Polymarket says it is returning $3.9 million to traders following last week’s supply chain attack. Website performance monitoring firm DebugBear, meanwhile, has disclosed that its DNS records were compromised.
On October 29, the prediction market halted trading on its international platform after users reported unauthorized withdrawals. Hudson Rock researchers linked the activity to malicious JavaScript served from a DebugBear address that Polymarket’s site loaded.
The script targeted logged-in traders. It checked their portfolios, and then either dumped positions or shifted assets to a wallet chosen by the attacker. The code read credential-related data stored in the browser, but Hudson Rock saw no evidence of it sending passwords, seed phrases or private keys back to the attacker. Instead, it piggybacked on the trading permissions of the open session.
In an October 30 update, Polymarket said 726 wallets were affected. At that point, all but 37 had been made whole, and the rest were being paid once their details were checked.
Polymarket is also covering traders hurt by the trading halt or whose positions were sold or transferred by the malicious script, paying out $1.19 million across roughly 5,500 wallets. Together with the roughly $2.7 million stolen directly, that brings the payout to $3.9 million.
“The attack came through a compromised 3rd party provider which we removed within the hour. We are in active investigation with law enforcement & will share a postmortem,” Polymarket said.
DebugBear, whose real user monitoring (RUM) script lets websites measure page load performance for visitors, initially told customers to remove the embed code and has now shared its initial findings.
“Our DNS server records were compromised through our domain registrar. We are currently unable to receive emails sent to our domain,” the company said.
According to DebugBear, the attackers appear to have gone after one customer’s website specifically, though it stressed that this is a preliminary finding. It did not name the customer, and Polymarket has not named the compromised provider.
DebugBear has not explained how the attackers obtained access at the registrar level, and its investigation is ongoing. The company said it found no indication that its internal systems were compromised.
Polymarket faced a similar incident in June, when it said a third-party vendor compromise resulted in a malicious script being injected into its frontend. The theft was reported at around $3 million.
Related Content
Cybercrime
$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.
Data Breaches
Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net
The data of So-net and Plala customers in Japan was exposed, along with 54,401 email account passwords and 16 bank account records.
Data Breaches
HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
Hackers stole personal information and iRhythm account and device data from third-party-hosted business applications.
Data Breaches
Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
A leaked SquareML access key could have been used to access a database containing personal and health information.
Data Breaches
Genesys Hack Exposes Customer Data From Internal Systems
The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected.
Data Breaches
11 Million Impacted by Capcom Data Breach
The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts.
Data Breaches
Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
In a regulatory filing, Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders.
Data Breaches
Hackers Steal 1.8 Million Records From Nikkei
The compromised information includes names, addresses, email addresses, phone numbers, and dates of birth.
