Prediction market Polymarket just got hit by a classic supply chain attack, and it is a brutal reminder that even a secure smart contract can be undone by a compromised third-party script.

On October 29, malicious code on the Polymarket website sold some signed-in traders' positions and moved their funds to the hackers. The code had replaced a page-speed script that the site loaded from an outside company called DebugBear.

Polymarket says it is refunding about $2.7 million to 726 affected wallets, but blockchain records show crypto worth about $2.64 million reached the hackers' wallet in under an hour.

The DebugBear DNS Compromise

The replaced script came from DebugBear, whose real user monitoring (RUM) tool measures how fast web pages load for real visitors. This is a completely legitimate service, and that is what makes the attack so effective.

Researchers at Hudson Rock downloaded the malicious file on October 29 from the address Polymarket's site used to load the DebugBear script. They also found a change in Polymarket's site code that removed the DebugBear script.

DebugBear said its DNS records were compromised through its domain registrar. Its early findings indicate the attack targeted one customer's website, which was Polymarket. It has seen no sign of a break-in to its own systems, though it is still looking.

Researchers at Ohey found a different server answering for DebugBear's web addresses at 18:13 UTC, when the malicious file was still online. Earlier that day, the normal script had been served from Google Cloud Storage. Each DebugBear customer loads its own copy of the script, and the file that was swapped was Polymarket's.

How the Script Actually Took the Money

The code reused the access a signed-in trader already had in an open Polymarket page, which Hudson Rock found after reviewing the file without running it. It read account details that Polymarket keeps in the browser, including a set of trading API keys.

Those API keys alone cannot place an order on Polymarket, because orders also need a wallet signature. Hudson Rock found no part of the code that sends the keys, a password, a seed phrase, or a private key to the server it reports to.

Instead, the code searched the page for the part of Polymarket's site that places orders, and for the signer that approves the account's transactions.

It then took one of two paths.

• For accounts that sign in with their own crypto wallet: It moved the trader's positions straight to the hackers' wallet.
• For accounts that sign in via email: It sold positions at ever-worse prices and then moved the money out.

In both paths, the code asked the account's own signer to sign its requests and handed them to Polymarket's relayer, which submits them. Hudson Rock noted that a signing request alone does not prove a trader signed without seeing a prompt. The wallet provider may still ask the trader, refuse, or apply its own rules for the session.

The Timeline of the Attack

The wallet written into the code received its first funds at 17:10 UTC and its last at 18:02 UTC, according to Ohey's blockchain trace. In that time, it collected 28.6 million POL tokens and positions from 33 wallets.

At 18:19 UTC, those 28.6 million POL were worth about $2.64 million at DefiLlama's price of $0.0922, DefiPrime calculated. The figure covers only the POL, not the positions.

Polymarket's Response and Refunds

Polymarket posted its first status update about unauthorized activity in user wallets at 17:38 UTC. At 18:05 UTC, it said its exchange was in cancel-only mode, with relayer actions paused.

The company said it removed the script "within the hour." It also cleared every cache, reset all active login sessions and paused trading until the site was clean. It has referred the case to law enforcement.

By October 30, 689 of the 726 affected wallets had been refunded in full, and the remaining 37 were being paid as they were checked. Polymarket is also paying $1.19 million to about 5,500 wallets that lost money during the trading pause or had positions taken. In all, it is returning $3.9 million to traders.

Traders do not need to file a claim. Polymarket's status page links a form for anyone who thinks their amount is wrong or that they should have received a payment.

What Sites and Traders Can Do

DebugBear has told customers of its RUM product to remove its embed code from their websites. The address that served the malicious file, cdn.debugbear[.]com, had no DNS record when The Hacker News checked on November 1.

Polymarket said it is putting third-party scripts back in place with extra checks, such as a stronger Content Security Policy, pinned versions, and sandboxing.

Hudson Rock's advice for sites that load outside scripts is straightforward.

• Keep unneeded third-party code off pages where users trade or sign. If a script does not need to be on your checkout page, remove it.
• Use Subresource Integrity (SRI) where possible. SRI lets the browser reject the file if its contents change. A security policy that simply allows a trusted CDN does not check the files that CDN serves.
• Check what code on a signed-in page can ask the signer to do. Audit the permissions and capabilities your frontend exposes to third-party scripts.
• Traders should reject any signing request they did not expect. If your wallet prompts you to sign something you did not initiate, stop and verify.

FAQ

What happened at Polymarket?

A malicious script on Polymarket's website sold some traders' positions and moved funds to hackers on October 29. The script replaced a legitimate page-speed tool from DebugBear.

Was DebugBear hacked?

DebugBear said its DNS records were compromised through its domain registrar, not through a breach of its own systems. The attack targeted one specific customer: Polymarket.

Did the attackers steal private keys or seed phrases?

No. Hudson Rock found no code that exfiltrated private keys, seed phrases, or passwords. The script reused the trading session and asked the user's own signer to authorize requests.

How much was stolen and refunded?

About $2.64 million reached the hackers' wallet. Polymarket is refunding about $2.7 million to 726 affected wallets, and is paying an additional $1.19 million to wallets affected by the trading pause. Total refunds are $3.9 million.

How do I protect my crypto site from this kind of attack?

Remove unneeded third-party scripts from pages where users trade or sign. Use Subresource Integrity (SRI) to pin file contents. Audit what third-party code can ask your signer to do. And if you are a trader, reject any signing request you did not initiate.

Source : The Hacker News