An analysis of the October 29 Polymarket security incident showing how a compromised third-party domain registrar enabled malicious code injection via an external script, bypassing browser sessions to drain funds and positions.
On October 29, unknown individuals changed code on Polymarket’s website, replacing a file that the company was uploading from an external partner. The problem was started by DebugBear, a company that measures the speed of websites. According to DebugBear, its Internet address settings were compromised by the company that manages its names, while the company itself reported that it did not detect a breach in its own systems.
How did the code work?
The malicious code exploited the users' already active login on the page. It read account information stored in the web browser, including digital keys, and searched for the points on the website that perform transactions.
Depending on how each user logged in, the system either transferred the positions directly to the perpetrators’ wallets or sold the positions at very low prices to raise the funds. In less than an hour, approximately $2,64 million worth of digital currencies arrived in the perpetrators’ wallets, which were then quickly transferred to other addresses.
The company's reaction and refunds
Polymarket detected the unauthorized activity, posted a status update, and suspended transactions. The company removed the malicious code, cleared caches, reset all active connections, and notified authorities.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
How artificial intelligence helps negotiate with hackers demanding ransom
↗
A total of 726 wallets were affected by the attack. The company announced that it is refunding funds to users, bringing the total refunds to $3,9 million, which includes funds for affected wallets and compensation to those who lost funds during the outage.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)