On October 29, a cyberattack targeted Polymarket, a prediction market platform, by exploiting a vulnerability in a third-party script. The attackers hijacked a page-speed monitoring script from DebugBear, a tool used to measure webpage loading speeds, and inserted malicious code. This breach affected 726 wallets, resulting in approximately $2.7 million being drained. Polymarket responded by refunding affected traders and implementing additional security measures.

Researchers from Hudson Rock discovered that the compromised script was downloaded from the DebugBear address used by Polymarket. The attackers manipulated the script to leverage the access of signed-in traders, capturing account details and trading API keys. However, executing trades required a wallet signature, which the malicious code cleverly bypassed by manipulating Polymarket's transaction signing process.

The attack was facilitated by a compromise in DebugBear's DNS records at their domain registrar, although DebugBear stated that its systems were not breached. The attackers managed to redirect the script to their server, enabling them to execute trades without the users' consent.

Polymarket took immediate action by removing the compromised script, clearing caches, pausing trading, and resetting login sessions. The company started issuing refunds, and by October 30, most affected wallets had been reimbursed. They are also compensating wallets impacted by the trading pause. Moving forward, Polymarket is reinstating third-party scripts with enhanced security measures such as stronger Content Security Policies and sandboxing.

DebugBear advised its customers to remove its RUM product embed code from their websites. Hudson Rock recommended that traders be cautious and reject any unexpected signing requests.