Malicious code on the website of forecasting platform Polymarket automatically sold the positions of some authorized traders and transferred their funds to hackers. As a result, Polymarket was forced to refund approximately $2.7 million to 726 wallets.
Malicious code on the website of forecasting platform Polymarket automatically sold the positions of some authorized traders and transferred their funds to hackers. As a result, Polymarket was forced to refund approximately $2.7 million to 726 wallets.
In particular, as The Hacker News reports, the code replaced a script for measuring page loading speed that the site downloaded from a third-party company.
Blockchain records show that the cryptocurrency arrived in the hackers’ wallet in less than an hour. The replaced script belonged to DebugBear, whose Real User Monitoring (RUM) tool measures the loading speed of web pages for visitors.
According to DebugBear on Platform X, the company’s DNS records were compromised through its domain registrar. Their initial findings indicate that the attack targeted only one customer’s website. The company has not found any signs of any intrusion into its own systems, although the investigation is ongoing.
Polymarket said it removed the script within an hour. It also cleared all cache, reset all active login sessions, and suspended trading until the site was fully cleaned up. Law enforcement was notified of the incident.
As of October 30, 689 of the 726 wallets affected by the malicious activity have received full refunds. Polymarket is also paying out $1.19 million to approximately 5,500 wallets that lost funds during the trading halt. In total, the platform is returning $3.9 million to traders.
As previously reported by dev.ua, fraudsters previously tried to launder $10 million through the Polymarket prediction market using stolen cards.
In June, hackers already attacked Polymarket users and stole $3 million in crypto.
