Polymarket hacked: prediction market platform loses $2.5 million

On Thursday, prediction market platform Polymarket temporarily suspended trading after hackers compromised a third-party service and injected malicious JavaScript code to steal cryptocurrency assets, resulting in about $2.5 million being siphoned off.

• Polymarket temporarily halted trading on Thursday following a major security compromise.
• Hackers infiltrated a third-party monitoring service, DebugBear, injecting malicious JavaScript.
• Approximately $2.5 million in cryptocurrency was transferred to a wallet controlled by attackers.
• The company confirmed that all affected users will receive full compensation for their losses.

The Attack Vector via DebugBear

Cybersecurity researchers from Hudson Rock discovered that the malicious JavaScript was distributed via cdn.debugbear.com, a web performance monitoring service. The script was specifically designed to hijack active user trading sessions, liquidate positions on prediction markets, and drain funds.

The malicious software evaluated visitor authentication, checked cryptocurrency balances, and inspected prediction market holdings. Depending on the user's authentication method, the script automatically sold positions or transferred market tokens directly to attacker-controlled wallets.

Scope of Losses and Blockchain Analysis

Blockchain analysis by BleepingComputer revealed that the primary suspicious wallet associated with the exploit received around 28.6 million POL tokens and subsequently distributed funds across multiple addresses. At the time of investigation, the wallet held roughly $2.19 million worth of assets.

Polymarket swiftly removed the vulnerable monitoring integration and placed the exchange into a safe mode. Trading resumed approximately one hour after the initial suspension, while the incident details were handed over to law enforcement agencies.

What This Means for Users and the Market

This security breach highlights the inherent risks of relying on third-party vendors and external scripts within financial and web3 ecosystems. Even when a primary platform maintains strict security protocols, a single compromised auxiliary provider can introduce massive vulnerabilities.

For Polymarket users, the situation is being mitigated by the company's commitment to fully reimburse all losses. Nevertheless, the event serves as a stark reminder of the critical need for rigorous supply chain security and external dependency audits in the crypto industry.