Polymarket international platform hit by wallet thefts after third-party provider compromise

Hudson Rock found malicious JavaScript served via a DebugBear address tied to Polymarket. It read browser storage for account details, wallet address and trading API credentials, located a live trading client and signer in React components, and tried to move assets via position token transfers or by selling positions first, using the relayer for signatures and transactions. Researchers did not execute the sample, so this shows intended behaviour only. No CVE is given, and the exposure window and initial provider compromise method are unresolved. Defenders should audit third-party scripts on sensitive pages. Users should review orders and transactions, reject unexpected signing requests and check existing approvals, since disconnecting a wallet does not reverse transfers or revoke them.

For security analysts · Written by AI from 2 sources · Wrong?