Hackers steal about $2.7 million from Polymarket traders via hijacked script
CRYPTODebugBearredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A third-party page-speed script loaded by Polymarket's website from DebugBear was replaced with malicious code on October 29, which sold positions and moved funds for signed-in traders. Polymarket says it is refunding about $2.7 million to 726 wallets, and blockchain records show crypto worth about $2.64 million reached attacker-controlled addresses. The article gives no CVE or affected versions. Teams that load third-party scripts should review how those scripts are integrity-checked and monitored.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check your Polymarket account and wallet activity for unexpected position sales or transfers around October 29.
- Watch for refund communications from Polymarket if your wallet was affected.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News
Who and what is in it
Companies