Polymarket international platform hit by wallet thefts after third-party provider compromise
- Severity
- High
- Sources
- 3
What happened
Hudson Rock found malicious JavaScript served via a DebugBear address tied to Polymarket. It read browser storage for account details, wallet address and trading API credentials, located a live trading client and signer in React components, and tried to move assets via position token transfers or by selling positions first, using the relayer for signatures and transactions. Researchers did not execute the sample, so this shows intended behaviour only. No CVE is given, and the exposure window and initial provider compromise method are unresolved. Defenders should audit third-party scripts on sensitive pages. Users should review orders and transactions, reject unexpected signing requests and check existing approvals, since disconnecting a wallet does not reverse transfers or revoke them.
For security analysts · Written by AI from 3 sources · Wrong?
What to do
- If you have an account with the company, change that password, and anywhere you used the same one.
- Turn on two-step sign-in where you can.
- Expect scam emails and texts that mention the breach: contact the company yourself, not through links.
General advice for this kind of story
Full story timeline · 3 updates
Who reported · 3 outlets
Who and what is in it
Companies