Polymarket Security Breach: What Happened and How to Protect Yourself
On October 29, 2023, a significant security incident occurred at Polymarket, a prediction market platform. An injection of malicious code on their site led to the unauthorized liquidation of signed-in traders’ positions, resulting in a theft totaling approximately $2.64 million. The breach was facilitated through a compromised external script used for monitoring page load speeds.
Details of the Attack
The malicious code replaced a JavaScript file loaded from DebugBear, a service that provides real-user monitoring for web pages. The alteration to Polymarket’s website was detected by researchers from Hudson Rock, who noted that the infected script was delivered from the same source used for this monitoring tool.
DebugBear’s domain registrar was compromised, allowing malicious actors to modify the necessary DNS records. The company stated on X that initial investigations revealed a specific targeting against one of their customers, with no indications of broader intrusions into their systems.
Mechanism of the Exploit
Upon examination, Hudson Rock revealed how the malicious code operated. It exploited the authenticated session of signed-in users by accessing account details cached in the browser, such as trading API keys. However, these keys alone were insufficient for placing orders, as wallet signatures were also required.
In the exploit, the code searched for the components on Polymarket’s site responsible for the trading process and transaction approvals. The script followed two distinct pathways depending on the authentication method:
- Crypto Wallet Sign-In: Directly transferred the trader’s positions to the hackers’ wallet.
- Email Sign-In: Sold positions at progressively lower prices before transferring the funds out.
In both scenarios, the code effectively prompted the account’s wallet signer to authorize transactions, leveraging the user’s active session. The theft occurred swiftly, with the hackers amassing funds between 17:10 and 18:02 UTC.
Immediate Response from Polymarket
Polymarket reacted promptly to the breach, issuing an update regarding unauthorized activities at 17:38 UTC and subsequently implementing a cancel-only trading mode by 18:05 UTC. The compromised script was removed shortly thereafter, and all affected user sessions were reset. The platform pledged to reimburse affected users approximately $2.7 million across 726 wallets, with an additional $1.19 million allocated to users who suffered losses during the trading freeze.
By October 30, most affected wallets had been refunded, with a total refund amounting to $3.9 million. Users were not required to file claims, as Polymarket streamlined the refund process through automatic evaluations.
Recommendations for Users and Websites
In the aftermath of this incident, both DebugBear and Polymarket have issued recommendations to enhance security:
- Remove unnecessary third-party scripts from pages where financial actions are taken.
- Utilize Subresource Integrity (SRI) to ensure that only untampered versions of scripts are executed.
- Check for unsolicited signing requests when interactions with digital wallets are prompted.
For traders, it is crucial to be vigilant and reject any signing requests that seem unexpected or unauthorized.
Conclusion
This breach underscores the ongoing cybersecurity challenges faced by online trading platforms and the importance of robust security measures for both service providers and users. As digital environments evolve, it is essential for all stakeholders to remain proactive in safeguarding their assets and information.
