Polymarket to Refund $2.7 Million Following Script Hijacking Attack

Polymarket is refunding approximately $2.7 million to 726 affected traders after a supply chain attack allowed hackers to steal cryptocurrency funds via a hijacked third-party script.

The incident occurred on 29 October and involved the compromise of a page-speed script provided by the external service DebugBear. The malicious code was injected into the script that Polymarket loads, enabling attackers to target signed-in users directly on the platform.

Mechanism of the Theft

The hijacked code allowed attackers to sell the positions of active traders and subsequently move the funds to hacker-controlled wallets. While blockchain records indicate that approximately $2.64 million was successfully moved, Polymarket has stated it will refund the full $2.7 million to the victimised wallets.

This attack highlights the significant risks associated with third-party dependencies. By compromising a legitimate script used for site performance and optimisation, threat actors can bypass many standard security layers of the host platform to execute unauthorised actions within a user’s browser session.