Some Polymarket users report losing funds after security breach
Some users of the crypto-based prediction market Polymarket reported losing more than $2 million Thursday after malicious code was served through the company’s official website. Polymarket has promised to refund affected users.
The issue was first discovered at around 17:30 UTC (1:31 p.m. ET) on Thursday when several users reported that their wallets had been “drained” by an unknown party who sold all of their shares. It’s unclear how many users were affected.
People monitoring the situation said Polymarket’s official website was compromised when code from analytics company DebugBear began serving malicious code. This code was then used to gather information about active users and exploited trading credentials from the user’s local storage.
“It sells every open position: first at 3% under market, then at half price, then at the lowest possible price,” one user wrote. “It then swaps your whole balance to POL or USDC and sends it to the attacker.”
The malicious code disappeared from the Polymarket website at around 18:00 UTC (2 p.m. ET), when trading was suspended.
“We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement,” a Polymarket employee said in an update.
It added: “Anyone who has been impacted will be made whole.”
It was not immediately clear how much money had been stolen but transaction records put the figure at around $2.6 million. Trading on Polymarket resumed at 3 p.m. ET. DebugBear, which is based in the UK, said it was aware of the “ongoing security incident” and urged customers using its RUM product to remove the embed code.
