The prediction platform Polymarket faced a "supply chain" attack that led to the draining of millions of dollars from traders' accounts on its international platform. The platform announced a temporary suspension of trading on October 29 after detecting unauthorized withdrawals, confirming that it will compensate all those affected by this incident.
Attack Mechanism: Exploiting Monitoring Tools
Researchers at Hudson Rock revealed that the attack did not directly target Polymarket's infrastructure, but was carried out via malicious code (JavaScript) injected through DebugBear, a British company specializing in website performance monitoring.
The malicious code exploited DebugBear's "Real User Monitoring" (RUM) tool to perform the following:
- Searching for trading tools and wallets of users who were already logged in.
- Exploiting available permissions in authenticated sessions without the need to directly steal passwords, private keys, or recovery phrases.
- Selling users' financial positions or transferring tokens directly to addresses controlled by the attackers.
Estimates of Financial Losses
Figures regarding the scale of the theft vary based on analyses available from cybersecurity companies:
- Hudson Rock estimated approximately $2.19 million in the attacker's address pre-programmed in the code.
- While the cybersecurity company GoPlus indicated that losses could reach $2.71 million, noting that the attack passed through 710 deposit wallets and 731 different addresses.
For its part, DebugBear confirmed it had suffered a security incident and urged its users to immediately remove its software (snippet) from their websites, noting that it has sought the help of specialized incident response experts. It is worth noting that the US platform for Polymarket was not affected by this attack.
Why Does This News Matter?
This incident highlights increasing risks in software security, as it is no longer sufficient to secure only the main platform; all tools and services operating in the "background" (third-party dependencies) must also be secured. Targeting performance monitoring tools (RUM) represents a serious threat because these tools inherently possess the ability to interact with the user interface, making them an ideal target for executing attacks that exploit authenticated session permissions without the need to breach traditional passwords, which changes the rules of the game in how third-party risks are assessed.