Trading Paused on Polymarket
Polymarket has implemented a temporary halt on trading by shifting to an "order cancellation only" mode. This decision follows alarming reports from users indicating that unauthorized transactions had occurred, leading to significant losses.
Details of the Security Incident
Data collected by Arkham has identified a specific wallet, suspected of being linked to the attacker, that contains around $2.65 million in POL (Polygon’s token). Previously, this wallet was active, facilitating multiple exchanges from USDC.e to POL via a service known as Relay.
Hudson Rock has revealed that a problematic script found on DebugBear may have enabled this breach, as it appears to have been programmed to deplete users’ wallets while also incorporating a hard-coded fallback address for receiving stolen assets.
User Warnings and Accounts Affected
Users expressed their frustration on social media, reporting the frontend of the Polymarket platform may have been compromised. Affected users have seen their funds removed without their consent. One trader named CarOnPolymarket shared on X that they lost a staggering $800,000, stressing the importance of securing accounts: "If you are a Polymarket user, please lock your account immediately." Additionally, another user mentioned that a friend was deprived of approximately $600,000.
Polymarket's Response
In response to the crisis, Polymarket confirmed that the breach originated from a third-party service provider. The team is collaborating with law enforcement and assured users that all affected individuals will be fully compensated for their losses.
The implicated wallet address, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, exhibited activity just before the reporting of the incidents. After around five minutes of inactivity, concerns arose regarding the wallet's potential link to the security breach.
Investigation into the Breach
The script from DebugBear reportedly aimed to seek out active trading sessions of logged-in users, attempt to liquidate their holdings, and subsequently transfer the assets to designated addresses. While the script has since been deleted from Polymarket's production site, Hudson Rock is still investigating the breach's origins and the extent of the user impact.
This incident is just one of several security challenges that Polymarket has faced in recent months. Earlier this year, a private key vulnerability led to the theft of about $700,000 from an internal deposit wallet. The platform experienced another breach following a third-party compromise, costing around $3 million in losses to a handful of users, which prompted Polymarket to promise full reimbursements to those affected.
As this story develops, users are advised to approach the platform with caution and stay updated on further information from Polymarket.
