29-oktabrda bashorat bozori Polymarket veb-saytida zararli kod tizimga kirgan ba'zi treyderlarning pozitsiyalarini sotdi va ularning mablag'larini xakerlarga o'tkazdi. Kod sayt tashqi kompaniyadan yuklagan sahifa tezligini o'lchaydigan skriptni almashtirgan edi.
Polymarket 726 ta ta'sirlangan hamyonga taxminan 2,7 million dollarni qaytarib berayotganini aytdi. Blokcheyn yozuvlari shuni ko'rsatadiki, xakerlar hamyoniga bir soatdan kamroq vaqt ichida taxminan 2,64 million dollar qiymatidagi kripto yetib borgan.
Almashtirilgan skript DebugBear'dan kelgan bo'lib, uning haqiqiy foydalanuvchi monitoringi (RUM) vositasi haqiqiy tashrif buyuruvchilar uchun veb-sahifalar qanchalik tez yuklanishini o'lchaydi.
Hudson Rock tadqiqotchilari 29-oktabrda Polymarket sayti DebugBear skriptini yuklash uchun ishlatgan manzildan zararli faylni yuklab olishdi. Ular shuningdek, Polymarket sayt kodida DebugBear skriptini olib tashlagan o'zgarishni ham topishdi.
Kompaniya X'da aytishicha, DebugBear'ning DNS yozuvlari uning domen registratori orqali buzilgan. Uning dastlabki topilmalari hujum bitta mijoz veb-saytiga qaratilganligini ko'rsatadi. U o'z tizimlarida buzilish belgisi yo'qligini aytdi, ammo hali ham tekshirmoqda.
Ohey tadqiqotchilari zararli fayl hali ham onlayn bo'lganida, 18:13 UTC da DebugBear veb-manzillari uchun boshqa server javob berayotganini topishdi. O'sha kuni ertaroq, odatiy skript Google Cloud Storage'dan xizmat qilingan edi. Har bir DebugBear mijozi skriptning o'z nusxasini yuklaydi va almashtirilgan fayl Polymarket'nikidir.
Skript pulni qanday o'g'irladi
Hudson Rock faylni ishga tushirmasdan ko'rib chiqqach, kod tizimga kirgan treyderning ochiq Polymarket sahifasida allaqachon mavjud bo'lgan kirish huquqidan qayta foydalanishini aniqladi. U Polymarket brauzerda saqlaydigan hisob tafsilotlarini, jumladan savdo API kalitlari to'plamini o'qiydi.
Bu API kalitlari yolg'iz o'zi Polymarket'da buyurtma berish uchun yetarli emas, chunki buyurtmalar ham hamyon imzosini talab qiladi. Hudson Rock kodda kalitlar, parol, urug' iborasi yoki shaxsiy kalitni u xabar beradigan serverga yuboradigan hech qanday qism topmadi.
Buning o'rniga, kod Polymarket saytining buyurtma beradigan qismini va hisob operatsiyalarini tasdiqlaydigan imzochisini sahifada qidiradi.
So'ngra u ikki yo'ldan birini tanlaydi. O'z kripto hamyoni bilan tizimga kirgan hisoblar uchun u treyder pozitsiyalarini to'g'ridan-to'g'ri xakerlar hamyoniga o'tkazadi. Elektron pochta orqali tizimga kirgan hisoblar uchun u pozitsiyalarni tobora yomonroq narxlarda sotadi va keyin pulni chiqarib yuboradi.
Ikkala yo'lda ham kod hisobning o'z imzochisidan o'z so'rovlarini imzolashni so'raydi va ularni Polymarket relayeriga topshiradi, u esa ularni yuboradi. Hudson Rock aytishicha, imzolash so'rovi yolg'iz o'zi treyder ko'rmasdan imzolaganini isbotlamaydi. Hamyon provayderi hali ham treyderdan so'rashi, rad etishi yoki sessiya uchun o'z qoidalarini qo'llashi mumkin.
Kodga yozilgan hamyon Ohey'ning blokcheyn iziga ko'ra, birinchi mablag'ini 17:10 UTC da va oxirgisini 18:02 UTC da oldi. Bu vaqtda u 33 ta hamyondan 28,6 million POL token va pozitsiyalarni to'pladi.
18:19 UTC da, DefiLlama narxi $0,0922 bo'yicha, bu 28,6 million POL taxminan 2,64 million dollar qiymatida edi, deb hisoblagan DefiPrime. Bu raqam faqat POL ni qamrab oladi, pozitsiyalarni emas.
Hamyon 28,6 million POL ning barchasini 18:28 va 18:38 UTC orasida uchta boshqa manzilga yubordi, uning operatsiya tarixi shuni ko'rsatadi.
Polymarket'ning javobi va qaytarishlari
Polymarket foydalanuvchi hamyonlarida ruxsatsiz faoliyat haqida birinchi holat yangilanishini 17:38 UTC da e'lon qildi. 18:05 UTC da u o'z birjasining faqat bekor qilish rejimida ekanligini, relayer harakatlari to'xtatilganini aytdi.
Kompaniya skriptni "bir soat ichida" olib tashlaganini aytdi. U shuningdek, har bir keshni tozaladi, barcha faol kirish sessiyalarini qayta o'rnatdi va sayt toza bo'lguncha savdoni to'xtatdi. U ishni huquqni muhofaza qiluvchi organlarga yuborgan.
30-oktabrga kelib, 726 ta ta'sirlangan hamyonning 689 tasi to'liq qaytarib berilgan, qolgan 37 tasi tekshirilayotganda to'lanmoqda. Polymarket shuningdek, savdo to'xtatilishi paytida pul yo'qotgan yoki pozitsiyalari olingan taxminan 5 500 ta hamyonga 1,19 million dollar to'lamoqda. Umuman olganda, u treyderlarga 3,9 million dollar qaytarmoqda.
Treyderlar da'vo arizasi topshirishi shart emas. Polymarket'ning holat sahifasi o'z miqdori noto'g'ri deb o'ylaydigan yoki to'lov olishi kerak deb hisoblaydigan har kim uchun shaklga havola qiladi.
Saytlar va treyderlar nima qilishi mumkin
DebugBear o'z RUM mahsuloti mijozlariga o'z veb-saytlaridan uning joylashtirish kodini olib tashlashni aytdi. Zararli faylni xizmat qilgan manzil, cdn.debugbear[.]com, The Hacker News 1-noyabrda tekshirganida DNS yozuviga ega emas edi.
Polymarket uchinchi tomon skriptlarini qo'shimcha tekshiruvlar bilan, masalan, kuchliroq Kontent Xavfsizlik Siyosati (CSP), pinlangan versiyalar va sandboxing bilan qayta joylashtirayotganini aytdi.
Hudson Rock'ning tashqi skriptlarni yuklaydigan saytlar uchun maslahati:
- Foydalanuvchilar savdo qiladigan yoki imzo qo'yadigan sahifalarda keraksiz uchinchi tomon kodini saqlamang.
- Faylni pinlash mumkin bo'lgan joyda, Subresource Integrity (SRI) dan foydalaning, bu brauzerga fayl mazmuni o'zgarsa uni rad etish imkonini beradi. Ishonchli CDN ni shunchaki ruxsat beradigan xavfsizlik siyosati o'sha CDN xizmat qiladigan fayllarni tekshirmaydi.
- Tizimga kirgan sahifadagi kod imzochidan nima qilishni so'rashi mumkinligini tekshiring.
Hudson Rock'ning treyderlar uchun maslahati — kutmagan har qanday imzolash so'rovini rad etishdir.
Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company.
Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached the hackers' wallet in under an hour.
The replaced script came from DebugBear, whose real user monitoring (RUM) tool measures how fast web pages load for real visitors.
Researchers at Hudson Rock downloaded the malicious file on October 29 from the address Polymarket's site used to load the DebugBear script. They also found a change in Polymarket's site code that removed the DebugBear script.
DebugBear's DNS records were compromised through its domain registrar, the company said on X. Its early findings indicate the attack targeted one customer's website. It has seen no sign of a break-in to its own systems, though it is still looking.
Researchers at Ohey found a different server answering for DebugBear's web addresses at 18:13 UTC, when the malicious file was still online. Earlier that day, the normal script had been served from Google Cloud Storage. Each DebugBear customer loads its own copy of the script, and the file that was swapped was Polymarket's.
How the Script Took the Money
The code reuses the access a signed-in trader already has in an open Polymarket page, Hudson Rock found after reviewing the file without running it. It reads account details that Polymarket keeps in the browser, including a set of trading API keys.
Those API keys alone cannot place an order on Polymarket, because orders also need a wallet signature. Hudson Rock found no part of the code that sends the keys, a password, a seed phrase, or a private key to the server it reports to.
Instead, the code searches the page for the part of Polymarket's site that places orders, and for the signer that approves the account's transactions.
It then takes one of two paths. For accounts that sign in with their own crypto wallet, it moves the trader's positions straight to the hackers' wallet. For accounts that sign in via email, it sells positions at ever-worse prices and then moves the money out.
In both paths, the code asks the account's own signer to sign its requests and hands them to Polymarket's relayer, which submits them. Hudson Rock said a signing request alone does not prove a trader signed without seeing a prompt. The wallet provider may still ask the trader, refuse, or apply its own rules for the session.
The wallet written into the code received its first funds at 17:10 UTC and its last at 18:02 UTC, according to Ohey's blockchain trace. In that time, it collected 28.6 million POL tokens and positions from 33 wallets.
At 18:19 UTC, those 28.6 million POL were worth about $2.64 million at DefiLlama's price of $0.0922, DefiPrime calculated. The figure covers only the POL, not the positions.
The wallet sent all 28.6 million POL on to three other addresses between 18:28 and 18:38 UTC, its transaction history shows.
Polymarket's Response and Refunds
Polymarket posted its first status update about unauthorized activity in user wallets at 17:38 UTC. At 18:05 UTC, it said its exchange was in cancel-only mode, with relayer actions paused.
The company said it removed the script "within the hour." It also cleared every cache, reset all active login sessions and paused trading until the site was clean. It has referred the case to law enforcement.
By October 30, 689 of the 726 affected wallets had been refunded in full, and the remaining 37 were being paid as they were checked. Polymarket is also paying $1.19 million to about 5,500 wallets that lost money during the trading pause or had positions taken. In all, it is returning $3.9 million to traders.
Traders do not need to file a claim. Polymarket's status page links a form for anyone who thinks their amount is wrong or that they should have received a payment.
What Sites and Traders Can Do
DebugBear has told customers of its RUM product to remove its embed code from their websites. The address that served the malicious file, cdn.debugbear[.]com, had no DNS record when The Hacker News checked on November 1.
Polymarket said it is putting third-party scripts back in place with extra checks, such as a stronger Content Security Policy (CSP), pinned versions, and sandboxing.
Hudson Rock's advice for sites that load outside scripts:
- Keep unneeded third-party code off pages where users trade or sign.
- Where a file can be pinned, use Subresource Integrity (SRI), which lets the browser reject the file if its contents change. A security policy that simply allows a trusted CDN does not check the files that CDN serves.
- Check what code on a signed-in page can ask the signer to do.
Hudson Rock's advice for traders is to reject any signing request they did not expect.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.