Polymarket 29-oktabrda foydalanuvchilar ruxsatsiz yechib olishlar haqida xabar berganidan so'ng o'z xalqaro platformasida savdoni to'xtatdi.
Bashorat bozorining holat sahifasiga ko'ra, birja avval faqat bekor qilish rejimiga o'tkazildi va relayer harakatlari to'xtatildi.
"Biz xalqaro platformamiz Polymarket.com ga ta'sir qilgan muammoni aniqladik va tuzatdik. Bizning 3-tomon provayderlarimizdan biri buzilgan va biz bu haqda tegishli huquqni muhofaza qiluvchi organlarga murojaat qildik. Ta'sirlangan har kim to'liq qoplanadi," deb aytdi kompaniya.
Savdo taxminan bir soat o'tib qayta tiklandi va Polymarket ta'sirlangan barcha treyderlarga to'lov qilishni va'da qildi. U sotuvchini nomlamadi va yo'qotishlarni oshkor qilmadi.
Tadqiqotchilar o'g'irlikni Buyuk Britaniyada joylashgan veb-sayt ishlashini kuzatish firmasi DebugBear'dan tarqatilgan zararli kod bilan bog'lashdi. Polymarket'ning AQSh platformasi ta'sirlanmagani xabar qilindi.
DebugBear "davom etayotgan xavfsizlik hodisasi ta'sirida" ekanligini tasdiqladi va o'zining real foydalanuvchi kuzatuvi (RUM) mahsulotidan foydalanadigan foydalanuvchilarga uning snippetini veb-saytlaridan olib tashlashni so'radi. Shuningdek, u maxsus hodisa javob beruvchilarni jalb qilganini aytdi.
Hudson Rock Polymarket tomonidan ishlatiladigan DebugBear manzilidan zararli JavaScript nusxasini oldi. Kod kirgan foydalanuvchining savdo vositalari va portfelini qidirgan. Hisob turiga qarab, u keyin pozitsiyalarni sotish va daromadni ko'chirishga, yoki pozitsiya tokenlarini to'g'ridan-to'g'ri hujumchi belgilagan manzilga yuborishga uringan.
"Namuna hisob ma'lumotlari bilan bog'liq materialni o'qiydi, lekin bizning ko'rib chiqishimizda hisob ma'lumotlari xaritasini, parolni, urug' iborasini yoki shaxsiy kalitni o'zining hisobot nuqtasiga yuboradigan tartib aniqlanmadi. Uning asosiy yondashuvi autentifikatsiyalangan ilovada allaqachon mavjud bo'lgan vakolatni qayta ishlatishdir," dedi Hudson Rock.
Firma shuningdek, 17:59 UTC vaqti bilan belgilangan Polymarket ishlab chiqarish qurilmasini ham aniqladi, unda DebugBear skriptini olib tashlash haqida o'zgartirish eslatmasi bor.
Yo'qotish raqamlari farq qiladi. Hudson Rock ko'rib chiqqan skrinshot skriptning qattiq kodlangan zaxira manzilida taxminan 2,19 million dollarni ko'rsatdi, garchi firma bu tasdiqlangan hisob emasligini aytdi.
Blokcheyn xavfsizlik firmasi GoPlus, u ham hujumni DebugBear'ning RUM skriptining ta'minot zanjiri buzilishiga bog'ladi, yo'qotishlarni taxminan 2,71 million dollar deb baholaydi. Uning zanjirdagi tahliliga ko'ra, asosiy hujum yo'li 710 depozit hamyon va 731 manzil orqali o'tgan, garchi manzil soni jabrlanuvchilar soniga teng emas.
Arkham ma'lumotlari shubhali hujumchi hamyonida taxminan 2,65 million dollar borligini ko'rsatdi. Bu skriptda zaxira qabul qiluvchi sifatida qattiq kodlangan o'sha manzil.
Hudson Rock skript qanday buzilganini yoki qancha foydalanuvchi ta'sirlanganini aniqlamadi. Uning topilmalari boshqa DebugBear mijozlari nishonga olinganini ko'rsatmaydi.
Hujum Binance taxminan 6 milliard dollarlik xakerlik hujumiga uchragan o'sha kuni sodir bo'ldi, blokcheyn razvedka firmalari buni Shimoliy Koreyaga bog'lashdi. Iyun oyida Polymarket o'zining old qismiga zararli skript kiritgan yana bir uchinchi tomon buzilishini oshkor qildi va yo'qotishlar taxminan 3 million dollar deb xabar qilindi.
Bog'liq: Arizona sud tizimiga kiberhujumda 1 milliondan ortiq kishining shaxsiy ma'lumotlari o'g'irlandi
Bog'liq: Ribon Apps xakerligi orqali BigCommerce ma'lumotlari o'g'irlandi
Bog'liq: Xakerlar Liquid Network'dan o'g'irlangan 263 million dollarni qaytarishdi
Polymarket halted trading on its international platform on October 29 after users reported unauthorized withdrawals.
According to the prediction market’s status page, the exchange was first switched to cancel-only mode, with relayer actions suspended.
“We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole,” the company said.
Trading resumed about an hour later, and Polymarket pledged to reimburse all affected traders. It has not named the vendor or disclosed losses.
Researchers have linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm. Polymarket’s US platform was reportedly unaffected.
DebugBear confirmed being “impacted by an ongoing security incident” and urged users of its real user monitoring (RUM) product to pull its snippet from their websites. It also said it brought in specialist incident responders.
Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.
“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,” Hudson Rock said.
The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.
Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.
Blockchain security firm GoPlus, which also attributed the attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.
Arkham data showed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.
Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.
The attack came the same day Binance was hit by a roughly $6 billion hack that blockchain intelligence firms have attributed to North Korea. In June, Polymarket disclosed another third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.
Related: Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System
Related: BigCommerce Data Stolen via Ribon Apps Hack
Related: Hackers Return $263 Million Stolen From Liquid Network