Bashorat bozori platformasi Polymarket payshanba kuni savdoni vaqtincha to'xtatdi, chunki xakerlar uchinchi tomon xizmatini buzib, kriptovalyutani o'g'irlovchi JavaScript tarqatishdi; taxminan 2,5 million dollar aktivlar gumon qilinayotgan hujumchi hamyoniga kuzatildi.
Kompaniya xavfsizlik hodisasini tasdiqladi va o'zining xalqaro platformasi Polymarket.com ga ta'sir qilgan muammoni aniqlab, tuzatganini hamda buzilishni huquqni muhofaza qiluvchi organlarga yuborganini aytdi.
"Bizning uchinchi tomon provayderlarimizdan biri buzildi va biz bu haqda tegishli huquqni muhofaza qiluvchi organlarga murojaat qildik," — dedi Polymarket.
"Ta'sirlangan har bir kishi to'liq qoplanadi. Ehtiyot chorasi sifatida biz savdoni vaqtincha to'xtatdik va platformani qayta onlayn qilish ustida ishlayapmiz."
Polymarket dastlab o'z birjasini 14:05 ET da faqat bekor qilish rejimiga o'tkazdi va hodisani tekshirayotganda relayer harakatlarini to'xtatdi. Soat 14:37 da kompaniya muammo tuzatilganini va savdo ehtiyot chorasi sifatida vaqtincha to'xtatilganini e'lon qildi.
Savdo dastlabki to'xtatilishdan taxminan bir soat o'tib qayta tiklandi, hodisa 15:05 ET da hal qilingan deb belgilandi.
"Savdo endi to'liq onlayn qaytdi," — deb e'lon qildi kompaniya X da. "Biz buni to'g'rilaymiz va ta'sirlangan barcha savdogarlarni to'liq qoplaymiz."
Polymarket qancha foydalanuvchi ta'sirlanganini, qancha kriptovalyuta o'g'irlanganini yoki qoplash jarayoni qanday ishlashini oshkor qilmadi.
Hudson Rock xavfsizlik tadqiqotchilari zararli JavaScript ichiga joylashtirilgan gumon qilinayotgan hujumchi nazoratidagi hamyonni (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) aniqladilar.
BleepingComputer'ning hamyonning blokcheyn faoliyatini tekshiruvi shuni ko'rsatdiki, u taxminan 28,6 million POL ni, ya'ni taxminan 2,57 million dollarni, uchta qo'shimcha hamyonga o'tkazgan.
Blokcheyn yozuvlari shuningdek, hamyon Polymarketning bashorat bozori token shartnomasi bilan 13:50 dan 13:56 ET gacha, birja savdoni to'xtatishidan biroz oldin, ko'plab tranzaksiyalarni amalga oshirganini ko'rsatadi.
Hudson Rock o'z tekshiruvi paytida hamyon taxminan 2,19 million dollar kriptovalyutaga ega bo'lganini xabar qildi.
Hamyonlarni o'g'irlovchi zararli JavaScript
Hudson Rock xavfsizlik tadqiqotchilari cdn.debugbear[.]com/C7xcKKrjUnXK.js orqali tarqatilgan zararli JavaScript ni aniqladilar, u Polymarket foydalanuvchilaridan kriptovalyuta va bashorat bozori aktivlarini o'g'irlash uchun mo'ljallangan.
Skript veb-sayt yuklanish tezligi va foydalanuvchi tajribasini kuzatishda tashkilotlarga yordam beradigan veb-sayt ishlash monitoringi xizmati DebugBear ga tegishli infratuzilmada joylashtirilgan.
DebugBear'ning Real User Monitoring (RUM) xizmati veb-saytlarga joylashtirilgan JavaScript dan foydalanib, tashrif buyuruvchilarning brauzerlaridan ishlash ko'rsatkichlarini yig'adi.
DebugBear shundan beri davom etayotgan xavfsizlik hodisasini tekshirayotganini tasdiqladi va mijozlarga monitoring JavaScript ni veb-saytlaridan olib tashlashni ogohlantirdi.
"Biz davom etayotgan xavfsizlik hodisasidan ta'sirlanganmiz," — dedi DebugBear X dagi postida.
"Agar siz bizning RUM mahsulotimizdan foydalansangiz, iltimos, joylashtirish kodini veb-saytingizdan olib tashlang."
Yozish paytida DebugBear veb-sayti kirish mumkin emas edi va Cloudflare xatosini ko'rsatardi. Veb-sayt uzilishi hodisani cheklash harakatlari bilan bog'liqmi yoki hodisaning boshqa oqibati ekanligi aniq emas.
Hudson Rock tadqiqotchilari shuningdek Polymarket ishlab chiqarish qurilishi metama'lumotlarida "chore(polymarket): remove debugbear rum script (#15337)" commit xabarini topdilar, bu platforma DebugBear monitoring integratsiyasini olib tashlaganini ko'rsatadi.
Qurilish 29-oktabr 13:59 ET da, Polymarket hodisani ommaviy e'lon qilishidan biroz oldin, vaqt belgisi bilan belgilangan.
BleepingComputer zararli JavaScript faylining nusxasini (VirusTotal) tahlil qildi va u autentifikatsiyalangan Polymarket savdo sessiyalarini o'g'irlash, foydalanuvchilarning bashorat bozori pozitsiyalarini tugatish va kriptovalyuta hamda boshqa aktivlarni hujumchi nazoratidagi hamyonga o'tkazish uchun mo'ljallanganini aniqladi.
Zararli dastur tashrif buyuruvchi Polymarket ga kirganligini tekshiradi va ularning mavjud savdo sessiyasi hamda platformaning savdo funksiyasidan foydalanib, ruxsatsiz tranzaksiyalarni amalga oshirishga harakat qiladi.
So'ngra u foydalanuvchining kriptovalyuta balanslari va bashorat bozori pozitsiyalarini tekshirib, aktivlarining qiymatini aniqlaydi.
Foydalanuvchi Polymarket ga qanday autentifikatsiya qilganiga qarab, zararli dastur ularning aktivlarini turli usullar bilan o'g'irlashga harakat qiladi.
Ba'zi foydalanuvchilar uchun u ularning bashorat bozori pozitsiyalarini avtomatik ravishda sotishga harakat qiladi. Boshqalar uchun zararli dastur ularning bashorat bozori tokenlarini to'g'ridan-to'g'ri hujumchi nazoratidagi hamyonga o'tkazishga harakat qiladi.
Zararli JavaScript Polymarket foydalanuvchilarining bashorat bozori tokenlarini hujumchi nazoratidagi hamyonga o'tkazishga harakat qiladi Manba: BleepingComputer
Zararli dastur shuningdek foydalanuvchilarning kriptovalyuta aktivlarini Polymarketning mavjud tranzaksiya funksiyasidan foydalanib, hujumchi nazoratidagi hamyonga o'tkazilishi mumkin bo'lgan aktivlarga aylantirishga harakat qiladi.
BleepingComputer zararli skript data.debugbear.com bilan bog'lanib, ko'rsatmalar olish va maqsadli hisoblar, hamyon manzillari, balanslar va tranzaksiya natijalari haqida ma'lumot yuborish uchun foydalanilganini aniqladi.
Zararli skriptni tarqatish va buyruq-nazorat (C2) hamda ma'lumot o'g'irlash serveri sifatida xizmat qilish uchun DebugBear infratuzilmasidan foydalanish hujumchilarning kompaniya tizimlariga qanchalik kirish huquqiga ega bo'lganligi haqida savollar tug'diradi.
BleepingComputer Polymarket va DebugBear bilan hodisa haqida savollar bilan bog'landi va agar javob olsak, ushbu maqolani yangilaydi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlarning ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet.
The company confirmed the security incident, saying it had identified and fixed the issue affecting its international platform, Polymarket.com, and referred the breach to law enforcement.
"One of our third party providers was compromised, and we have referred this to relevant law enforcement," Polymarket said.
"Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online."
Polymarket initially placed its exchange into cancel-only mode at 2:05 p.m. ET and paused relayer actions while investigating the incident. At 2:37 p.m., the company announced that the issue had been fixed and that trading was temporarily halted out of an abundance of caution.
Trading resumed approximately one hour after the initial suspension, with the incident marked resolved at 3:05 p.m. ET.
"Trading is now fully back online," the company announced on X. "We'll make this right and are fully reimbursing all affected traders."
Polymarket has not disclosed how many users were affected, how much cryptocurrency was stolen, or how the reimbursement process will work.
Security researchers at Hudson Rock identified a suspected attacker-controlled wallet (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) embedded in the malicious JavaScript.
BleepingComputer's examination of the wallet's blockchain activity found that it transferred approximately 28.6 million POL, valued at roughly $2.57 million, to three additional wallets.
Blockchain records also show that the wallet conducted numerous transactions involving Polymarket's prediction-market token contract between 1:50 p.m. and 1:56 p.m. ET, shortly before the exchange suspended trading.
Hudson Rock reported that the wallet held approximately $2.19 million in cryptocurrency at the time of its investigation.
Malicious JavaScript used to drain wallets
Security researchers at Hudson Rock identified malicious JavaScript distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js that was designed to steal cryptocurrency and prediction-market holdings from Polymarket users.
The script was hosted on infrastructure belonging to DebugBear, a website performance-monitoring service that helps organizations track website loading speeds and user experience.
DebugBear's Real User Monitoring (RUM) service uses JavaScript embedded in websites to collect performance metrics from visitors' browsers.
DebugBear has since confirmed that it is investigating an ongoing security incident and warned customers to remove its monitoring JavaScript from their websites.
"We're impacted by an ongoing security incident," DebugBear said in a post on X.
"If you use our RUM product, please remove the embed code from your website."
At the time of writing, DebugBear's website was inaccessible, displaying a Cloudflare error. It is unclear whether the website outage is related to containment efforts or another consequence of the incident.
Hudson Rock's researchers also discovered Polymarket production build metadata containing the commit message, "chore(polymarket): remove debugbear rum script (#15337),"indicating that the platform had removed the DebugBear monitoring integration.
The build was timestamped October 29 at 1:59 p.m. ET, shortly before Polymarket publicly announced the incident.
BleepingComputer analyzed a copy of the malicious JavaScript file (VirusTotal), finding that it was designed to hijack authenticated Polymarket trading sessions, liquidate users' prediction-market positions, and transfer cryptocurrency and other assets to an attacker-controlled wallet.
The malware checks whether a visitor is logged into Polymarket and attempts to use their existing trading session and the platform's trading functionality to carry out unauthorized transactions.
It then checks the user's cryptocurrency balances and prediction-market positions to determine the value of their holdings.
Depending on how the user authenticated to Polymarket, the malware attempts to steal their assets in different ways.
For some users, it tries to automatically sell their prediction-market positions. For others, the malware attempts to transfer their prediction-market tokens directly to an attacker-controlled wallet.
Malicious JavaScript attempts to transfer users' Polymarket prediction-market tokens to an attacker-controlled wallet Source: BleepingComputer
The malware also attempts to convert users' cryptocurrency holdings into assets that can be transferred to an attacker-controlled wallet, using Polymarket's existing transaction functionality.
BleepingComputer found that the malicious script communicated with data.debugbear.com to receive instructions and send data about targeted accounts, wallet addresses, balances, and transaction results.
The use of DebugBear's infrastructure to both distribute the malicious script and serve as a command-and-control (C2) and data exfiltration server raises questions about the how much access the attackers had to the company's systems.
BleepingComputer has contacted Polymarket and DebugBear with questions about the incident and will update this article if we receive a response.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report