Polymarket says it has fixed the third-party script supply-chain contamination incident and promises full compensation
BIBIBI
AT A GLANCE
GoPlus said that the RUM script from DebugBear was affected by supply-chain contamination, resulting in the theft of user assets on the Polymarket international site.
Article
GoPlus: The Polymarket hack was caused by supply-chain contamination of a script from service provider DebugBear RUM BlockBeats reports that October 30, GoPlus published a vulnerability analysis on social media stating that a user-asset theft incident occurred on the Polymarket international site. A script from third-party performance monitoring service provider DebugBear was RUM script was affected by supply-chain contamination, and malicious code was delivered to user pages and abused their trading and signing permissions.
On-chain analysis shows that the main path involved 710 DepositWallet，731 addresses, with losses of approximately 2710000 USD(the number of addresses does not represent the actual number of users).
Polymarket subsequently stated that it had fixed the issue and restored services, while promising to fully compensate affected traders. The actual compensation progress remains subject to subsequent official announcements.
Original link https://m.theblockbeats.info/flash/374581
Key points
01
GoPlus published a vulnerability analysis stating that a user-asset theft incident occurred on the Polymarket international site.
02
GoPlus said that a RUM script from third-party performance monitoring service provider DebugBear was affected by supply-chain contamination.
03
Malicious code was delivered to user pages and abused trading and signing permissions.
04
On-chain analysis shows that the main path involved 710 addresses, with losses of approximately DepositWallet、731 2710000 USD。
05
The original text explicitly states that the number of addresses does not represent the actual number of users.
06
Polymarket said it had fixed the issue and restored services, while promising to fully compensate affected traders.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This was a third-party script supply-chain security incident: a DebugBear RUM script loaded by the page was contaminated, allowing malicious code to enter user pages and exploit trading and signing permissions. The number of addresses listed in the report cannot be directly treated as the number of affected users.
Why it matters to readers
The incident involved approximately 2710000 USD in losses, and the risk originated from a third-party script; although Polymarket said the issue had been fixed, the actual compensation situation still requires waiting for subsequent announcements.
Beginners should handle transaction and signing requests on webpages cautiously and pay attention to the affected scope and compensation announcements subsequently issued by the platform.
Risks and unknowns
Approximately 2710000 USD represents the loss figure provided by on-chain analysis; the full scope of the impact has not yet been confirmed.
710 addresses and DepositWallet 731 addresses do not equal the actual number of affected users.
Polymarket promised full compensation, but the actual compensation progress remains pending subsequent official announcements.
DebugBear RUM The specific reasons for the script's contamination and the full scope of its impact are not stated in the evidence.
Related Developments
Loading event timeline…
Related concepts
Supply-chain compromise
This term is not in the glossary yet. Browse related concepts in the glossary.
