MYRIAD Disclosed the leakage of an internal wallet’s private key, 10 markets voided and automatically refunded
BIBIBI
AT A GLANCE
MYRIAD said that the leaked private key of an internal wallet was used to manipulate 10 AMM markets, which will be voided and automatically refunded.
Article
MYRIAD Disclosed the incident involving the leakage of an internal wallet’s private key; the affected 10 markets will be voided and automatically refunded
BlockBeats reported that,October 28, according to an incident report published by the prediction market platform MYRIAD, the attacker used an internal wallet whose private key had been leaked to manipulate the settlement results on BNB Chain for 10 AMM markets. The attacker first bought low-probability outcomes, then used the wallet’s permissions to settle the markets in favor of the attacker and claim payouts. Within minutes of receiving an anomaly alert, the team revoked the wallet’s administrative permissions, preventing the attack from continuing.MYRIAD stated that the private key involved had been leaked several weeks earlier due to a vulnerability in a third-party library used by a backend service. The attacker’s final large purchase did not receive a payout; the team has revoked that position and transferred the funds in the wallet involved to a platform-controlled wallet.
The platform said that the attacker did not withdraw any funds. All 10 affected markets will be voided. Holders on both sides will automatically receive refunds calculated as “position size × the last price of the corresponding outcome before the attack”; any payouts already claimed will be deducted from the refunds, and no user action is required. Refunds will come from recovered funds and the market funds pool. Other markets were not affected and will continue operating normally.
Original link https://m.theblockbeats.info/flash/374040
Key points
01
BlockBeats cited an MYRIAD incident report as saying that the attacker used an internal wallet whose private key had been leaked to manipulate the settlement results on BNB Chain for 10 AMM markets.
02
The attacker first bought low-probability outcomes, then used the wallet’s permissions to change the settlement results and claim payouts.
03
The team revoked the administrative permissions of the wallet involved within minutes of receiving an anomaly alert.
04
MYRIAD said the private key had been leaked several weeks earlier due to a vulnerability in a third-party library used by a backend service.
05
MYRIAD said the attacker’s final large purchase did not receive a payout, and that the team had revoked the position and transferred the funds in the wallet involved.
06
The platform said the attacker did not withdraw any funds, and that the affected 10 markets would all be voided.
07
The platform said holders on both sides would receive automatic refunds calculated as “position size × the last price of the corresponding outcome before the attack”; any payouts already claimed would be deducted from the refunds, and users would not need to take any action.
08
Refunds will come from recovered funds and the market funds pool; the platform said other markets were not affected and would continue operating.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
A private key is effectively a wallet’s highest-level authorization credential. In this incident, the attacker allegedly obtained access to an internal wallet, bought a particular outcome in advance, and then used the permissions to settle the market in the attacker’s favor. The platform said it had revoked the permissions and planned to cancel the relevant markets and calculate refunds at prices from before the attack.
Why it matters to readers
The incident involved market settlement permissions and the fairness of 10 markets. Voiding the markets and arranging refunds may limit user losses, but the outcome of the implementation still requires subsequent confirmation.
If you hold positions in affected markets, the announcement says that you do not need to manually apply for a refund, but the refund amount will be calculated at the last price before the attack, and any payouts already claimed will be deducted. Users in other markets should also monitor the platform’s subsequent security remediation disclosures.
Risks and unknowns
The information in the article mainly came from the MYRIAD incident report; no independent on-chain or third-party verification was provided.
The name of the third-party library, vulnerability details, specific remediation measures, and the scope of the private key leakage were not disclosed.
10 The specific list of affected markets, refund amounts, and completion time were not disclosed.
Related Developments
Loading event timeline…
The platform’s claims that no funds were withdrawn, that other markets were unaffected, and that the funds have been recovered remain subject to independent verification.
Related concepts
Private key
This term is not in the glossary yet. Browse related concepts in the glossary.
