Polymarket Faces Second Major Security Breach in Four Months
Polymarket has restored trading as of October 29, after a security breach caused by a compromised third-party provider disrupted its international prediction market. This incident marks the second significant breach in just four months, following a website-script attack on June 25 that reportedly drained around $3 million from user accounts. The recurrence of these breaches raises critical questions regarding the security of financial transactions conducted through the platform.
The official incident record indicates that trading restrictions were in place from 18:05 UTC until resolution at 19:05 UTC. Polymarket has stated that it has addressed the issue, referred the matter to law enforcement, and assured that affected users will be compensated. However, the implications of this breach extend beyond merely replacing a compromised supplier, as investigations suggest that malicious code has been able to access sensitive financial functions within the trading interface.
In June, Polymarket disclosed that a malicious script was injected through a compromised vendor. According to a Source Defense investigation, the affected dependency has since been removed, and users are expected to receive full refunds. The investigation revealed that the June attack targeted wallets with balances exceeding $100,000, repeatedly requesting digital authorizations through Polymarket's own infrastructure.
The October breach involved a different approach, with recovered code searching for trading tools within a logged-in session. Analysis by Hudson Rock identified a script that sought to interact with the live trading client and its signer, which is responsible for requesting cryptographic authorization. This script was designed to perform various actions based on account type, including requesting position-token transfers or sales and proceeds transfers.
Consequences of the Recent Breach
Despite the thorough investigation, Hudson Rock's static review did not conclusively prove the execution of silent signatures or private-key theft, leaving the extent of user exposure unresolved. Blockchain analytics firm Bubblemaps estimates that over 700 Polymarket users were affected by the October breach, with approximately $3.46 million in assets compromised. Attackers reportedly converted about $2.7 million into POL tokens and transferred them out, while another $750,000 remained on the platform at the time of the assessment.
The nature of third-party scripts poses inherent risks, as they can access other scripts and data on the page. The different delivery methods used in the June and October breaches highlight the vulnerabilities within the platform's security architecture. To mitigate these risks, Polymarket could benefit from reducing reliance on external code, constraining signing requests, and verifying downloaded files.
Intelligence Reviewed
Implementing Subresource Integrity would allow browsers to compare downloaded scripts against expected cryptographic fingerprints, rejecting any altered content. A detailed postmortem report outlining the exposure window, affected accounts, and authorization paths would aid in assessing the remaining risks and ensuring that no further breaches occur due to compromised integrations.
The unresolved question remains whether another compromised integration could allow unauthorized access to the trading interface, potentially leading to further financial losses for users. As Polymarket navigates these challenges, it is crucial for the platform to enhance its security protocols and restore user confidence in its trading environment. The ongoing investigations and the implementation of robust security measures will be vital in preventing future breaches and protecting user assets.
