GoPlus: About $2.71 Million in Polymarket User Assets Stolen; Attack Source Points to Supply Chain Compromise of Third-Party Monitoring Service

According to Shenchao TechFlow, on October 30, the GoPlus Chinese community published a vulnerability analysis stating that on October 29 (UTC), user assets were stolen on the Polymarket international site. The RUM script of third-party performance monitoring service provider DebugBear was compromised through a supply chain attack; malicious code was injected into user pages and exploited transaction and signing permissions to carry out asset transfers.

On-chain analysis shows that the attack involved 710 DepositWallets and 731 addresses, with losses of approximately $2.71 million. The attacker obtained user account context through the malicious script, invoked existing signers to construct malicious orders and asset transfer requests, executed transactions through the Polymarket relayer, and ultimately swapped USDC.e for POL and transferred it to the attacker's address.

Polymarket subsequently stated that the issue had been fixed and services had been restored, and pledged full compensation to affected traders. At present, the specific cause of the attack on DebugBear is still awaiting further investigation.

Source: Shenchao TechFlow