Polymarket says it will return $3.9 million after script hack
Polymarket says it will give $3.9 million back to traders after a hacked script drained wallets on its site, The Record and SecurityWeek report. That covers about $2.7 million that was stolen. It also covers losses from the trading halt that followed, the company said.
Polymarket, a site where people bet on future events, says it will pay $3.9 million to traders hurt by last week's hack. The money covers the theft. It also covers losses from the time the site stopped trading to fix the problem.
About $2.7 million of the total covers money that was stolen outright, The Record and SecurityWeek report. SecurityWeek reports that $1.19 million goes to roughly 5,500 wallets. Those traders lost out during the halt, or the bad script sold or moved their bets. The Record puts that second amount at $1.2 million.
Traders do not have to apply, Polymarket said. It said it found the wallets that qualify by using blockchain and trading data, The Record reports.
The Record reports that 95% of the affected wallets had been paid back in full as of Saturday. SecurityWeek cites a Polymarket update from October 30. It said 726 wallets were hit, and all but 37 had been made whole at that point.
On October 29, a bad script took the place of a page speed tool from DebugBear that Polymarket's site loaded, SecurityWeek reports. The code used traders' open sessions to sell their bets or move their money to the attacker. Polymarket said it removed the script, paused trading and signed everyone out, The Record reports.
“Our DNS server records were compromised through our domain registrar,” DebugBear said, SecurityWeek reports. DebugBear has not said how the attackers got that access, the outlet reports. It said it saw no sign that its own systems were broken into.
Polymarket set out the payout in a report on what went wrong, The Record reports. The company said it has contacted law enforcement and is looking into who was behind the attack. It did not answer The Record's question on how many people were hurt.
What we know: Polymarket says it is paying back the stolen money and the halt losses, as its own update shows.
What we don't: How many people were hurt, and how the attackers took over DebugBear's records.
Where outlets agree The Record and SecurityWeek agree, citing Polymarket, that the payout covers the money stolen in the hack and the losses from the trading halt.
Where they differ The cited reports agree on the key facts so far.