GoPlus: Approximately $2.71 million in Polymarket user assets stolen, attack source points to third-party monitoring service supply chain compromise

on October 30, the GoPlus Chinese community published a vulnerability analysis stating that on October 29 (UTC), user assets were stolen from Polymarket's international site. The RUM script of third-party performance monitoring provider DebugBear was compromised through a supply chain attack, allowing malicious code to be injected into user pages, which then abused trading and signing permissions to facilitate asset transfers.

On-chain analysis indicates that the attack involved 710 DepositWallets and 731 addresses, resulting in losses of approximately $2.71 million. The attacker obtained user account context via the malicious script, leveraged existing signers to construct malicious orders and asset transfer requests, and executed transactions via the Polymarket relayer, ultimately swapping USDC.e for POL and transferring them to the attacker's address.

Polymarket subsequently announced that the issue has been resolved and services restored, committing to fully compensate affected traders. The specific cause of the DebugBear compromise remains under further investigation.