Polymarket compromised through a third party provider

[BitBakerr1]

I am not sure whether one can truly evade responsibility by placing all blame on third party provider and vendor.

I understand that they have promised to provide compensation, that is fair enough. But such misappropriation of over $2.65 million and draining of account belonging to more than 700 user cannot be dismissed as minor error!

Moreover similar kind of security breach and scandal occurred just last month too?
So, is it our responsibility to repeatedly check for these third party vulnerabilities?
Or is it from their platform?

In one of the latest news reports, I saw a figure of $3.9 million mentioned as the amount stolen in the hack. For a platform of this size, that kind of loss is hardly significant. I think that's exactly why they aren't paying much attention to the number of users who were hacked. They're only concerned about the amount of money stolen, and since it's relatively small, they don't seem to consider it a major incident either.

Binance exchange did a very wonderful job in making sure that they handle the situation very well, hack can happen to any organization or any company and when the money stole is very big you don’t expect the company or organization to make everything right at a time.

Binance have done what they can do and I won’t blame them for anything, the money they lost is not a small amount of money, big companies will close down if they lose that kind of money to hackers.
Binance said they will cover all losses and that’s good.

[Karl_3000]

ofI think it's normal to see the entire ecosystem panic. It's only a matter of time for everything to die down when they get to find out, especially since Binance have reimbursed at least 90% of the lost funds to the affected people ( For the liquid assets), and the remaining 10% is currently under the process. I think new source information says they have increased it by 5%, making it 95 in total. That's a rapid way to clear off almost $7 billion in debt

This can be off-topic because this thread supposed to be about Polymarket breach and not Binance breach. The official statement is still that it is 90% and not 95%. That has been what I have only seen online till now. If you want to quote me, you can do that on the Binance breached discussion thread on the exchange board. Polymarket breach should not be what people should be worried about. I know when I saw the news that it will not be beyond Polymarket capability.

[o48o]

-cut-
In one of the latest news reports, I saw a figure of $3.9 million mentioned as the amount stolen in the hack. For a platform of this size, that kind of loss is hardly significant. I think that's exactly why they aren't paying much attention to the number of users who were hacked. They're only concerned about the amount of money stolen, and since it's relatively small, they don't seem to consider it a major incident either.

Users don't care either as they already said that they will cover losses.

Weird how our goalposts have changed from "hardly significant" when it's $3.9 million hacked, considering that whole crypto was used to be marketed as safer then banks. When banks are robbed $3.6 million worth of cash, it's so unusual, that there will be movies made out of it.

As a side note, i just noticed that that polymarket is trying to brand themselves as "trading market".
Is this a new legal approach, or am i just noticing it because their distancing from gambling sites has been a hot topic (for legal reasons)?

[oll]

As posted on their official X handle a short while ago, a third party provider was compromised which led to some traders losing funds, meanwhile all trading has been halted out of caution.
They've also promised to refund those affected.

We've identified & fixed an issue impacting our international platform, Polymarket⁠.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.

Anyone who has been impacted will be made whole.

Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online.

Source

If I understand correctly, the thread about this incident was posted here an hour before yours.

https://bitcointalk.org/index.php?topic=5598271.msg67290397#msg67290397

In any case, I want to point out that large companies—Polymarket is certainly a large and successful company—have begun to outsource their work to small IT contractors too often. By doing so, they save themselves money, but not ours. Remember the recent exchange hacks via chat windows? Those were also hacks via a third-party IT contractor. I understand that these crypto services choose contractors based on the principle of "cheapest is best," but that's not right. They should understand that hackers are starting to hack at the rate of 10 touches a day. Thet can't skimp on security.

[xenomorfo]

As posted on their official X handle a short while ago, a third party provider was compromised which led to some traders losing funds, meanwhile all trading has been halted out of caution.
They've also promised to refund those affected.

We've identified & fixed an issue impacting our international platform, Polymarket⁠.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.

Anyone who has been impacted will be made whole.

Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online.

Source

what did i tell you? Better to stay far away, or very far away from this kind of places.
I've said it in all the posts that talk about polymarket, it's not fun at first and it only makes you lose money and make the usual suspects rich.
Stay away and you will live peacefully.

[Merit.s]

what did i tell you? Better to stay far away, or very far away from this kind of places.
I've said it in all the posts that talk about polymarket, it's not fun at first and it only makes you lose money and make the usual suspects rich.
Stay away and you will live peacefully.

Polymarket might not be fun to you but it's fun to someone. Because you don't like it doesn't mean you it's bad. Will you also encourage people to stay away from gambling because it's more of losses than profit because casinos and Polymarket are the same thing.

[sompitonov]

what did i tell you? Better to stay far away, or very far away from this kind of places.
I've said it in all the posts that talk about polymarket, it's not fun at first and it only makes you lose money and make the usual suspects rich.
Stay away and you will live peacefully.

I understand this too, but the thing is, many players are looking for the thrill, the adrenaline, and the euphoric rush that comes from placing bets or making predictions especially regarding geopolitics. Even after a purely lucky guess, they want to believe they are top-tier experts and tell everyone around them so. They might claim, for instance, that everything is about to change and that, for this "pseudo-bettor," a whole new chapter is finally beginning...

[hedgeh0g]

I understand this too, but the thing is, many players are looking for the thrill, the adrenaline, and the euphoric rush that comes from placing bets or making predictions especially regarding geopolitics. Even after a purely lucky guess, they want to believe they are top-tier experts and tell everyone around them so. They might claim, for instance, that everything is about to change and that, for this "pseudo-bettor," a whole new chapter is finally beginning...

Even if Polymarket has been hacked, that doesn’t mean such breaches will stop. In the crypto space, everyone needs to take security much more seriously especially as AI continues to evolve, enabling increasingly sophisticated attacks. Beyond the risk of our accounts or the prediction market platforms themselves being compromised, there is also the inherent risk of simply losing one’s wagers. Given the sheer number of risks involved, now is the perfect time to reconsider whether participating is even worth it. Perhaps it would be better to explore safer alternatives platforms or games where we might hold a greater advantage.

[ZeroVinsonN]

what did i tell you? Better to stay far away, or very far away from this kind of places.
I've said it in all the posts that talk about polymarket, it's not fun at first and it only makes you lose money and make the usual suspects rich.
Stay away and you will live peacefully.

I could say the same thing about casinos but I won't because that's not how life works, I might not be a fan of prediction market but that's because I don't agree with some of the services they offer but I'm not the whole planet and if I don't appreciate it someone else will.
Plus if Polymarket was somehow running a campaign here on this forum we'd probably still wear their signature, and that's something a lot of people who claim to hate gambling do, you hate something and yet you are willing to promote their services, it shouldn't work that way.
I gamble, some other people don't, them saying gambling isn't fun isn't going to change my view on it, I will probably just ignore them because they don't know anything about it which is exactly how someone who uses Polymarket will react to a comment like this one.

[Dogedegen]

As posted on their official X handle a short while ago, a third party provider was compromised which led to some traders losing funds, meanwhile all trading has been halted out of caution.
They've also promised to refund those affected.

We've identified & fixed an issue impacting our international platform, Polymarket⁠.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.

Anyone who has been impacted will be made whole.

Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online.

Source

Not another, I've read about this in another thread but finally found myself here. The software and platforms that are built in modern times are horrible. They are just focused on delivering things fast, build build build and it is all horribly vulnerable. The best platform does not use any 3rd party providers and does not have 50 script sources of all kinds of javascript. While going this way does make things much easier than building things yourself, with each thing it introduces huge complexity and makes attacking easier. I don't know if they will finally learn their lesson and stop building platforms this way, but from what I can observe in crypto the last few years it is not getting better. These is Bitcoin and its security first approach, and then there are shitcoins and all the platforms built around that that are just about building fast junk.

what did i tell you? Better to stay far away, or very far away from this kind of places.
I've said it in all the posts that talk about polymarket, it's not fun at first and it only makes you lose money and make the usual suspects rich.
Stay away and you will live peacefully.

I could say the same thing about casinos but I won't because that's not how life works, I might not be a fan of prediction market but that's because I don't agree with some of the services they offer but I'm not the whole planet and if I don't appreciate it someone else will.
Plus if Polymarket was somehow running a campaign here on this forum we'd probably still wear their signature, and that's something a lot of people who claim to hate gambling do, you hate something and yet you are willing to promote their services, it shouldn't work that way.
I gamble, some other people don't, them saying gambling isn't fun isn't going to change my view on it, I will probably just ignore them because they don't know anything about it which is exactly how someone who uses Polymarket will react to a comment like this one.

Don't listen to biased people anyway, a lot of them talk against polymarket for two reasons. One is a primary and that is envy. Average people can't stand it that other people are making big money, so they invent arguments against them and label it all evil. Polymarket is evil and I could do it better! That kind of nonsense.  The only fair recommendation would be to stay away from all gambling, and I am pretty sure regular casinos are much more addictive than prediction markets anyway.

[Hazink]

A big loss for the cryptospace this year because there are numerous hacks here and there. If not directly, it will be from a third-party provider. I hope this will give casinos and exchanges a better clue on how to prevent further hacks in future because it seems that Ai is really helping the hackers to achieve their evil goals.

A lot have been happening this year. Almost every sector has witnessed their own fair share of these hackers, and they are not even stopping, no matter what means they use to gain access, the end result is usually that they succeed in stealing before they are discovered, and what keeps on surprising me is how they keep on succeeding even after news of hack have spread instead of exchanges to learn from it, they appear more reluctant as if it can never get to them.

[Ojima-ojo]

what did i tell you? Better to stay far away, or very far away from this kind of places.
I've said it in all the posts that talk about polymarket, it's not fun at first and it only makes you lose money and make the usual suspects rich.
Stay away and you will live peacefully.

Polymarket might not be fun to you but it's fun to someone. Because you don't like it doesn't mean you it's bad. Will you also encourage people to stay away from gambling because it's more of losses than profit because casinos and Polymarket are the same thing.

Poly market have market volume and that shows that many people find it as fun and truly it fund and business as like, since we can't say for sure that predictions market will offer the same fun and entertaining games like our traditional casinos are offering?


Another concern in about this poly market third party vulnerability that happen, I wonder why is happening all at once and for me I think poly market is still very early in the market to get hacked like this, and just wondering how much impact the exploit will have on the liquidity.

[CucakRowo]

As posted on their official X handle a short while ago, a third party provider was compromised which led to some traders losing funds, meanwhile all trading has been halted out of caution.
They've also promised to refund those affected

Failure isn't just that another third party hack has occurred. Actual problem is that item, which most sites classify as having virtually no risk were granted full access during live trading session.

Once that RUM tag was replaced and drainer was installed, there was no longer any need for smart contract.

Polymarket has begun issuing refund promptly and has cited law enforcement, this is the absolute minimum requirement. But why do high value sites still load external analytic and monitoring code on authenticated page? As long as this bad habit persist, these front end supply chain attack will continue to occur. It  does not matter how robust on chain security.

[alegotardo]

Failure isn't just that another third party hack has occurred. Actual problem is that item, which most sites classify as having virtually no risk were granted full access during live trading session.

Once that RUM tag was replaced and drainer was installed, there was no longer any need for smart contract.

Polymarket has begun issuing refund promptly and has cited law enforcement, this is the absolute minimum requirement. But why do high value sites still load external analytic and monitoring code on authenticated page? As long as this bad habit persist, these front end supply chain attack will continue to occur. It  does not matter how robust on chain security.

I do not really understand what happened there, but they have certainly already learned from these mistakes so they can protect themselves and prevent it from happening again.
The only thing I am sure about is that there is no point in investing in smart contract security and on chain security if the risk is still in the user's browser, which executes privileged external code... what is the point of having a robust backend!? The defense needs to start with the frontend architecture, minimizing third-party privileges... implementing layered security and restricting access by levels.

Anyway... I do not think the problem is bad RUM, I think the surface layer that was attacked was poorly designed... allow a third party script to obtain too many privileges within an authenticated trading page is an architectural flaw, plain and simple.