Evan Luthra@EvanLuthra2D
bearish🚨995 Polymarket accounts just got drained through Polymarket's own website. Let me explain how, because this one should scare everyone in crypto.
No fake link. No shady airdrop. These people were on the real Polymarket dot com on Thursday.
Polymarket's site loaded a script from DebugBear, a tool whose only job is measuring how fast the page loads. Somebody poisoned it.
Once it was running in your browser, it grabbed your logged-in trading session and started dumping every open position you had, first at 3% under market, then at half price, then at the lowest price possible. Then it swapped the whole balance into POL and shipped it to the attacker. Stablecoins can be frozen. POL can't.
It even reported back after every hit. Your wallet, your country, your portfolio size, whether the transfer went through. All of it sent home through DebugBear's own data endpoints.
The attacker's wallet went from empty to $2M in about 45 minutes. Conor Grogan's final count was $2.65M.
One trader said he lost $800K and watched every position get sold. His friend got hit for $600K.
Polymarket flipped the exchange to cancel-only, paused the relayer and says everyone will be made whole. Credit where it's due.
But this is the third time this year. About $700K in May. About $3M in June, through a hacked third-party script, same as now.
I've been phished. I've been drained. Stay in crypto long enough and it happens to you. But the people on Thursday did nothing wrong. They opened the right website.
Not one of these three hacks touched a smart contract. We spent ten years making the blockchain unbreakable and then let a page speed tracker sit right next to people's money.
评论
暂无评论