Two vendor breaches in four months put Polymarket’s supply-chain security under scrutiny

Attackers drained an estimated $2.7 million from hundreds of Polymarket traders on October 29, and for the second time this year the money left through a vendor the company trusted rather than through anything its own users did wrong. As Casino.org first reported , the breach ran through DebugBear, a UK-based provider of website performance-monitoring software whose script was embedded on Polymarket’s site. A modified script on DebugBear’s infrastructure, identified by security researchers at Hudson Rock, executed inside traders’ logged-in sessions on the legitimate Polymarket website, scanned balances and open positions, liquidated holdings and moved the assets to an attacker…