Two major cryptocurrency platforms reported significant security breaches in recent days. Polymarket, a global prediction market platform, suffered a $2.7 million hack, while hardware wallet provider Ledger experienced losses of $2.7 million through a supply chain compromise in Singapore.
Polymarket Breach Details
The attack on Polymarket exploited a vulnerability in DebugBear, a third-party analytics tool integrated with the platform. The attacker injected malicious code that targeted authenticated users and active trades across more than 700 accounts.
The script liquidated user positions and transferred collateral funds to attacker wallets. Security researchers tracked 28.6 million POL tokens moving through a central wallet before being converted to USDC.e and distributed across three separate wallets in an attempt to obscure the transaction trail.
The breach affected only Polymarket's global platform, leaving its separately operated US service unaffected. The attacker was unable to withdraw a final batch of $750,000, which Polymarket immediately froze upon discovering the incident.
Response and Reimbursement
Polymarket placed its international exchange in cancel-only mode for approximately one hour while investigating the breach. After resolving the issue, normal operations resumed.
The company announced that all affected users would receive full reimbursement. The incident has been referred to UK law enforcement, as DebugBear is headquartered in the United Kingdom.
This marks the second major security incident at Polymarket. A previous breach in June targeted 15 high-net-worth individuals and resulted in $3 million in losses.
Ledger Supply Chain Compromise
Singapore police reported that Ledger's supply chain in the country was compromised as part of a broader wave of security incidents affecting companies across Asia. The compromise resulted in $2.7 million in losses, with investigations ongoing.
