Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
A credential leak at About Million is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
A credential leak at About Million is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
Anyone connected to About Million through the compromised trust relationship is potentially affected, not just About Million itself.
There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.
The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.
About Million says the credential has been revoked, and no exploitation has been confirmed so far.
If you have any integration or dependency involving About Million, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.
What happened
A credential leak at About Million is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
Who is affected
Anyone connected to About Million through the compromised trust relationship is potentially affected, not just About Million itself.
Why it matters
There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.
Technical details
The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.
Response
About Million says the credential has been revoked, and no exploitation has been confirmed so far.
What security teams should do
If you have any integration or dependency involving About Million, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.