orchestra conductor
chi
Joined September 2014
- Tweets56.3K
- Following3.1K
- Followers16K
- Likes176K
having claude design some logos/symbols/icons from scratch and it literally cannot stop iterating six pointed stars and swastikas
When you're up by 50 and swish the buzzerbeater from half court
Written account of Jesus rising from the dead identified in 2,000-year-old manuscript, study suggests trib.al/caFpzVT
i mean, i knew elon acknowledging crypto was a bad thing i just didn't think it would come back to rape us that fast
oh great cant wait to read details about the polymarket hack from *squints* @ TheFatMbappe on X dot com the Everything app
Polymarket Incident Breakdown (Oct 29)
We have traced 2.724M pUSD across 721 source wallets in transactions paying the recipient embedded in a DebugBear-hosted drainer.
1. The Payload & Delivery: The malicious code was served from [cdn.debugbear.com/C7xcKKrjUn…](cdn.debugbear.com/C7xcKKrjUn…) inside the real DebugBear namespace.
2. Attack Mechanism (Browser-Side Compromise)T
The script reads Polymarket wallet/auth state, walks React internals to hook the live trading client and signer, and uses EIP-712 DepositWallet batch signatures alongside Polymarket’s own relayer. No seed-phrase extraction occurs in this payload.
It executes via two theft paths (targeting portfolios and positions over $10):
External wallets: Positions are transferred directly.
Magic accounts: Positions are sold first, then collateral is swept.
3. Routing & On-Chain ProofThe coded route stays on Polygon (pUSD → USDC.e → POL or USDC → recipient) using quotes via api.fun.xyz, with a direct USDC.e transfer as a fallback.
4. Money Trail
18:17 UTC: Embedded recipient 0x3F991...Ffc18 held 28.636M POL (representing converted proceeds, not a separate loss total) and forwarded 25 position IDs to 0x5a276...0c0b.
18:21 UTC: The second wallet (0x5a276...0c0b) sold/redeemed those positions and held 4,262.36 pUSD.
5.Polymarket’s public production build at 17:59 UTC includes "remove debugbear rum script", confirming removal in the observed build.
More data coming
