MYRIAD discloses internal wallet private key leak incident, will invalidate 10 markets and automatically refund

BlockBeats news, October 28 — According to an incident report released by prediction market platform MYRIAD, attackers exploited an internal wallet with a leaked private key to manipulate the settlement outcomes of 10 AMM markets on BNB Chain. The attackers first bought low-probability outcomes, then used the wallet's permissions to settle the markets in their own favor and claim payouts. Within minutes of receiving an anomaly alert, the team revoked the wallet's admin permissions, stopping the attack from continuing. MYRIAD stated that the private key involved was leaked weeks earlier due to a vulnerability in a third-party library used by its backend services. The attackers' last large purchase did not receive a payout; the team has voided that position and transferred the funds from the involved wallet to a platform-controlled wallet.

The platform said the attackers did not withdraw any funds. All 10 affected markets will be voided entirely, and holders on both sides will automatically receive refunds calculated as "position size × the last price of the corresponding outcome before the attack." Payouts already claimed will be deducted from the refunds, with no user action required. Refund funds come from recovered funds and the market liquidity pools. Other markets were unaffected and continue to operate normally.