Polymarket to Pay $3.9m After DebugBear DNS Hijack

Polymarket is returning $3.9 million to traders following a supply chain attack linked to a DNS hijack at website performance monitoring firm DebugBear.

The incident, which caused Polymarket to halt trading on its international platform on 29 October, involved malicious JavaScript served from a DebugBear address.

Researchers at Hudson Rock identified that the script targeted logged-in traders by checking their portfolios and either dumping positions or shifting assets to wallets chosen by the attackers.

The malicious code read credential-related data stored in browsers, but Hudson Rock found no evidence that passwords, seed phrases, or private keys were sent to the attackers. Instead, the script exploited the permissions of active, open trading sessions.

Polymarket reported that approximately 726 wallets were affected. The company is paying out roughly $2.7 million to cover directly stolen funds, alongside $1.19 million to compensate traders for losses resulting from the trading halt and unauthorised position transfers.

DebugBear confirmed that its DNS server records were compromised via its domain registrar. The firm stated it is currently unable to receive emails sent to its domain due to the compromise.

Initial findings from DebugBear suggest the attackers appeared to target a single customer specifically, although the investigation remains ongoing. The company noted it has found no indication that its internal systems were compromised.

This event marks the second major supply chain incident for Polymarket. In June, the platform reported a similar compromise involving a third-party vendor that led to a malicious script injection and approximately $3 million in theft.