Ma'lumotlar Buzilishi
Polymarket Treyderlarga 3,9 Million Dollarni Qaytaradi, DebugBear esa DNS O'g'irlanishini Keltiradi
DebugBear o'z DNS yozuvlari domen registratori orqali buzilganini aytadi va dastlabki topilmalar bitta mijoz nishonga olinganini ko'rsatadi.
Eduard Kovacs
| 2026-yil 2-noyabr (ET 5:33)
Polymarket o'tgan haftadagi ta'minot zanjiri hujumidan so'ng treyderlarga 3,9 million dollarni qaytarayotganini aytadi. Veb-sayt ishlashini kuzatuvchi firma DebugBear esa o'z DNS yozuvlari buzilganini ma'lum qildi.
29-oktabrda bashorat bozori xalqaro platformasida savdoni to'xtatdi, chunki foydalanuvchilar ruxsatsiz yechib olishlar haqida xabar berishdi. Hudson Rock tadqiqotchilari faoliyatni Polymarket sayti yuklagan DebugBear manzilidan taqdim etilgan zararli JavaScript bilan bog'lashdi.
Skript tizimga kirgan treyderlarni nishonga oldi. U ularning portfellarini tekshirdi, so'ngra pozitsiyalarni sotib yubordi yoki aktivlarni hujumchi tanlagan hamyonga o'tkazdi. Kod brauzerda saqlangan ma'lumotlarga oid ma'lumotlarni o'qidi, ammo Hudson Rock parollar, urug' iboralari yoki shaxsiy kalitlar hujumchiga qaytarib yuborilganiga dalil topmadi. Buning o'rniga, u ochiq sessiyaning savdo ruxsatlaridan foydalanib harakat qildi.
30-oktabrdagi yangilanishda Polymarket 726 hamyon ta'sirlanganini aytdi. O'sha paytda 37 tadan tashqari barchasi to'liq qoplangan edi, qolganlari esa ularning ma'lumotlari tekshirilgandan so'ng to'lanmoqda.
Polymarket shuningdek, savdo to'xtatilishi yoki zararli skript tomonidan pozitsiyalari sotilgan yoki o'tkazilgan treyderlarga ham to'lov qilmoqda, taxminan 5 500 hamyon bo'yicha 1,19 million dollar to'lanmoqda. To'g'ridan-to'g'ri o'g'irlangan taxminan 2,7 million dollar bilan birga, bu to'lovni 3,9 million dollarga yetkazadi.
"Hujum bir soat ichida olib tashlagan buzilgan 3-tomon ta'minotchisi orqali keldi. Biz huquqni muhofaza qiluvchi organlar bilan faol tergovda va postmortemni ulashamiz," — dedi Polymarket.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
DebugBear, uning real foydalanuvchi kuzatuvi (RUM) skripti veb-saytlarga tashrif buyuruvchilar uchun sahifa yuklanish tezligini o'lchash imkonini beradi, dastlab mijozlarga o'rnatish kodini olib tashlashni aytdi va endi o'zining dastlabki topilmalarini ulashdi.
"Bizning DNS server yozuvlarimiz domen registratorimiz orqali buzildi. Hozirda biz domenimizga yuborilgan elektron pochta xabarlarini qabul qila olmayapmiz," — dedi kompaniya.
DebugBear ma'lumotiga ko'ra, hujumchilar bitta mijozning veb-saytiga maxsus hujum qilgan ko'rinadi, garchi bu dastlabki topilma ekanligini ta'kidladi. U mijoz nomini aytmadi va Polymarket ham buzilgan ta'minotchini nomlamadi.
DebugBear hujumchilar registrator darajasida qanday qilib kirish huquqini olganini tushuntirmadi va tergov davom etmoqda. Kompaniya o'z ichki tizimlari buzilganiga hech qanday dalil topmaganini aytdi.
Polymarket iyun oyida ham shunga o'xshash hodisani boshdan kechirdi, o'shanda uchinchi tomon ta'minotchisi buzilishi natijasida zararli skript uning old qismiga kiritilganini aytdi. O'g'irlik taxminan 3 million dollar deb xabar berildi.
Bog'liq: FBI Shimoliy Koreyaning Binance O'g'irlanishi bilan Bog'liq 600 dan Ortiq Manzilni Belgiladi
Bog'liq: Cisco SD-WAN Nol Kunlik Foydalanish Volt Typhoonning 'Jim Poyezd' Tarmog'iga Bog'liq
Bog'liq: PHP2Shell Hujumlari Palo Alto Fayervolini Ildizdan Olib Tashladi, Ammo WordPressga Qarshi Muvaffaqiyatsiz Bo'ldi
Yozgan: Eduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek'da katta boshqaruvchi muharrir. U jurnalistika karerasini 2011-yilda boshlashdan oldin o'rta maktab IT o'qituvchisi bo'lib ishlagan. Eduard sanoat informatikasi bo'yicha bakalavr darajasiga va elektr muhandisligida kompyuter texnikasi qo'llanilishi bo'yicha magistr darajasiga ega.
Kundalik Axborot Byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek Elektron Pochta Axborotiga obuna bo'ling.
Biznes Elektron Pochta*
emailsignupsource
Ko'proq ma'lumot olish uchun Maxfiylik Siyosatimizni o'qing.
Eduard Kovacsdan Ko'proq
- Drupal Commerce Core Zaifligi Onlayn Do'konlarga Qarshi Foydalanildi
- Polymarket Treyderlaridan 2 Million Dollardan Ortiq Yangi Ta'minot Zanjiri Hujumida O'g'irlandi
- 6 Milliard Dollarlik Binance O'g'irlanishi Shimoliy Koreyaning TraderTraitor Xususiyatlarini Ko'rsatadi
- Google Gemini 4 Carbon Modelida Kuchli Kiberxavfsizlik Imkoniyatlarini Ta'kidlaydi
- BAE Bankrotlik Sudlari Hujumida Hech Qanday Ma'lumot Olinmaganini Aytadi
- Xakerlar Sony'ning Yaponiya ISP So-net'dan 2,6 Million Yozuvni O'g'irladi
- Cisco SD-WAN Nol Kunlik Foydalanish Volt Typhoonning 'Jim Poyezd' Tarmog'iga Bog'liq
- Hujumchilar Avgustdan Beri Ikkinchi Cisco Fayervol VPN Nol Kunligini Foydalanmoqda
So'nggi Yangiliklar
- FBI Shimoliy Koreyaning Binance O'g'irlanishi bilan Bog'liq 600 dan Ortiq Manzilni Belgiladi
- Ivanti Connect Secure Hujum Zanjirida Foydalanilayotgan Yana Ikki Nol Kunlikni Tuzatdi
- Northstar Security 7 Million Dollar bilan Toksik Xavf Kombinatsiyalarini Fosh Etish Uchun Stealth'dan Chiqdi
- Suriyalik Xaker AQShda O'n Yildan Ortiq Qochqinlikdan So'ng Qamoq Jazosi Oldi
- PHP2Shell Hujumlari Palo Alto Fayervolini Ildizdan Olib Tashladi, Ammo WordPressga Qarshi Muvaffaqiyatsiz Bo'ldi
- Boshqa Yangiliklarda: Anthropic Buzilish Bahsi, UEFI Zaifligi Ko'pchilik Serverlarga Ta'sir Qiladi, Cloudflare AI Ma'lumot Sizishi
- Passkeys Parollardan Yaxshiroq. Ammo Ular Yetarli Emas.
- Bulletproof Host Virtualine Domenini FBI Musodarasiga Yo'qotdi
Trend
PHP2Shell Hujumlari Palo Alto Fayervolini Ildizdan Olib Tashladi, Ammo WordPressga Qarshi Muvaffaqiyatsiz Bo'ldi
Passkeys Parollardan Yaxshiroq. Ammo Ular Yetarli Emas.
Northstar Security 7 Million Dollar bilan Toksik Xavf Kombinatsiyalarini Fosh Etish Uchun Stealth'dan Chiqdi
Suriyalik Xaker AQShda O'n Yildan Ortiq Qochqinlikdan So'ng Qamoq Jazosi Oldi
Yangi WordPress Zaifligi Hujumchilarning Diqqat Markazida
6 Milliard Dollarlik Binance O'g'irlanishi Shimoliy Koreyaning TraderTraitor Xususiyatlarini Ko'rsatadi
Drupal Commerce Core Zaifligi Onlayn Do'konlarga Qarshi Foydalanildi
Cisco SD-WAN Nol Kunlik Foydalanish Volt Typhoonning 'Jim Poyezd' Tarmog'iga Bog'liq
Kundalik Axborot Byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiya haqida xabardor bo'lish, shuningdek, soha mutaxassislarining chuqur fikrlarini olish uchun SecurityWeek Elektron Pochta Axborotiga obuna bo'ling.
Biznes Elektron Pochta*
emailsignupsource
Ko'proq ma'lumot olish uchun Maxfiylik Siyosatimizni o'qing.
Vebinar: Agentik Pentesting Kuchliroq CTEM Dasturi Uchun
2026-yil 4-noyabr
Pentestlar orasidagi xavfsizlik bo'shliqlarini yoping. Ushbu sessiyaga qo'shiling va agentik pentestingni o'rganing hamda CTEM dasturingizda uzluksiz ta'sirni tekshirish uchun amaliy asosga ega bo'ling.
Ro'yxatdan O'ting
Virtual Tadbir: CISO Forum 2026 Sammiti
2026-yil 10 va 11-noyabr
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini birlashtirgan holda amaliy tajribani almashish va korporativ kiberxavfsizlik strategiyasini shakllantiruvchi masalalarni ko'rib chiqish uchun bizga qo'shiling.
Ro'yxatdan O'ting
Harakatdagi Odamlar
Barracuda Dan Fletcher'ni CFO etib tayinladi.
Artemis Security Arun Singh'ni CGO etib tayinladi.
General Paul M. Nakasone Armadin Kengashiga qo'shildi.
Harakatdagi Ko'proq Odamlar
Mutaxassis Fikrlari
Passkeys Parollardan Yaxshiroq. Ammo Ular Yetarli Emas.
Tashkilotlar parollarni yo'q qilganda, hujumchilar moslashadi. Autentifikatorni to'g'ridan-to'g'ri hujum qilish o'rniga, ular uning atrofidagi imkoniyatlarni qidiradi. (Torsten George)
Xavf Shaxsiy Bo'lganda: Xavfsizlik Rahbarlari Saraton Tashxisidan Nima O'rganishi Mumkin
Xavf menejerlari zaif signallarni aniqlash, buzilishlarga tayyorlanish va noaniqlik ostida qiyin qarorlar qabul qilishga o'rgatilgan. Ammo bu intizom tizim yoki korxona emas, balki siz bo'lganingizda boshqacha ko'rinadi. (Steve Durbin)
Hech Kim Xavfsizlik So'rovnomasiga Ishonmaydi. Biz Baribir Unga Tayanamiz.
Deyarli har bir B2B bitimini nazorat qiladigan jarayon — yuboruvchi ishonmaydigan va qabul qiluvchi qabul qiladigan o'z-o'zini baholash. Nihoyat, kompaniyalar o'rtasida ishonch uchun yaxshiroq asos bor. (Sravish Sridhar)
Bu Normal: NetScaler Nol Kunliklari Yangi Normal Haqida Nima Aytadi
Yaqinda Citrix NetScaler tuzatishlarining yana bir to'plami chiqarilishi ehtimoliga tayyor bo'lish uchun yamoq boshqaruv quvurlaringizni tayyor saqlang. (Tod Beardsley)
AI Dasturiy Ta'minot Xavfsizligining Kaliti Tezlik Emas, Balki Yetuklik
Sizning ishlab chiquvchilaringiz AI qabul qilish shkalasida qayerda joylashgani xavfsizlik xavfini qanday hal qilishingizga haqiqiy ta'sir qiladi. (Matias Madou)
Data Breaches
Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
DebugBear says its DNS records were compromised via its domain registrar, and early findings show a single customer was targeted.
By
Eduard Kovacs
| November 2, 2026 (5:33 AM ET)
*
Polymarket says it is returning $3.9 million to traders following last week’s supply chain attack. Website performance monitoring firm DebugBear, meanwhile, has disclosed that its DNS records were compromised.
On October 29, the prediction market halted trading on its international platform after users reported unauthorized withdrawals. Hudson Rock researchers linked the activity to malicious JavaScript served from a DebugBear address that Polymarket’s site loaded.
The script targeted logged-in traders. It checked their portfolios, and then either dumped positions or shifted assets to a wallet chosen by the attacker. The code read credential-related data stored in the browser, but Hudson Rock saw no evidence of it sending passwords, seed phrases or private keys back to the attacker. Instead, it piggybacked on the trading permissions of the open session.
In an October 30 update, Polymarket said 726 wallets were affected. At that point, all but 37 had been made whole, and the rest were being paid once their details were checked.
Polymarket is also covering traders hurt by the trading halt or whose positions were sold or transferred by the malicious script, paying out $1.19 million across roughly 5,500 wallets. Together with the roughly $2.7 million stolen directly, that brings the payout to $3.9 million.
“The attack came through a compromised 3rd party provider which we removed within the hour. We are in active investigation with law enforcement & will share a postmortem,” Polymarket said.
Advertisement. Scroll to continue reading.
DebugBear, whose real user monitoring (RUM) script lets websites measure page load performance for visitors, initially told customers to remove the embed code and has now shared its initial findings.
“Our DNS server records were compromised through our domain registrar. We are currently unable to receive emails sent to our domain,” the company said.
According to DebugBear, the attackers appear to have gone after one customer’s website specifically, though it stressed that this is a preliminary finding. It did not name the customer, and Polymarket has not named the compromised provider.
DebugBear has not explained how the attackers obtained access at the registrar level, and its investigation is ongoing. The company said it found no indication that its internal systems were compromised.
Polymarket faced a similar incident in June, when it said a third-party vendor compromise resulted in a malicious script being injected into its frontend. The theft was reported at around $3 million.
Related: FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
Related: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Related: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Written ByEduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Eduard Kovacs
- Drupal Commerce Core Vulnerability Exploited Against Online Stores
- $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
- $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
- Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
- BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts
- Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net
- Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
- Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Latest News
- FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
- Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
- Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations
- Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
- In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
- Passkeys Are Better Than Passwords. But They Are Not Enough.
- Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
Trending
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Passkeys Are Better Than Passwords. But They Are Not Enough.
Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations
Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
Fresh WordPress Vulnerability in Attackers’ Crosshairs
$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
Drupal Commerce Core Vulnerability Exploited Against Online Stores
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Barracuda has appointed Dan Fletcher as CFO.
Artemis Security has appointed Arun Singh as CGO.
General Paul M. Nakasone has joined Armadin’s Board of Directors.
More People On The Move
Expert Insights
*
Passkeys Are Better Than Passwords. But They Are Not Enough.
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)
When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)