The original text is in EN, taken from the source site. Source ↗

Data Breaches

Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

DebugBear says its DNS records were compromised via its domain registrar, and early findings show a single customer was targeted.

By

Eduard Kovacs

| November 2, 2026 (5:33 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Polymarket says it is returning $3.9 million to traders following last week’s supply chain attack. Website performance monitoring firm DebugBear, meanwhile, has disclosed that its DNS records were compromised.

On October 29, the prediction market halted trading on its international platform after users reported unauthorized withdrawals. Hudson Rock researchers linked the activity to malicious JavaScript served from a DebugBear address that Polymarket’s site loaded.

The script targeted logged-in traders. It checked their portfolios, and then either dumped positions or shifted assets to a wallet chosen by the attacker. The code read credential-related data stored in the browser, but Hudson Rock saw no evidence of it sending passwords, seed phrases or private keys back to the attacker. Instead, it piggybacked on the trading permissions of the open session.

In an October 30 update, Polymarket said 726 wallets were affected. At that point, all but 37 had been made whole, and the rest were being paid once their details were checked.

Polymarket is also covering traders hurt by the trading halt or whose positions were sold or transferred by the malicious script, paying out $1.19 million across roughly 5,500 wallets. Together with the roughly $2.7 million stolen directly, that brings the payout to $3.9 million.

“The attack came through a compromised 3rd party provider which we removed within the hour. We are in active investigation with law enforcement & will share a postmortem,” Polymarket said.

Advertisement. Scroll to continue reading.

DebugBear, whose real user monitoring (RUM) script lets websites measure page load performance for visitors, initially told customers to remove the embed code and has now shared its initial findings.

“Our DNS server records were compromised through our domain registrar. We are currently unable to receive emails sent to our domain,” the company said.

According to DebugBear, the attackers appear to have gone after one customer’s website specifically, though it stressed that this is a preliminary finding. It did not name the customer, and Polymarket has not named the compromised provider.

DebugBear has not explained how the attackers obtained access at the registrar level, and its investigation is ongoing. The company said it found no indication that its internal systems were compromised.

Polymarket faced a similar incident in June, when it said a third-party vendor compromise resulted in a malicious script being injected into its frontend. The theft was reported at around $3 million.

Related: FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist

Related: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Related: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Written ByEduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Eduard Kovacs

  • Drupal Commerce Core Vulnerability Exploited Against Online Stores
  • $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
  • $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
  • Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
  • BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts
  • Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net
  • Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
  • Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

Latest News

  • FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
  • Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
  • Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations
  • Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
  • PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
  • In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
  • Passkeys Are Better Than Passwords. But They Are Not Enough.
  • Bulletproof Host Virtualine Loses Its Domain to FBI Seizure

Trending

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Passkeys Are Better Than Passwords. But They Are Not Enough.

Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations

Syrian Hacker Gets Prison Time in US After Over a Decade on the Run

Fresh WordPress Vulnerability in Attackers’ Crosshairs

$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor

Drupal Commerce Core Vulnerability Exploited Against Online Stores

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: Agentic Pentesting for a Stronger CTEM Program

November 4, 2026

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Passkeys Are Better Than Passwords. But They Are Not Enough.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)