NewsPublished 2 Nov 2026

Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Source SecurityWeek

Description

Polymarket experienced a supply chain attack via a compromised third-party provider, DebugBear, whose DNS records were hijacked through its domain registrar. Malicious JavaScript served from DebugBear's address was injected into Polymarket's site, targeting logged-in traders to manipulate their portfolios by dumping positions or transferring assets to attacker-controlled wallets. Approximately 726 wallets were affected, with Polymarket returning a total of $3.9 million to traders, covering stolen funds and losses from trading halts. DebugBear's internal systems were not compromised, and the attack appears to have targeted a single customer. The investigation is ongoing, and law enforcement is involved.

Impact

The attack resulted in unauthorized asset transfers from 726 Polymarket trader wallets, causing direct theft of approximately $2.7 million and additional losses due to trading disruptions. Polymarket compensated affected traders with a total payout of $3.9 million. The compromise exploited a third-party provider's DNS hijack to inject malicious code, impacting user trust and platform integrity. No credential theft was observed, but active session permissions were abused to execute unauthorized trades.

Defensive guidance

Polymarket removed the compromised third-party provider's script within an hour of detection and is actively investigating the incident with law enforcement. DebugBear advised customers to remove the embedded monitoring code and is conducting a thorough investigation into the DNS hijack. Users should ensure third-party integrations are from trusted sources and monitor for unusual account activity. Since the attack vector involved DNS hijacking at the registrar level, organizations should review and strengthen domain registrar security controls.

Summary

On October 29, 2026, Polymarket halted trading after unauthorized withdrawals were reported. Researchers linked the incident to malicious JavaScript served from DebugBear, a website performance monitoring firm, whose DNS records were compromised via its domain registrar. The injected script exploited active trading sessions to manipulate portfolios without stealing credentials like passwords or seed phrases. Polymarket identified 726 affected wallets and has reimbursed traders $3.9 million, including direct theft and collateral losses. DebugBear confirmed DNS hijacking but found no evidence of internal system compromise. The attack was limited to one customer’s website, and the investigation continues with law enforcement involvement.

References

securityweek.com/polymarket-returns-3-9-million-to-traders-as-debugbear-cites-dns-hijack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Nov 2026, 09:43 UTC

Technical details

References

Community reviews