Overview
Polymarket is reimbursing traders a total of $3.9 million after a third-party script compromise, while monitoring vendor DebugBear says its DNS records were hijacked through its domain registrar. SecurityWeek reports the details.
Timeline
- October 29: Polymarket halted trading on its international platform after users reported unauthorized withdrawals. Hudson Rock linked the activity to malicious JavaScript served from a DebugBear address that Polymarket's site loaded.
- October 30: Polymarket reported 726 affected wallets, all but 37 made whole at that point.
- Around November 2: DebugBear published initial findings that its DNS records were compromised at the registrar level.
How the attack worked
DebugBear provides a real user monitoring (RUM) script that customers embed. Once its DNS was hijacked, attackers could serve their own script from the trusted hostname. Hudson Rock says the script targeted logged-in Polymarket traders, checked their portfolios, then dumped positions or moved assets to an attacker-chosen wallet. It found no evidence of password, seed phrase or private key theft; the script abused the trading permissions of already-open sessions.
The numbers
- About $2.7 million stolen directly
- $1.19 million paid across roughly 5,500 wallets hurt by the trading halt or position sales and transfers
- $3.9 million total payout
Polymarket says the attack came through a compromised third-party provider that it removed within the hour, and that it is working with law enforcement and will publish a postmortem.
DebugBear's position
DebugBear first told customers to remove its embed code. Its preliminary findings say attackers appear to have targeted a single customer's website specifically. It has not said how the registrar was breached, reports no sign that internal systems were compromised, and currently cannot receive email sent to its domain.
Polymarket suffered a similar incident in June, when a vendor compromise led to malicious script injection into its frontend, with about $3 million reported stolen.
Lessons
- Third-party scripts run with your origin's privileges. Use Subresource Integrity where possible and avoid loading monitoring scripts on authenticated, high-value pages.
- Apply a strict Content Security Policy that limits script sources and outbound connections.
- Harden registrar accounts: registry lock, hardware-key MFA and change alerts on DNS records.
- Require wallet transaction confirmation that cannot be satisfied by an existing session alone.