Polymarket Pays Out $3.9M After Supply Chain Attack; DebugBear Points to DNS Hijack
Polymarket is refunding $3.9 million to traders caught up in last week's supply chain attack, while performance monitoring firm DebugBear has confirmed its DNS records were tampered with at the registrar level.
The prediction market suspended trading on its international platform on October 29 after users flagged unauthorised withdrawals. Researchers at Hudson Rock traced the culprit to a malicious JavaScript file being served from a DebugBear domain that Polymarket's site was loading.
The script was surgical. It only activated for logged-in users, checked their portfolios, then either liquidated positions or moved funds to an attacker-controlled wallet. It could read credential data sitting in the browser, but Hudson Rock found no sign it was exfiltrating passwords, seed phrases, or private keys. It didn't need to. It just hitched a ride on the existing session's trading permissions.
Polymarket confirmed 726 wallets were hit. By October 30, all but 37 had already been reimbursed, with the remainder being processed once account details were verified. Beyond direct theft, which amounted to around $2.7 million, Polymarket is also compensating roughly 5,500 wallets affected by the trading halt or forced position changes, adding another $1.19 million to the bill.
"The attack came through a compromised 3rd party provider which we removed within the hour. We are in active investigation with law enforcement and will share a postmortem," the company said.
DebugBear, whose real user monitoring script embeds into websites to track page load performance, told customers to strip out the embed code as soon as the incident surfaced. It has since published preliminary findings. "Our DNS server records were compromised through our domain registrar. We are currently unable to receive emails sent to our domain," the company said.
DebugBear believes the attackers were targeting a single customer's site rather than running a broad sweep, though it flags that as an early-stage conclusion. How the attackers gained access at the registrar level remains unexplained, and the investigation is continuing. The company says there is no sign its internal systems were breached.
Neither DebugBear nor Polymarket has publicly named each other in connection with the incident, which is a bit of a dance at this point given what's already on record.
This isn't Polymarket's first rodeo. Back in June, the platform disclosed a near-identical situation where a third-party vendor was compromised and a malicious script was injected into its frontend. That one cost around $3 million. Two supply chain hits in under six months is not a good look, whatever the third-party circumstances.