Hackers compromised DebugBear's DNS records to replace a page-speed script loaded by prediction market Polymarket with malicious code, which exploited signed-in traders' existing account access to steal approximately $2.7 million from 726 wallets in under an hour on October 29. The malicious script used each account's own signing mechanisms to move positions and funds directly to the hackers' wallet, without needing to steal passwords or private keys. Polymarket responded by pausing trading, removing the script, and is refunding around $3.9 million in total to affected traders and those impacted by the trading pause.
