Polymarket to refund traders after DNS hijack attack

Polymarket says it will return about $3.9 million to traders following a recent supply chain attack, with early findings from DebugBear attributing the incident to DNS hijacking of DebugBear’s own domain. Security week reports that on 29 October, Polymarket halted trading after users reported unauthorized withdrawals on its international platform.

Hudson Rock linked the activity to malicious JavaScript loaded from a DebugBear address, which targeted logged-in traders by inspecting portfolios and either dumping positions or moving assets to attacker-chosen wallets. The script read credential-related data stored in the browser, but Hudson Rock found no evidence that passwords, seed phrases or private keys were transmitted back to the attacker; instead, it leveraged the permissions of the open session.

Polymarket’s update on 30 October said 726 wallets were affected, with all but 37 now reimbursed and the remainder being paid after verification. The site says it is paying out $1.19 million across roughly 5,500 wallets to cover those harmed by the trading halt or by positions sold or transferred by the malicious script. Combined with about $2.7 million stolen directly in the incident, the total payout reaches $3.9 million.

DebugBear reports its DNS server records were compromised via its domain registrar, hindering email delivery to that domain; the incident appears to have targeted a single customer so far, though DebugBear emphasises this is an initial finding and investigations are ongoing. DebugBear says its own systems were not compromised. Polymarket previously faced a related incident in June involving a third-party vendor that injected a malicious script into its frontend.