Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

What it is

On 29 October 2026, a script served from a DebugBear address that Polymarket's site loaded attacked logged-in traders. DebugBear is a real user monitoring (RUM) vendor whose script lets sites measure page load performance. About $2.7 million was stolen directly. Adding $1.19 million paid to roughly 5,500 wallets hurt by the trading halt or forced sales gives the $3.9 million payout.

How it works

The script ran in the trader's browser and checked the portfolio. It then either dumped positions or moved assets to a wallet the attacker chose. It read credential-related data stored in the browser. Hudson Rock saw no evidence that passwords, seed phrases or private keys were sent to the attacker. Instead, the script used the trading permissions of the already open session.

flowchart LR
    A[Registrar compromised] --> B[DebugBear DNS records changed]
    B --> C[Polymarket page loads DebugBear script]
    C --> D{Trader logged in?}
    D -->|Yes| E[Sell positions or move assets]
    D -->|No| F[No action reported]

The DNS and registrar link comes from DebugBear's own statement. The page does not say how the attackers got registrar access.

Preconditions / Affected

• A site loading a third-party script from a vendor domain, with that script running in authenticated sessions.
• 726 Polymarket wallets were affected. As of 30 October, all but 37 had been made whole, and the rest were being paid once their details were checked.
• DebugBear says the attackers appear to have targeted one customer's site, which is a preliminary finding. Neither company has named the customer. Polymarket has not named the provider.

What to do

The page states only one customer action: DebugBear first told its customers to remove the RUM embed code. Polymarket said it removed the compromised provider within the hour. The page gives no commands, indicators or detections.

Caveats

• DebugBear's investigation is ongoing. It says it found no sign that its internal systems were compromised, and its domain email was still unreachable.
• Polymarket has promised a postmortem and is working with law enforcement.
• The page says Polymarket had a similar incident in June 2026, when a third-party vendor compromise put a malicious script in its frontend. That theft was reported at around $3 million.