Polymarket has paid back about $3.9 million to traders after code from a website-performance vendor was turned into a script that sold or moved their holdings, SecurityWeek reported Monday. The vendor, DebugBear, says attackers hijacked its DNS records, the internet's address entries that tell browsers where to fetch a domain's content, through its domain registrar. The case shows that any company embedding outside code on pages where customers log in or move money also inherits the security of that vendor's domain accounts.
What Happened
Polymarket, a New York-based prediction market where users bet on events with cryptocurrency, halted trading on its international platform Oct. 29 after users reported unauthorized withdrawals. The company said one of its third-party providers had been compromised and that it had referred the matter to law enforcement, The Record reported. Polymarket says it removed the provider within the hour and will publish a postmortem, but it has not named the provider.
Researchers at the cybersecurity firm Hudson Rock identified it as DebugBear, which sells a script that measures how fast pages load for real visitors. In its analysis, Hudson Rock said code served from a DebugBear address to Polymarket's site checked logged-in traders' portfolios, then sold their positions or transferred assets to a wallet the attacker chose. Hudson Rock found no evidence that the script sent out passwords, seed phrases (the recovery words that control a crypto wallet) or private keys; it instead used the trading permissions of the open session, according to SecurityWeek.
Polymarket said Oct. 30 that 726 wallets were affected and that all but 37 had been made whole, with the rest to be paid after verification. It is also paying $1.19 million to about 5,500 wallets hurt by the trading halt or by script-driven sales and transfers. With roughly $2.7 million stolen directly, payouts total $3.9 million, SecurityWeek reported.
DebugBear has not explained how attackers gained access at its registrar, and it currently cannot receive email at its domain. Its preliminary findings suggest the attackers targeted one customer's website specifically, and it found no sign that its internal systems were breached.
Why It Matters
Nothing on Polymarket's own servers had to be breached. Whoever controls a vendor's domain can swap the code that client sites load automatically, and that code runs with the same powers as the customer who is logged in. It is the second such case at Polymarket this year: SecurityWeek reported a similar third-party script injection in June, with about $3 million stolen.
The checks for security teams are concrete. Keep an inventory of outside scripts on login, trading and payment pages, and drop any that are not needed there. Use subresource integrity, a browser check that refuses a script whose contents have changed from a known version, and a content security policy that limits which domains may supply code. Ask critical vendors whether their registrar accounts use a registrar lock and multifactor sign-in.
What to Watch
Polymarket's promised postmortem, DebugBear's account of how its registrar access was obtained, whether any other DebugBear customers were served malicious code, and any law enforcement action.
