Ethical Hacking News
A sophisticated cyber attack was carried out on the Polymarket trading platform, resulting in the theft of approximately $2.7 million from some of its signed-in traders. The attack was carried out by exploiting a DebugBear script, a real user monitoring (RUM) tool, which was loaded from an outside company. The attackers managed to hijack the DNS records of the DebugBear domain, allowing them to redirect the traffic to a malicious server that served the stolen code. The incident highlights the importance of implementing robust security measures to protect against sophisticated cyber attacks and the need for greater awareness and education among traders and website owners about the risks associated with using third-party scripts and tools.
The Polymarket trading platform was hijacked by cyber attackers, resulting in the theft of approximately $2.7 million from some of its signed-in traders. The attackers exploited a DebugBear script, a real user monitoring (RUM) tool, to gain access to the Polymarket website. The DebugBear script was hijacked through its domain registrar, allowing the attackers to redirect traffic to a malicious server. The code used by the attackers accessed a signed-in trader's account details and trading API keys, allowing them to steal funds. A total of 689 out of 726 affected wallets were refunded in full, with the remaining 37 being paid as they were checked. Polymarket is paying $1.19 million to about 5,500 wallets that lost money during the trading pause or had positions taken. The incident highlights the importance of implementing robust security measures to protect against sophisticated cyber attacks. The incident underscores the need for greater awareness and education among traders and website owners about the risks associated with using third-party scripts and tools.
In recent times, the world of cryptocurrency and web security has witnessed a surge in sophisticated cyber attacks, with the latest incident being the hijacking of the Polymarket trading platform. On October 29, 2026, malicious code on the website of Polymarket, a prediction market platform, was used to steal approximately $2.7 million from some of its signed-in traders. The code, which was discovered by researchers at Hudson Rock, utilized a DebugBear script, a real user monitoring (RUM) tool, to hijack the traders' positions and transfer funds to the hackers' wallets.
The DebugBear script, which was loaded from an outside company, was compromised through its domain registrar, the company revealed on X. The attackers had managed to hijack the DNS records of the DebugBear domain, allowing them to redirect the traffic to a malicious server that served the stolen code. Researchers at Ohey discovered a different server answering for DebugBear's web addresses at 18:13 UTC, when the malicious file was still online.
The code utilized the access a signed-in trader already had in an open Polymarket page, Hudson Rock found after reviewing the file without running it. It read account details that Polymarket keeps in the browser, including a set of trading API keys. The code then searched for the part of Polymarket's site that places orders and for the signer that approves the account's transactions. It then took one of two paths, moving the trader's positions straight to the hackers' wallet for accounts that sign in with their own crypto wallet, or selling positions at ever-worse prices and then moving the money out for accounts that sign in via email.
In both paths, the code asked the account's own signer to sign its requests and handed them to Polymarket's relayer, which submitted them. Hudson Rock said a signing request alone did not prove a trader signed without seeing a prompt. The wallet written into the code received its first funds at 17:10 UTC and its last at 18:02 UTC, according to Ohey's blockchain trace. In that time, it collected 28.6 million POL tokens and positions from 33 wallets.
At 18:19 UTC, those 28.6 million POL were worth about $2.64 million at DefiLlama's price of $0.0922. The figure covers only the POL, not the positions. The wallet sent all 28.6 million POL on to three other addresses between 18:28 and 18:38 UTC, its transaction history shows.
Polymarket responded to the incident by removing the script within the hour and clearing every cache, resetting all active login sessions, and pausing trading until the site was clean. The company has referred the case to law enforcement. By October 30, 689 of the 726 affected wallets had been refunded in full, and the remaining 37 were being paid as they were checked. Polymarket is also paying $1.19 million to about 5,500 wallets that lost money during the trading pause or had positions taken.
This incident highlights the importance of implementing robust security measures to protect against sophisticated cyber attacks. The use of DebugBear's RUM tool, which is designed to monitor and improve website performance, was exploited by the attackers to gain access to the Polymarket website. The attackers were able to hijack the DebugBear script and use it to steal funds from traders. This incident serves as a reminder to all website owners and traders to ensure that their security measures are up-to-date and that they are taking steps to protect against such attacks.
The incident also highlights the need for greater awareness and education among traders and website owners about the risks of sophisticated cyber attacks. Many traders and website owners may not be aware of the risks associated with using third-party scripts and tools, and may not take adequate steps to secure their websites and protect their users' data.
In conclusion, the hijacking of the Polymarket trading platform by sophisticated cyber attackers highlights the need for robust security measures to protect against such attacks. It also underscores the importance of awareness and education among traders and website owners about the risks associated with using third-party scripts and tools.
Related Information:
https://www.ethicalhackingnews.com/articles/Hijacking-the-Polymarket-A-Cautionary-Tale-of-DebugBears-DNS-Compromise-and-the-Rise-of-Sophisticated-Cyber-Attacks-ehn.shtml
https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html
Published: Sun Nov 1 02:17:11 2026 by llama3.2 3B Q4_K_M
