Polymarket pays $3.9M after DebugBear DNS registrar compromise injected session-hijacking script

The attack originated from DebugBear’s domain registrar, where DNS records were altered to serve a malicious RUM script to Polymarket’s frontend. Hudson Rock analysis showed the script inspected open trading sessions, checked portfolios, and executed transfers to attacker-controlled wallets using existing permissions rather than credential theft. Polymarket removed the provider within an hour and confirmed no internal systems were breached at either company.

Evidence points to a targeted registrar-level compromise rather than a broad infrastructure breach, consistent with DebugBear’s statement that only one customer site was affected. This follows Polymarket’s June 2024 third-party vendor incident that also resulted in frontend script injection and roughly $3 million in losses, indicating repeated exposure through external dependencies.

The incident underscores supply-chain risks in financial platforms handling prediction market liquidity, where session persistence replaces traditional credential theft. Registrar access grants persistent DNS control that bypasses typical application-layer defenses. DebugBear’s ongoing investigation has not disclosed the registrar involved or access method.

Polymarket’s full payout of $3.9 million covers both direct theft and indirect trading losses, while law enforcement involvement continues. Expect registrar audit requirements and potential shifts toward self-hosted or verified script delivery for similar platforms within the next quarter.