DebugBear DNS Registrar Hijack Drains $2.64M POL from 33 Polymarket Wallets

The attack replaced Polymarket's legitimate DebugBear script hosted on Google Cloud Storage with malicious code served from an alternate IP at 18:13 UTC. Hudson Rock analysis shows the injected script reused existing authenticated sessions to read browser-held API keys, locate the order signer, and submit pre-signed transactions through Polymarket's relayer without exfiltrating seeds or private keys.

Blockchain traces from Ohey confirm the receiving wallet collected funds from 33 accounts between 17:10 and 18:02 UTC before forwarding the POL to three downstream addresses. DebugBear stated its systems were not breached and attributed the subdomain change to a domain-registrar compromise that affected only the Polymarket customer file.

This incident follows the established pattern of registrar-level DNS takeovers used against third-party monitoring and analytics providers rather than direct platform intrusions. The narrow targeting and rapid script removal within the hour limited exposure yet exposed how prediction-market platforms inherit the weakest link in their external script supply chain.

Polymarket has refunded $3.9 million across affected and collateral wallets and referred the case to law enforcement. Regulators are expected to scrutinize third-party script governance in licensed trading venues within the next quarter.