Attack on Polymarket via Third-Party Service DNS

Prediction market Polymarket fell victim to an attack via third-party website speed monitoring service DebugBear. Attackers did not hack the platform itself, but exploited a vulnerability in the DNS records of an external provider.

The mechanism of fund theft was as follows:

• The script checked the user's authorization status in their Polymarket account
• It analyzed wallet balances and open positions on markets
• It forcibly sold assets using native functions and transferred them to the attacker's wallet

As a result of the compromise, 726 wallets were affected. Direct losses amounted to approximately $2.7 million. The platform promptly halted trading and disconnected the compromised service within an hour.

Compensation was paid to all affected users except for 37 wallet owners. Total costs for Polymarket regarding payouts and trading suspension reached $3.9 million.

This is already the second such incident within a few months. In June, a similar attack via another third-party frontend provider caused damages of approximately $3 million. The attackers gained access to the DebugBear domain registrar by modifying its DNS records.