Short answer: Polymarket had to return $3.9 million to traders after a DNS hijack attack. Any website using DebugBear’s services should check for potential security issues.
TL;DR
- DebugBear’s DNS records were compromised.
- Hudson Rock researchers found malicious JavaScript.
- Traders affected by the attack are being compensated.
What happened?
This incident involves a DNS hijack, where attackers changed the DNS records of a website (DebugBear) to redirect traffic to their servers. Malicious JavaScript was then loaded onto Polymarket's site, targeting traders' accounts. Polymarket is returning money to affected traders as a result of this attack.
Key facts
| Reported by | SecurityWeek |
|---|---|
| Date reported | 02 Nov 2026 |
| Amount reported | $3.9 million (as reported by SecurityWeek) |
How it works
A DNS hijack happened, where attackers changed DNS records. This allowed them to redirect traffic.
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-02 | Reported by SecurityWeek | SecurityWeek |
| 2026-11-02 | This Skillmate explainer published | Skillmate |
How to fix it
- Keep systems and network devices updated and follow vendor security notices.
- Make sure an incident response contact and plan exist before an attack happens.
- Ask your service providers which protections they offer, and test them.
How to detect it
Look for unauthorized transactions or account changes. DNS hijack can cause website performance issues or unexpected redirects.
What is confirmed
- SecurityWeek reports the amount as $3.9 million
- Reported by SecurityWeek
Why it matters
This incident highlights the importance of secure DNS management and third-party vendor vetting. Companies and users must ensure robust security practices to protect against such attacks.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is DNS hijacking?
DNS hijacking is when attackers change your domain name server settings, redirecting traffic to a malicious site.
How can Polymarket prevent this in the future?
Polymarket should ensure better monitoring of third-party providers and domain security to prevent such attacks.
How much was Polymarket paying back to traders?
Polymarket is returning $3.9 million to traders affected by the supply chain attack.
Who is DebugBear?
DebugBear is a website performance monitoring firm that was compromised, leading to DNS hijack.
Related Skillmate posts
Sources
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
