Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

On October 29, prediction market platform Polymarket suffered a supply-chain incident resulting in approximately $2.7 million stolen from 726 user wallets. Attackers compromised third-party vendor DebugBear at its domain registrar level, modifying DNS records to redirect traffic to an unauthorized server. The rogue server delivered malicious JavaScript to Polymarket site visitors, manipulating browser session states and executing unauthorized trades to exfiltrate funds.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's subdomain module continuously monitors authoritative DNS resolutions and nameserver configurations to detect unexpected IP address changes and domain-level DNS hijacking.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain