DebugBear registrar account hijacked and its monitoring script swapped for a wallet drainer; about $2.7 million taken from Polymarket traders

Website performance monitoring firm DebugBear said an unauthorized third party gained access to its domain registrar account and replaced its monitoring script with malicious code for about two hours, in what it assesses was a targeted, financially motivated attack on one customer website ^[1]. According to SecurityWeek, prediction market Polymarket halted trading on its international platform on October 29 after unauthorized withdrawals; the script abused logged-in traders' sessions to dump positions or move assets to an attacker wallet, affecting 726 wallets with about $2.7 million stolen directly and $3.9 million paid out in total ^[2]. Sites that load third-party scripts should add subresource integrity checks, as DebugBear has, so a hijacked vendor domain cannot silently swap content ^[1].

Industries mainly affected: Finance, Technology

1. Add subresource integrity (SRI) checks to third-party scripts you load ^[1].
2. Sites using DebugBear should confirm they handled the embed code per its notice and refresh sessions and keys .