Polymarket compensation plan hits $3.9 million as DebugBear blames DNS
Polymarket is returning $3.9 million to traders after last week's malicious-script attack, including $1.2 million for losses tied to the hour-long trading halt, while the monitoring vendor says hackers hijacked its DNS through a registrar.
The bill for last week's attack on Polymarket's international site is now clearer, and so is the route the attackers took. The Polymarket compensation plan totals $3.9 million, according to the company's post-mortem as reported by TokenPost and IBTimes UK, and the vendor whose script was swapped says its DNS was hijacked at the registrar level.
What happened
The money splits in two. About $2.7 million goes to 726 wallets whose funds or positions were taken on October 29, and about $1.2 million, $1.19 million in The Hacker News' figure, covers roughly 5,500 wallets that lost value because of the hour-long pause, such as traders whose market closed while trading was frozen or who sold right after the restart. By October 30, 689 of the 726 drained wallets had been refunded in full and the remaining 37 were being processed, IBTimes UK reported.
Eligible wallets were identified from on-chain and trading data, so no claims were needed, though traders who dispute an amount can request a review, TokenPost said. Compensation for taken positions uses their value at the time plus sale slippage.
The Hacker News reported on November 1 that DebugBear, whose real-user monitoring script Polymarket loaded, said attackers compromised its DNS records through its domain registrar. Early findings indicate only one customer's website was targeted, and DebugBear has seen no sign of a breach of its own systems.
Why it matters
The technical details explain why sessions, not passwords, were the weak point. Hudson Rock found the malicious code reused access that signed-in traders already had open, then either moved positions straight to the attacker's wallet or sold them at worsening prices before moving the cash, The Hacker News said. It found no code that sent keys or seed phrases out.
On-chain tracing put about 28.6 million POL, worth roughly $2.64 million at the time, in the attacker's wallet within an hour. IBTimes UK stressed that this figure covers only the POL and should not be confused with the total compensation commitment.
Our first report on the Polymarket international halt covered the outage itself. The same weekend, DNS-level attacks hit DeFi front ends too, as our Name.com DeFi hijack story showed, which points to registrars as a growing weak link.
The Polymarket compensation plan also goes beyond direct theft by paying for losses caused by the halt, a step that covers about 5,500 wallets.
What's next
Polymarket says it is restoring third-party scripts only with stronger content security policies, pinned versions, sandboxing and continuous monitoring. The Hacker News' technical account includes Hudson Rock's analysis.
The Polymarket compensation plan covers the immediate losses, and the incident has been referred to law enforcement; the timing matters too: election-week traffic will test whether the new controls hold.
The Hacker News said the address that served the malicious file had no DNS record when it checked on November 1.
This article is for information only and is not investment advice.