DebugBear says its DNS was hijacked at the registrar. Polymarket is repaying $3.9 million.
By Lior AharonovFounder, 7IT Solutions ·
What happened
SecurityWeek reported on Monday, 2 November, that DebugBear, whose monitoring script was linked to the 29 October Polymarket withdrawals, says its DNS records were compromised through its domain registrar. It found no sign its internal systems were breached. Polymarket says 726 wallets were affected and is returning about $3.9 million in total.
Why it matters
DebugBear found no sign of a break-in at its own systems. Control of its DNS was apparently enough: whoever answers for a vendor's domain decides what your page loads from it, inside your logged-in users' sessions.
What to do
Turn on registrar lock and multi-factor sign-in at your own domain registrar today. Then ask each vendor whose script runs on your logged-in pages how they protect their domain.
My take
Lior Aharonov
Founder, 7IT Solutions
Your security now includes your vendor's registrar password. Ask who holds it.
I've seen this before
I've seen this movie before: in January 2019 CISA ordered federal agencies to audit their DNS records within 10 business days, after attackers used DNS account credentials to swap in addresses they controlled and intercept web and mail traffic.
CISA: Emergency Directive 19-01, Mitigate DNS Infrastructure Tampering cisa.gov
Sources
| SecurityWeek: Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.