Polymarket confirms third-party compromise after trading outage
Blockchain firms allege more than $2.1 million was siphoned; Hudson Rock names DebugBear, which Polymarket has not confirmed.
68
Organization
Hudson Rock
- Mentions · 7d10
- Mentions · 30d11
- All mentions15
- First seenAug 13, 2026
- Last mentioned1d ago
Timeline
15 articles · newest firstPolymarket traders drained after DebugBear monitoring script compromised
Trading on the international site paused for about an hour on October 29, and Polymarket says affected users will be reimbursed.
74
Polymarket users report stolen funds after third-party script compromise
Hudson Rock says malicious JavaScript from a DebugBear address reused logged-in sessions; $2.7 million across 710 wallets is an outside estimate.
72
Polymarket halts trading after crypto-draining script breach, $2.5M traced
Hudson Rock linked a wallet in DebugBear-hosted JavaScript to about 28.6 million POL, roughly $2.57 million.
74
ThreatsDay: Fortinet fixes, PHP2Shell scans, Authenticator token flaw
Fortinet is withholding flaw details until November 10 while Hudson Rock reports 40,573 exposed FortiGate secrets.
64
Alleged Wagyu.xyz leak links Monero swaps to IPs
Researchers reviewed an unverified export with 38,628 orders and 10,139 IP addresses covering July 18 to October 26, 2026.
52
Alleged Wagyu leak links 4,580 swaps to Monero addresses and IPs
Hudson Rock has not authenticated the files, and WhiteArmor listings do not prove intrusion or ransomware.
48
FortiBleed 2.0 finds 40,573 cleartext secrets in FortiGate configs
Hudson Rock parsed 1,703 FortiGate configuration reports and 1,689 host identifiers; 975 domain labels were absent from the earlier set.
58
FortiBleed 2.0 finds 40,573 cleartext secrets in exposed FortiGate configs
The follow-up is stolen configuration files, not a new Fortinet flaw, and the records are not confirmed still valid.
66
UK pentester claims $2,000 Bitcoin prize for PHP2Shell CTF RCE
Jaydip Modhwadia says he achieved remote code execution in about three hours after a PHP endpoint was added.
52
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
FBI and Secret Service warn FortiBleed is still harvesting Fortinet firewall credentials, with 86,644 logins tied to ransomware access brokers.
84
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
Australian Federal Police charges two men with 14 offences over TeamPCP supply chain backdoors in Trivy, Checkmarx KICS, and LiteLLM affecting 1,000+ organizations.
72
Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs
Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.
42
Hacker claims millions of records stolen from corporate Azure tenants
Threat actor TheHatman claims millions of employee records stolen from Azure tenants of nine Fortune 500 firms, including McDonald's, Vodafone, Kyndryl, and TCS.
72
153GB of stolen credentials surface after LiteLLM supply chain attack
153GB archive from the LiteLLM supply chain attack exposes secrets from about 2,500 companies, including AWS, Samsung, Cisco and Salesforce.
90
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-194786%9.1Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering
- CVE-2026-80097<1%8.6Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation
Appears with
- Polymarketvictim · 4
- DebugBearvendor · 4
- Fortinetvendor · 4
- Microsoftvendor · 3
- FBIorganization · 3
- FortiOSproduct · 3
- FortiGateproduct · 3
- McDonald'svictim · 2
- Kyndrylvictim · 2
- Wagyu.xyzproduct · 2
- Vodafonevictim · 2
- CloudSEKorganization · 2
- CISAorganization · 2
- Tata Consultancy Servicesvictim · 2
- TheHatmanthreat actor · 2
- WhiteArmorthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.