Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

thehackernews.com Nov 1, 2026

Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

Curated by Shubham · TechCapsules · Nov 1, 2026

AI-summarised brief · reviewed before publication

On October 29, malicious code injected into Polymarket’s website hijacked a third‑party DebugBear page‑speed script and used signed‑in traders’ credentials to transfer their positions and funds to a hacker‑controlled wallet. The attack moved roughly $2.64 million worth of POL tokens from 33 wallets in under an hour, after which the funds were quickly split among three addresses. Polymarket identified the breach, removed the compromised script within an hour, cleared caches, reset sessions and paused trading. The company is refunding about $2.7 million to 726 affected wallets and an additional $1.19 million to roughly 5,500 users impacted by the trading pause, totaling $3.9 million in reimbursements. DebugBear confirmed its DNS was compromised but its own systems remain intact. The incident underscores risks of third‑party scripts.

💡 Why It Matters

· Exploiting a trusted monitoring script let attackers bypass user authentication, exposing a systemic vulnerability in how crypto platforms rely on external code.

Read full article on thehackernews.com

FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist

The FBI announced that the North Korean‑aligned hacking collective known as TraderTraitor, also identified as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899, stole more than $6.43 billion in cryptocurrency across 11 blockchains. investigators from the FBI, U.S. Secret Service and IRS‑CI said the group primarily converted the loot into Ethereum before moving it through decentralized‑finance swaps and instant‑swap services for further laundering. Binance resumed phase‑one withdrawals after pausing them following the breach, noting that deposits remain unaffected. The theft surpasses the $1.46 billion Bybit hack and represents the largest crypto heist on record, with 82 % of the stolen value on Ethereum and Bitcoin. On‑chain analysis shows $2.85 billion of the assets have been frozen by Tether, Circle, Ripple, Arbitrum and Optimism.

💡 The haul demonstrates how state‑backed actors can weaponize decentralized finance to fund illicit programs, forcing regulators and exchanges to tighten cross‑chain monitoring. It also proves that even leading platforms like Binance can be disrupted by sophisticated supply‑chain attacks, reshaping risk assessments for the broader Web3 ecosystem.

thehackernews.com · Oct 31

Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold…

Trezor has warned that a Safe 5 hardware wallet purchased from reseller CryptoBilis contains an unauthorized circuit board that captures and transmits the recovery phrase via a cellular module. The device, sold through Tokopedia in August 2026, was reported by an Indonesian customer who noticed a weight difference and later discovered the board. Trezor is urging all CryptoBilis buyers since March 2026 to replace their wallets and is sending the suspect unit to its lab for examination. No funds have been lost, and the company has not yet confirmed the board’s functionality.

💡 The incident underscores the growing risk of supply‑chain tampering in crypto hardware, forcing users to trust manufacturers over resellers. It also highlights the need for stricter vetting of third‑party distributors in the rapidly expanding digital‑asset market.

thehackernews.com · Oct 29

FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering

The U.S. Department of Justice announced the seizure of the Virtualine domain, a bulletproof hosting provider used for child sexual abuse material, nonconsensual intimate content, and Bitcoin money laundering. The FBI, alongside international law‑enforcement partners, seized the site after Virtualine continued to host a criminal forum, Vendor 1, despite repeated abuse notices. Virtualine offered paid plans, accepted unhosted Bitcoin payments, and allegedly laundered funds for cybercriminals. The operator issued a rebuttal letter following the seizure.

💡 This action disrupts a key infrastructure hub that enables the distribution of illegal content and the laundering of illicit funds, tightening the net around cybercriminal operations worldwide.

thehackernews.com · Oct 27

Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key

Keystone disclosed that an attacker accessed its website on October 20, stole the verification key used by its hardware wallets, and could produce counterfeit devices that pass online authenticity checks. The company will destroy 18,835 unsold wallets bearing the compromised key and issue new keys for all future units. Owners of devices received after October 20 should verify authenticity with Keystone support; earlier devices remain valid. The breach also exposed 25,964 customer shipping records, prompting Keystone to shorten data retention to 90 days and notify affected users.

💡 The incident exposes a critical flaw in hardware wallet authentication, threatening user security without compromising private keys. It underscores the need for robust supply‑chain safeguards in crypto hardware manufacturing.

thequantuminsider.com · Oct 20

Project Eleven and Relm Explore Post-Quantum Risk in Digital Asset Insurance

Project Eleven and Relm Insurance have formed an exploratory partnership to examine how post‑quantum security controls can be integrated into digital asset insurance underwriting. Relm will advise on Project Eleven’s Strongpoint custody platform, focusing on key exposure, signing systems, transaction approvals, migration readiness, and third‑party dependencies. The collaboration aims to determine whether quantum‑ready infrastructure can influence risk assessments and insurance premiums, though any impact will require further evaluation under Relm’s independent underwriting processes.

💡 By linking quantum‑ready custody to insurance risk, the partnership could set a new standard for safeguarding digital assets as quantum threats loom.

thehackernews.com · Oct 19

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors began exploiting a chain of four Plex Media Server flaws, dubbed Plex2Shell, to achieve unauthenticated remote code execution shortly after a proof‑of‑concept was released on October 16, 2026. The vulnerabilities, including CVE‑2026‑96651 (CVSS 7.1), were reported to Plex on July 27 and patched in version 1.43.3.10861 on August 3. Within a day of the public disclosure, attackers deployed a cryptocurrency miner payload from IP 217.60.194.116 and a Linux backdoor called “myawesomeproxy,” which functions as a stealthy reverse proxy. The miner runs as “mylovelyminer” and contacts the server ota.proxystream.st, a domain previously linked to the AISURU DDoS and proxyware botnet. Reddit users have reported compromised Plex instances, prompting security experts to urge immediate updates to protect personal media libraries today.

💡 By turning widely deployed home media servers into covert crypto‑mining and proxy nodes, attackers can harness massive, unsuspected bandwidth and compute resources, amplifying both financial fraud and downstream botnet threats.