DebugBear's domain record changed minutes before the Polymarket drain, researcher says
The registry update came nine minutes before DebugBear's script host started failing and 25 minutes before the first funds hit the drainer's wallet, according to Ohey founder Matt Kirkland.
By Emerson Redding · Published
Primary source: ohey.ca
Why it matters
A registry change minutes before the drain points investigators toward DebugBear's domain, not just its code, as the place the attack may have started.
The registry record for debugbear.com changed nine minutes before the attack that drained Polymarket users' wallets on Oct. 29th, according to Matt Kirkland of Ohey, the security research firm that published a write-up tracing the drainer.
On Oct. 29th, the DebugBear monitoring script that Polymarket loaded from cdn.debugbear.com was replaced with a wallet drainer. It sent 28.6 million POL and 33 accounts' positions to a single wallet, according to Ohey's write-up.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.