Today’s Field Note

Two front-end supply-chain hits landed in the same window. Polymarket lost about $2.7 million across 726 wallets on October 29 when malicious code replaced a DebugBear page-speed script and sold signed-in traders’ positions out from under them. Separately, attackers hijacked a dozen DeFi frontends, all registered through Name.com, draining roughly $138,000 via a likely registrar compromise. Meanwhile the TraderTraitor crew behind the $6.3B Binance heist is laundering through Uniswap and posting stolen stablecoins as collateral to borrow ETH, since Tether and Circle have already frozen over $2 billion but cannot touch ETH. The pattern is clear: the contracts held, the websites and the DNS did not.

Today’s Move

  • Treat any DeFi frontend as hostile today. Interact through verified contract addresses or a cached safe build, not the live site, especially for Name.com-registered projects.
  • If you traded on Polymarket on or before October 29, check the $2.7M refund list for your wallet and revoke any lingering approvals granted via the site.
  • Audit browser-loaded third-party scripts if you run a frontend. Pin DebugBear and similar analytics tags by hash (SRI) and lock your registrar with transfer protection and strong non-SMS 2FA.
  • Watch and block the TraderTraitor laundering addresses per the FBI request. Screen inbound ETH and stablecoins if you operate a pool, bridge, or lending market.
  • Rotate Northflank-stored credentials and AI API keys now if you host there. The breach already produced key abuse.

Resources

  • https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html
  • https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251
  • https://www.reddit.com/r/CryptoCurrency/comments/1xkdxhk/defis_aml_blind_spot_how_stolen_funds_and/
  • https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.