Polymarket temporarily stopped trading on its international platform for nearly an hour after a third-party software provider was compromised. The company said it found and fixed an issue involving its website, referred the incident to British law enforcement, and believed the attack came from the United Kingdom. Users reported on Discord that their wallets had been drained, though Polymarket did not confirm losses or disclose the attack’s precise mechanics. The Block, citing blockchain analytics firm Arkham, reported that about $2.65 million in cryptocurrency had been taken. Polymarket pledged to fully reimburse affected traders. The software provider, web analytics company DebugBear, separately acknowledged an ongoing security incident. Trading resumed at 3 p.m. ET, and the breach did not appear to affect Polymarket’s U.S. platform.
The incident illustrates the risks of attacks routed through vendors that serve large online platforms, and was especially consequential because users’ funds were reportedly stolen. Polymarket handles about $200 million in trading activity daily and was valued at $21 billion in September, following a $1 billion investment led by Donald Trump Jr. The company and rival Kalshi are also caught in a high-stakes dispute between U.S. states and the Trump administration over who regulates prediction-market betting. Both platforms face scrutiny over potentially suspicious trading: Polymarket was investigating bets around Israel’s elections and dozens of wagers tied to U.S. midterms, while Kalshi was reviewing bets concerning Trump’s press secretary pick.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A Linux kernel use-after-free vulnerability, CVE-2026-98432, can enable remote code execution, and Go 1.24 enables MPTCP by default on Linux, exposing listeners to the demonstrated exploit. Upgrade to a patched kernel; disabling MPTCP in Go is only a fragile mitigation. (groups.google.com)
Scribd disclosed a security incident in which an unauthorized party may have accessed users’ email addresses, partial payment card details, country, issuer, expiry date, and payment history. The company says it secured the affected system, notified authorities, and advises users to watch for phishing. (news.ycombinator.com)
Flock camera searches in Highland Heights fell 95% after a dispatcher was caught misusing the system. The sharp drop followed the discovery of the misconduct. (wkyc.com)
AT Protocol apps can store user data publicly on personal data servers, where it is easy to search and retrieve. Skyreader subscriptions exposed more than 1,300 RSS feeds, including private and paywalled feeds, while other apps also publish messages openly. (melaniekat.com)
At least nine AI developer platforms disclosed breaches in October, with attackers targeting stored credentials and environment variables that grant access to AI services. The incidents point to coordinated agent-driven attacks fueled by the resale of stolen AI access, though investigations are still ongoing. (wiz.io)
The CVE-2026-112816 page requires JavaScript to display properly. The supplied content gives no details about the vulnerability. (cve.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.