Arkansas files lawsuit against Kalshi, describes operator as 'pocket-sized bookie' The lawsuit was filed in Independence County Circuit Court, with Arkansas Attorney General Tim Griffin seeking restitution, injunctive relief, compensatory damages and civil penalties. Key Points Griffin alleges Kalshi misrepresented the legality and safety of its products and engaged in unconscionable conduct Arizona and Utah are the first US states to file criminal charges against Kalshi, potentially resulting in prison time for the operator's Co-Founders Arkansas Attorney General Tim Griffin has filed a lawsuit against Kalshi in Independence County Circuit Court, representing the latest US state to enter into legal action against the prediction market operator. Within Griffin's filing, the Attorney General states: "The existence of legitimate derivatives does not grant Kalshi carte blanche to turn virtually any real-world occurrence into a betting opportunity. When it comes to the majority of its offerings, Kalshi is not a risk management tool; it is a pocket-sized bookie. "Whatever label Defendants attach to these contracts, consumers use them to do what gamblers have always done: risk money on the outcome of an athletic contest in hopes of receiving a greater return. That is sports betting. And Arkansas has long chosen to regulate such conduct because of the risks it poses to consumers and the public." Griffin is seeking restitution, injunctive relief, actual and compensatory damages and civil penalties as part of the lawsuit, having also alleged that Kalshi misrepresented the legality and safety of its products and engaged in unconscionable conduct. The Arkansas regulator also believes Kalshi failed to disclose material information regarding financial risks and professional-trader advantages and was "unjustly enriched" through unlawful gambling activity. The lawsuit would force Kalshi to restrict operations in Arkansas and recover any funds obtained from residents, while the state would impose civil penalties for its prediction market activity. Representing an advanced effort to deter Kalshi's services, Arizona and Utah became the first US states to file criminal charges against the operator, which include potential prison time for Co-Founders Luana Lopes Lara and Tarek Mansour. Such penalties are unlikely even if Kalshi were to be found guilty, however, but the charges do include a 20-count misdemeanor filing in Arizona and a second-degree felony charge, 12 third-degree felony counts and one Class A misdemeanor in Utah. Good to know Prediction market operators Kalshi and Polymarket announced new guardrails for player safety on October 28, as well as to detect potential manipulation of US Midterm Election markets

Polymarket's second vendor-script breach in four months drains 726 accounts. Polymarket's Oct. 29 DebugBear vendor breach drained up to $2.73M from 726 wallets, triggering a $3.9M refund. It's the second such hack in four months. * Subject - Polymarket third-party vendor script breach * What happened - Front-end supply-chain attack / wallet drainer * Actor - compromised third-party provider * Regulator - British law enforcement authorities * Jurisdiction - United Kingdom * Status - Resolved * Incident - 2026-10-29 * Disclosed - 2026-10-29 * Source - https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj What happened. Polymarket halted trading on its international platform for about an hour on October 29, 2026, after users reported unauthorized withdrawals from their accounts. The exchange's status page shows the outage began at 5:38 PM UTC and was resolved by 6:15 PM UTC. A separate third-party vendor compromise in June 2026 drained roughly $3 million. Source Defense's investigation traced the delivery chain to a marketing tag that loaded an external identity library, which the attacker replaced with a Polymarket-specific drainer. Per CryptoSlate's report on the Source Defense findings, the June payload selected wallets worth more than $100,000 and repeatedly requested a digital authorization. Polymarket's platform-status disclosure framed the cause plainly: "Security incident - 3rd party vendor compromised," per the Polymarket status page. The incident was marked Resolved on that status page. The breach matters because it is not an isolated glitch. It is Polymarket's second multimillion-dollar front-end compromise in four months, and it exposes a structural weakness that has nothing to do with smart-contract code: third-party scripts loaded directly into a trading interface, often with enough access to interact with a logged-in user's wallet session. Polymarket's own contracts were never touched. The attacker instead compromised a vendor used to measure page performance, and used that foothold to intercept live trading sessions. Why the $5.5B Binance Exploit Is a Bigger Deal Than You Think A crypto commentator breaks down why a reported $5.5 billion exploit on Binance, despite being reimbursed, signals deeper trust and security problems in crypto exchanges. Useful for crypto investors and security-consciou The vector: a monitoring script, not a smart contract. According to Report URI's Scott Helme, "a page-speed monitoring script served from vendor DebugBear's CDN was swapped for a drainer that hijacked logged-in sessions for about an hour." Polymarket embedded DebugBear's RUM snippet directly into its trading page, giving the vendor's script a direct line into the live session of anyone using the platform. DebugBear confirmed on X that it was "impacted by an ongoing security incident" and urged all customers running its RUM snippet to pull it from their sites immediately. A follow-up update reported by Brandefense on November 2 clarified the root cause: DebugBear's DNS server records were compromised through its own domain registrar, not through a breach of Polymarket's infrastructure. Security researchers who reviewed the incident traced the malicious script to the same address Polymarket's trading page loaded for DebugBear's monitoring code. Hudson Rock obtained a copy of the malicious JavaScript pulled from the compromised DebugBear address used by Polymarket. The firm found the code was built to hunt for a logged-in user's trading tools and portfolio - not a generic skimmer, but a script purpose-built to locate active Polymarket sessions and extract value from them. The numbers: who lost what. Estimates of the total stolen varied slightly by firm and methodology in the hours after the attack, but converged in a tight band: | Source | Estimate | Method | | GoPlus | ~$2.71 million | On-chain tracing of 710 deposit wallets, 731 addresses | | Bubblemaps | ~$2.7 million, ~700 users affected | Blockchain analytics | | The Block, citing Arkham | ~$2.65 million | Blockchain analysis group data | | Polymarket's own refund accounting | $2.7 million stolen + $1.2 million pause-related losses = $3.9 million total | Internal on-chain and trading data review | GoPlus, which independently attributed the attack to a supply-chain compromise of DebugBear's RUM script, put losses at roughly $2.71 million, with the primary attack path running through 710 deposit wallets and 731 addresses. Bubblemaps reported around 700 users affected and approximately $2.7 million stolen. The Block, citing Arkham data, put the figure at roughly $2.65 million. The loss distribution, according to Bitquery's analysis cited by Bankless, was heavily skewed: the median victim lost just $171, but four accounts that each lost over $100,000 accounted for 43% of the total haul. That pattern - a long tail of small losses alongside a handful of whale-sized extractions - suggests the drainer script was either opportunistic across all sessions or specifically tuned to flag high-value wallets once detected. Who is affected. Polymarket's international platform, Polymarket.com, was the only system compromised. Polymarket's US platform, which operates as a federally regulated exchange, was reportedly unaffected, Polymarket's internal data identified 726 wallets hit by the breach. As of Friday morning following the attack, 689 of those 726 wallets had been fully repaid, with the remaining 37 being paid out as each was individually verified. The company said it identified eligible wallets directly from on-chain and trading data rather than requiring users to file claims or support tickets. Polymarket said the attack appeared to emanate from the United Kingdom and that it had referred the matter to British law enforcement authorities, the regulator now handling the case. Timeline. * June 2026 - Source Defense's investigation traced the delivery chain to a marketing tag that loaded an external identity library, which the attacker replaced with a Polymarket-specific drainer targeting wallets worth more than $100,000. * October 29, 2026, ~2:00 p.m. ET / 5:38 PM UTC - Polymarket's international platform moves into cancel-only mode after users report unauthorized withdrawals. * October 29, 2026, ~3:00 p.m. ET / 6:15 PM UTC - Trading resumes; the outage, classified as a major outage affecting the web app and account access and authentication, lasts roughly 37 minutes. * October 29, 2026 - DebugBear confirms an "ongoing security incident" and tells RUM customers to remove its snippet. * October 30, 2026 - Polymarket issues a postmortem update; refunds under $10,000 are due to be paid automatically. * November 2, 2026 - DebugBear's provider discloses that its DNS records were compromised through its own domain registrar, the root cause behind the malicious script substitution. The response. Polymarket's postmortem, published on its status page, committed to returning a total of $3.9 million to traders - the $2.7 million believed stolen plus an additional $1.2 million to cover losses tied to the trading pause itself, as reported by Bankless. The company said no claims or support tickets were required: eligible wallets were identified directly from on-chain and trading data. Refund mechanics were split by loss size. Users whose losses fell below $10,000 were due to receive refunds automatically by October 30, while those with larger losses were asked to complete a release form before payment. By the following morning, 689 of the 726 affected wallets were fully repaid, with the last 37 paid as each was verified - an unusually fast remediation timeline for an exchange-level security incident. This is also Polymarket's second reported third-party website compromise in four months, following the June incident that drained roughly $3 million through a compromised marketing tag. Polymarket has not detailed what structural changes, if any, it is making to how third-party scripts are vetted or sandboxed going forward. What to do. Front-end supply-chain attacks like this one are difficult for ordinary users to detect in the moment, because the malicious code runs inside a site they already trust and are already logged into. Still, some practical steps reduce exposure: * Revoke standing approvals regularly. If you've granted a dApp or exchange session-level permissions, periodically review and revoke token approvals using a wallet's built-in permission manager. * Watch for repeated authorization prompts. A legitimate trade rarely requires repeated signature requests in quick succession; treat that pattern as a red flag. * Use hardware wallets for high-value positions. Session hijacking is far less effective against transactions that require a physical confirmation step. * Follow vendor and platform status pages directly rather than relying solely on social media during an active incident - Polymarket's own status page provided the clearest real-time account of the outage window and resolution. * Assume third-party scripts are part of your attack surface. Platforms embedding monitoring, analytics, or marketing tags are effectively extending trust to every vendor in that chain. For platforms and developers, the structural fix is architectural, not reactive: minimizing what third-party scripts can see or touch on pages where wallet sessions are active, using subresource integrity checks, and isolating analytics and monitoring tooling from any code path that can interact with signing or withdrawal functions. Sources. Ask Cipher about this article Get AI-powered insights, related threats, and expert context - powered by CISO Brain