Hackers steal about $2.7 million from Polymarket traders via hijacked third-party script

· Cybersecurity

Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. The incident highlights how third-party scripts, even benign performance tools, can become a supply-chain path into a site's authenticated sessions. For crypto platforms and any business loading outside JavaScript, the case underscores the need to monitor and constrain vendor scripts that run in users' browsers.

Why it matters：It shows how a trusted third-party script can compromise logged-in users and drain value directly, a supply-chain risk facing every web platform that embeds outside code.

Key points

  • The malicious code replaced a page-speed script loaded from an outside company.
  • Polymarket is refunding about $2.7 million to 726 affected wallets.
  • The attack on signed-in traders occurred on October 29.

Sources (original reporting)

More stories from this day