Supply‑Chain Breach Steals Over $2 Million from Polymarket Users

A malicious code package tied to a popular website‑monitoring utility has been used to hijack active Polymarket sessions, resulting in the loss of more than $2 million from traders on the platform.

The compromised monitoring tool injected a hidden script into the browser environment of users who were already signed into Polymarket. Once the script detected an authenticated session, it silently rerouted transaction requests to addresses controlled by the attackers, allowing funds to be siphoned without the victims’ knowledge.

Polymarket, a decentralized prediction‑market platform that lets participants wager on real‑world outcomes, has built its reputation on transparent, blockchain‑based settlements. The breach marks one of the few instances in which the platform’s on‑chain safeguards were bypassed by a client‑side exploit, highlighting the growing relevance of supply‑chain vulnerabilities in the crypto ecosystem.

Supply‑chain attacks have surged across the broader technology sector, with threat actors increasingly targeting third‑party services that many users trust by default. By compromising a tool that developers and analysts commonly install for site performance monitoring, the attackers leveraged a trusted relationship to gain a foothold, a tactic that mirrors recent incidents affecting software build pipelines and browser extensions.

Polymarket has acknowledged the incident, stating that it is working with cybersecurity firms and law‑enforcement agencies to trace the stolen assets and fortify its front‑end defenses. The platform has urged users to revoke any active sessions, change passwords, and consider using hardware wallets for future transactions. Analysts say the episode underscores the need for crypto services to adopt rigorous third‑party risk assessments and for users to stay vigilant about the software they integrate into their browsing environment.