Hackers Exploit Third‑Party Script to Swipe $2.7 Million from Polymarket Users

On October 29, a malicious code injection on the Polymarket prediction‑market platform enabled attackers to divert roughly $2.7 million from the accounts of traders who were logged in at the time. The breach was traced to a compromised page‑speed script that the site loads from an external provider, which the hackers used as a foothold to execute unauthorized transactions.

Security analysts say the altered script replaced a legitimate performance‑monitoring tool supplied by a third‑party vendor. Once the code was in place, it automatically listed the positions of signed‑in users, sold them on the market, and redirected the proceeds to wallets controlled by the perpetrators. The operation appeared to run for a short window before the irregular activity was detected.

Polymarket, which hosts markets on a wide range of real‑world events, confirmed the incident in a statement and announced that it will reimburse affected customers. The company is working with forensic investigators and the external vendor to understand how the script was tampered with and to reinforce its supply‑chain defenses.

The incident highlights a growing concern in the cryptocurrency and decentralized‑finance sectors: reliance on external scripts can introduce vulnerabilities that bypass a platform’s own security controls. While on‑chain transactions are transparent, many web‑based interfaces depend on third‑party services for analytics, caching, or performance optimization, creating potential attack vectors that are harder to monitor.

Regulators and industry groups have called for clearer standards around supply‑chain security for crypto‑related services. In the aftermath of the Polymarket breach, experts expect tighter audits of third‑party code and increased adoption of content‑security policies to limit the impact of similar attacks. The platform’s commitment to refund users aims to restore confidence, but the episode serves as a reminder that even well‑established prediction markets remain vulnerable to sophisticated supply‑chain exploits.