Hackers Steal $2.7 M from Polymarket Traders via Hijacked Third‑Party Script
What Happened — On 29 Oct 2026, malicious JavaScript was injected into Polymarket’s public website. The code replaced a legitimate page‑speed script that Polymarket loads from an external provider. When signed‑in traders visited the compromised page, the script silently executed a “sell‑position” transaction on their behalf and transferred the proceeds to wallets controlled by the attackers. Polymarket confirmed that roughly $2.7 million (≈ 2.64 M USD in crypto) was moved from 726 wallets and is in the process of refunding the victims. The breach was discovered after users reported unauthorized withdrawals and blockchain analysis traced the funds to a single attacker address.
Why It Matters for Trust & Control Assurance — The incident demonstrates how a compromised third‑party dependency can bypass an organization’s own security controls and directly impact customer assets, highlighting the need for continuous vendor‑risk monitoring and evidence‑driven assurance.
Who Is Affected
- Crypto‑trading platforms and prediction‑market services
- FinTech firms that embed external scripts or SDKs in customer‑facing applications
Recommended Actions
- Inventory every third‑party script, library, or CDN used in production web assets.
- Implement Subresource Integrity (SRI) and CSP nonces to ensure only expected code executes.
- Deploy continuous monitoring of third‑party code hashes and runtime behavior (e.g., integrity‑checking CI pipelines).
- Conduct a rapid vendor‑risk assessment of the page‑speed provider and require evidence of secure development practices.
- Document the incident and collect logs as audit evidence for any framework‑based assessments.
Technical Notes
- Attack vector: Hijacked third‑party page‑speed script (supply‑chain compromise).
- Data/asset impacted: User‑auth tokens stored in browser session, enabling unauthorized crypto transfers.
- Detection: User‑reported unauthorized trades; blockchain forensics confirmed fund flow.
- Remediation: Script restored, affected wallets refunded, third‑party provider notified.