Third‑Party Script Compromise Leads to $2.7 M Theft from Polymarket Users
What Happened — Polymarket, a decentralized prediction‑market platform, confirmed that a malicious third‑party JavaScript file was injected into its web interface in early 2024. The compromised script harvested users’ private keys and silently authorized cryptocurrency transfers, resulting in the unauthorized loss of roughly $2.7 million from user wallets. The breach surfaced after multiple users reported missing funds; Polymarket froze further withdrawals, launched an internal investigation, and pledged $3.9 million in refunds and compensation for paused trades.
Why It Matters for Trust & Control Assurance — The incident highlights the critical control objective of vendor/third‑party risk management—continuous oversight and integrity verification of external code is essential to meet multiple framework requirements simultaneously.
Who Is Affected — Financial‑technology platforms, crypto exchanges, and any SaaS product that incorporates third‑party scripts.
Recommended Actions —
- Inventory every third‑party script, library, or widget used in production.
- Enforce Subresource Integrity (SRI) or code‑signing to verify script authenticity at load time.
- Deploy continuous monitoring of vendor security posture and supply‑chain alerts.
- Capture and retain evidence of vendor assessments for audit readiness.
Technical Notes —
- Attack vector: Compromised third‑party JavaScript delivered via the platform’s front‑end (supply‑chain attack).
- Data types exposed: Private cryptographic keys and transaction authorizations.
- No public CVE; the flaw was a malicious injection by a script provider.
Source: HackRead