Polymarket temporarily halted trading after a compromised third-party service distributed cryptocurrency-draining JavaScript through its website. The malicious script used authenticated sessions to liquidate positions or transfer user assets. Approximately $2.5 million was traced through a suspected attacker wallet, although Polymarket did not confirm the amount stolen or the number of affected users. Trading resumed about an hour after the initial suspension, and the company said affected traders would be reimbursed.
Why It Matters
A trusted browser script can become a direct route into active customer sessions without compromising the platform’s core application. For leaders: third-party monitoring code belongs inside the organization’s security and financial-risk boundary. For defenders: inventory external scripts, minimize their privileges and be ready to remove them quickly when a supplier reports an incident. Session activity and transactions during the affected period require careful review. The larger lesson is that lightweight website dependencies can carry high-impact supply-chain risk.
What Defenders Should Do
Audit third-party browser scripts and establish a tested process to disable them without taking the full service offline.