Polymarket Trading Halted After Third-Party Script Drains $2.5M in Crypto

Key points

• Polymarket suspended trading Thursday after a malicious script reached users.
• The suspected attacker appears to have compromised an outside service, not the core platform.
• Roughly $2.5 million in cryptocurrency was taken; investigators are tracing the funds.
• The incident highlights supply-chain risk from externally hosted JavaScript.

Polymarket, a prediction market platform, stopped trading on Thursday after a malicious JavaScript payload began draining cryptocurrency from users. The suspected attacker did not appear to breach Polymarket directly; instead, evidence points to an outside service that supplied code to the site. That vendor then pushed a script designed to pull crypto assets from wallets interacting with the platform.

The disruption forced Polymarket to suspend trading while the issue was contained. Roughly $2.5 million in cryptocurrency was taken, and investigators have begun tracing the movement of those assets. No CVE has been assigned, and the available facts do not identify the outside provider or the individuals behind the attack.

The case matters because third-party dependencies remain a common attack path. A single compromised vendor can inject malicious code into a trusted site, bypassing perimeter controls and reaching users at scale. For government and education IT teams, the same pattern applies to analytics widgets, chat embeds, content delivery networks, and other externally hosted scripts.

Watch for vendor notifications, unexpected script changes, and unusual wallet prompts. Any organization that embeds outside JavaScript should review its inventory and monitor for unplanned updates. The traced funds may provide leads, but attribution remains unresolved.

What to do now

1. Inventory every externally hosted script and third-party service in use; assign an owner and business justification to each.
2. Add Subresource Integrity where supported and enforce a strict Content Security Policy that blocks unknown script origins.
3. Pin approved script versions and alert on hash or source changes; require review before any vendor update reaches production.
4. Review vendor security notifications and contracts for breach reporting; temporarily remove nonessential embeds during active incidents.
5. Monitor outbound traffic from web properties for anomalous destinations and preserve logs for forensic review.
6. Rotate integration keys and tokens tied to affected vendors, and enforce least privilege and MFA on all third-party connections.
7. Run a supply-chain compromise tabletop exercise covering script injection, user notification, and wallet-risk guidance.

Original source

BleepingComputer