Polymarket loses over $2M after website-monitoring supplier compromise

Key points

• A third-party site-monitoring supplier was compromised in a software supply-chain incident.
• Attackers inserted harmful code and took over active sessions.
• More than $2 million was stolen from Polymarket users.
• No CVE was cited, and the incident is rated high severity.

Polymarket has been hit through an outside provider of site-monitoring software, according to the facts available. The attackers did not begin at the trading service itself; they compromised the third-party supplier and planted harmful code as part of a software supply-chain compromise. That foothold was then used to take over active user sessions, turning trusted traffic into a route for account access.

Once sessions were seized, money was removed from affected accounts. More than $2 million has been reported stolen, with people trading on Polymarket bearing the direct impact. The pattern matters because the initial weakness sat in a supporting tool, not necessarily in Polymarket's core platform, yet the financial damage landed on its users.

No CVE has been associated with the incident, so defenders cannot rely on a patch identifier or standard vulnerability scan to find it. The event is rated high severity. It illustrates how a vendor with visibility into a site or its visitors can become a high-value stepping stone, especially when its code is trusted and widely loaded.

Organizations should watch for vendor advisories, unexpected changes to third-party scripts, and unusual session behavior such as logins from new locations or rapid account actions. The response should focus on containing the supplier, invalidating active sessions, and reviewing whether similar monitoring tools are running in sensitive environments. The key question is not only who was breached first, but which downstream accounts and funds were exposed before the malicious code was removed.

What to do now

1. Immediately disable or remove the affected site-monitoring component from production pages, and isolate any systems that loaded it.
2. Invalidate all active user sessions and rotate session-signing keys, cookies, and API tokens that could have been exposed.
3. Force credential and MFA resets for Polymarket-linked accounts and any staff accounts that reused the same credentials.
4. Review web and authentication logs for injected code, anomalous session creation, and unusual account or fund activity; preserve evidence.
5. Contact the monitoring supplier for indicators, affected versions, and a remediation timeline; do not re-enable until validated.
6. Audit all third-party scripts and require integrity checks, change approval, and least-privilege access for vendors.
7. Brief affected users and finance/security teams, and monitor account balances and transaction alerts for follow-on theft.

Original source

SecurityWeek