Polymarket third-party script breach drains user funds, refunds pledged

Key points

• A compromised third-party script on Polymarket led to theft of customer funds.
• Reported figures include $2.7 million and $3.9 million.
• Polymarket promised refunds and compensation while working to pause losses.
• No CVE was assigned; the risk is third-party script integrity.

Polymarket, a prediction market platform, has disclosed that hackers abused a compromised third-party script to take customer funds. The incident affected platform users and prompted an immediate response from the company, which has promised to make affected participants whole and is working to stop additional losses.

Reported loss figures include $2.7 million and $3.9 million. The available facts do not provide a final accounting, so defenders should treat both numbers as material indicators of impact rather than a settled total. No CVE was assigned, which is consistent with a web supply-chain compromise rather than a named software vulnerability with a patch identifier.

The central problem is trust in externally sourced JavaScript. A script loaded from a partner or vendor can change outside the platform's normal code review, and if that dependency is hijacked, it can interact with wallets, sessions, or transaction flows. For government and education IT teams, the lesson is that third-party tags need the same inventory, approval, and monitoring as internally developed code.

Polymarket has pledged refunds and compensation and says it is acting to pause losses. Users should watch for official claim instructions and avoid phishing messages that imitate refund notices. Administrators should review script allowlists, integrity controls, and vendor notifications, especially where financial or identity data is in scope.

What to do now

1. Inventory every third-party script and tag on public-facing sites, then remove unused or unapproved dependencies.
2. Enforce Subresource Integrity and a restrictive Content Security Policy for external scripts where technically feasible, and pin approved versions.
3. Rotate secrets and session tokens, and review wallet, payment, and transaction flows for unauthorized changes.
4. Monitor vendor advisories and script hashes, with alerts for unexpected changes to externally hosted code.
5. Publish only official refund and claim channels, and warn users about phishing that mimics compensation notices.
6. Isolate high-value transaction functions from third-party JavaScript and require security review before adding new tags.
7. Run a supply-chain tabletop exercise covering third-party script compromise, user notification, and loss containment.

Original source

Hackread