Polymarket Suspends Trading Following Third-Party JavaScript Breach

On Thursday, Polymarket, a prominent prediction market platform, temporarily suspended trading operations after security researchers discovered that a third-party service had been compromised to distribute cryptocurrency-draining JavaScript. The breach affected users who interacted with the platform, with approximately $2.5 million in cryptocurrency assets traced to a suspected attacker wallet.

According to reporting by BleepingComputer, the attack vector involved the compromise of a trusted third-party integration used for JavaScript distribution. By injecting malicious scripts into this trusted channel, attackers were able to target Polymarket users and drain cryptocurrency from their wallets. The exact nature of the third-party service and the specific mechanism of script injection remain under investigation.

Following the discovery, Polymarket took the platform offline to assess the scope of the compromise and prevent further user exposure. The platform advised users to revoke wallet permissions and check for any malicious script injection. Security analysts note that the incident underscores the growing threat landscape targeting decentralized finance (DeFi) and cryptocurrency platforms, where supply chain compromises of third-party services can have significant financial impact. Investigation into the attribution of the attack and the full extent of the user impact is ongoing.