Polymarket Suspends Trading After Third-Party Script Compromise Drains Crypto Wallets

What Happened

According to BleepingComputer, prediction market platform Polymarket temporarily halted trading on Thursday, October 29, 2026, after attackers compromised a third-party service used by the platform to distribute malicious, cryptocurrency-draining JavaScript. Investigators have reportedly traced approximately $2.5 million in assets to a suspected attacker wallet. Full technical details of the compromised service and the exact injection mechanism have not yet been disclosed.

Why It Matters

This is a supply-chain-style compromise: the attackers reportedly did not breach Polymarket's own infrastructure directly but instead compromised a third-party dependency that Polymarket's front end relies on, then used that trust relationship to serve malicious script content to end users. This pattern is especially dangerous for crypto and DeFi platforms, where a single injected script with wallet-signing prompts can silently drain user funds with no further interaction needed beyond a signature approval. Any organization embedding third-party JavaScript (analytics, widgets, CDNs, ad tech) in financially sensitive web applications faces similar exposure.

What Defenders Should Watch For

• Inventory and monitor all third-party scripts loaded by customer-facing web apps, especially those with wallet-connect or transaction-signing functionality.
• Implement and enforce Subresource Integrity (SRI) and strict Content Security Policy (CSP) to detect or block unauthorized script modification.
• Alert on unexpected changes to third-party script hashes/ETags or unusual new domains being contacted by front-end code.
• For crypto/DeFi platforms, monitor for anomalous wallet-approval or transfer patterns correlating with front-end script changes or deploys of third-party vendors.
• Review vendor/third-party service security postures and incident response commitments as part of ongoing supply-chain risk management.

Developing Story

This incident is newly reported and details are still emerging; Polymarket has not yet published a full post-incident technical breakdown as of this writing. We will track this story for a confirmed root cause and any follow-on indicators. Read the original report at BleepingComputer.