Key Takeaways
-
Hackers drained approximately $2.73 million from 737 Polymarket accounts through 985 withdrawals in about an hour.
-
Malicious code linked to a third-party monitoring script exploited logged-in sessions to sell positions and transfer assets.
-
Polymarket temporarily restricted trading, restored operations, and promised full reimbursements.
Hackers stole approximately $2.7 million from more than 700 Polymarket accounts on Oct. 29 after malicious code in a third-party website tool exploited active trading sessions, forcing the prediction market to temporarily halt trading.
Polymarket confirmed that an outside provider had been compromised, said it had resolved the issue, and pledged to reimburse affected users. Trading subsequently resumed on its international platform.
Blockchain analytics firm Bitquery traced approximately $2.73 million in unauthorized withdrawals across 737 accounts.
The incident highlights how compromised website software can expose traders even without an identified vulnerability in the underlying smart contracts.
Compromised Monitoring Script Targeted Logged-In Traders
Security researchers linked the attack to a JavaScript file served through in...