More than 700 users were reportedly affected in the latest incident, raising questions about why compromised third-party scripts remain a threat to the platform.

Polymarket restored trading on Oct. 29, after a compromised third-party provider disrupted its international prediction market.

The earlier website-script attack on June 25 reportedly drained about $3 million. The recurrence raises a security question about how much financial authority outside code can reach inside a trader's browser.

Its official incident record records trading restrictions from 18:05 UTC and resolution at 19:05 UTC. Polymarket said it had fixed the issue, referred it to law enforcement, and would make affected users whole.

The issue extends beyond replacing a compromised supplier, since separate investigations describe malicious code reaching for financial functions inside the website. June's reported route relied on approved authorizations, while October's code searched for trading tools and requested signatures.

On June 25, Polymarket disclosed a malicious script injected through a compromised vendor. In its Source Defense investigation, it said the affected dependency had been removed, and users would receive full refunds.

Source Defense reported that roughly $3 million was drained, tracing the delivery chain through a marketing tag that loaded an external identity library, which the attacker replaced with a Polymarket-specific drainer.

The June payload selected wallets worth more than $100,000 and repeatedly requested a digital authorization, according to the researchers. Once approved, that authorization went through Polymarket's own relayer, the infrastructure that submits signed actions.

Source link