The popular digital prediction platform Polymarket was forced to temporarily suspend trading operations on Thursday following a security breach at a third-party service provider that allowed attackers to distribute malicious JavaScript code targeting user accounts and draining their cryptocurrency balances and prediction positions.
The company confirmed the security incident, explaining that it successfully identified and resolved the issue on its international platform and referred the breach to the relevant security authorities. The company noted its commitment to fully compensating all affected individuals, confirming that trading operations would resume later after ensuring the system was secured.
Sequence of Operational Procedures
Polymarket initiated containment procedures at 2:05 PM local time by switching its platform to cancel-only mode and suspending rollover procedures. In less than half a minute, the company announced the vulnerability had been fixed, and full trading resumed about an hour after the temporary suspension once the safety of the operational environment was verified.
Technical data and analyses by cybersecurity firm Hudson Rock showed that the malicious script exploited the infrastructure of website performance monitoring company DebugBear, where the code was distributed via its monitoring services and a wallet associated with the attackers was injected.
How the Malware Operates
An security examination of the leaked version of the malicious code revealed that it was designed to hijack active and authenticated user trading sessions on the Polymarket platform, liquidate their prediction positions, and transfer assets directly to the attackers' wallet. The malware automatically checked login status and available balances to execute unauthorized transactions, exploiting the trading functions embedded within the platform itself.
What Matters to Users and the Tech Sector?
This incident highlights the risks of cross-site threats and software supply chains, where vulnerabilities do not necessarily originate from the target platform's core systems, but rather from external components and tools linked to the website. With Polymarket confirming its intention to compensate affected users and remove the compromised monitoring tools, questions remain regarding the extent of the hackers' access to the third-party service provider's systems and the exact scale of the actual damage.