Polymarket users lose $2.7 million in third-party script hack

Polymarket confirmed that $2.7 million was stolen through a compromised third-party script embedded in its platform. The company has pledged $3.9 million in refunds, including compensation for losses during a pause. The article does not name the script vendor, a CVE or affected versions, so the initial access path is unconfirmed. Defenders running third-party JavaScript on crypto or financial front ends should review script inventories, enforce subresource integrity and restrict script permissions.

For security analysts · Written by AI from 1 source · Wrong?