Polymarket halts trading after malicious script injection drains $2.5M from users

What happened

Polymarket, the decentralized prediction market platform, has suspended all trading after an attack that drained roughly $2.5 million in user funds. According to a dev.to report published on October 29, 2026, the breach did not involve an exploit of Polymarket's core smart contracts. Instead, attackers compromised a third-party service the platform uses to deliver front-end code to visitors.

The incident took place on Thursday, October 29, 2026. Polymarket halted trading to prevent further losses while the investigation continues.

How the attack worked

The dev.to report, citing BleepingComputer, says the compromise let attackers push a malicious JavaScript snippet to people visiting the site. Because the code ran in users' browsers rather than on the blockchain, it could interact with wallets directly.

So-called "crypto drainer" scripts typically hijack user interactions and coax visitors into signing harmful transactions or granting approvals that let the attacker spend their tokens without limit. Once signed, the transfers look legitimate to the chain, because the user has authorized the movement themselves — no protocol flaw is required.

About $2.5 million in cryptocurrency has been traced to a single wallet believed to belong to the attacker.

What remains unclear

The dev.to report flags several open questions:

• The compromised vendor. Neither Polymarket nor security researchers have publicly named the specific service, library or CDN that was breached.
• The victim count. While the traced funds point to one wallet, the number of individual users affected is still being assessed.
• Restitution. It is not yet known whether the funds can be recovered or whether Polymarket will set up compensation for affected users.

The lesson for developers

The incident underlines how much trust a single external script tag carries. Loading code from another domain — analytics, tag managers, UI widgets — gives that domain the power to execute code in your users' security context. On a platform where that code can prompt wallet signatures and token approvals, the third party effectively holds the keys.

Standard defenses include Subresource Integrity (SRI), which pins scripts to a known cryptographic hash, and a strict Content Security Policy (CSP), which limits which origins are allowed to execute code. The dev.to report describes these measures as critical for any modern web application handling financial transactions or sensitive data, and this case is a concrete illustration of why.

Why it matters

The blockchain held; the website did not. Polymarket's smart contracts were reportedly not at fault, yet users still lost millions because the code their browsers downloaded had been tampered with upstream. For any product that touches user funds, third-party delivery infrastructure is part of the attack surface whether teams treat it that way or not. The episode should add pressure on platforms, in crypto and beyond, to adopt SRI, strict CSPs and self-hosting of security-critical scripts — and it shows how a front-end supply-chain compromise can force an entire market, however decentralized its settlement layer, to grind to a halt.