Malicious code on Polymarket reportedly diverts 2.7 million dollars from traders
This brief is machine-written from public headlines and excerpts and has not been reviewed. Check the sources for the full story.
Attackers allegedly replaced a third-party script loaded by prediction site Polymarket on October 29. The malicious code executed unauthorized sales of signed-in users' positions and transferred roughly 2.7 million dollars to the hackers.
Why it matters
Third-party script compromises can bypass client-side security controls and execute unauthorized actions within active user sessions.
What to do
- Audit and inventory all third-party scripts integrated into web applications.
- Implement a strict Content Security Policy to restrict unauthorized script execution.
- Monitor active user sessions for anomalous or unauthorized transaction activity.