Polymarket Halts Trading After Third-Party Breach Compromises User Accounts
Polymarket suspended trading on October 29 after a compromised website supplier injected malicious code into the platform's interface, allowing attackers to access logged-in user accounts. The platform said it identified the issue and pledged to make affected users whole while it restored service.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The Breach and Response
Polymarket halted trading after discovering that a third-party website supplier had been compromised, introducing malicious code into the platform's trading interface. According to security researchers, the injected code attempted to execute unauthorized transactions—selling user positions and moving assets—using the credentials of logged-in accounts. The platform acknowledged the breach but did not disclose the total number of affected users or quantify the funds at risk.
Polymarket said it had identified and remediated the issue and committed to making affected users whole. The platform kept trading halted while it worked to restore service and implement additional safeguards.
Trust and Third-Party Risk
The incident underscores a structural vulnerability in web-based trading platforms: the reliance on external suppliers to deliver code that executes in users' browsers. Even with security reviews, a single compromised vendor can expose thousands of authenticated sessions to malicious logic. Traders who believed they were interacting directly with Polymarket's servers were, in fact, running code that could be modified without the platform's knowledge or consent.
Polymarket's experience mirrors similar supply-chain attacks in other industries, but the financial stakes in crypto trading—where accounts hold liquid assets and transactions settle instantly—compress the damage timeline and raise the cost of detection delays.
Why It Matters
For Traders
Polymarket trading remains suspended; users with open positions cannot exit, and the scope of compromised accounts is not yet fully disclosed.
For Investors
Third-party code injection at a major prediction market platform highlights ongoing operational risks in centralized web infrastructure, even for non-custodial trading.
For Builders
The incident reinforces the case for client-side signing and encrypted state management; platforms relying on server-injected logic face irreducible supply-chain attack surface.
This article is for information only and is not financial advice. Read the full disclaimer.
