Polymarket suffers second multimillion-dollar security breach in just four months

Polymarket restored trading on Oct. 29, after a compromised third-party provider disrupted its international prediction market.The earlier website-script attack on June 25 reportedly drained about $3 million. The recurrence raises a security question about how much financial authority outside code can reach inside a trader's browser.Its official incident record records trading restrictions from 18:05 UTC and resolution at 19:05 UTC. Polymarket said it had fixed the issue, referred it to law enforcement, and would make affected users whole.The issue extends beyond replacing a compromised supplier, since separate investigations describe malicious code reaching for financial functions inside the website. June's reported route relied on approved authorizations, while October's code searched for trading tools and requested signatures.Two scripts, different routes to users' assetsOn June 25, Polymarket disclosed a malicious script injected through a compromised vendor. In its Source Defense investigation, it said the affected dependency had been removed, and users would receive full refunds.Source Defense reported that roughly $3 million was drained, tracing the delivery chain through a ...