Polymarket supply chain attack drains trader wallets through compromised script
A supply chain attack on Polymarket's international platform compromised a third-party analytics script to deploy a crypto wallet drainer, prompting an immediate trading halt. Security researchers at Hudson Rock published an alert on Wednesday, October 29, 2026, warning users who traded on or visited the platform that day to review their wallets and transactions. The malicious script reportedly drained user funds. The separate CFTC-regulated US exchange was not affected.
The breach exposes third-party data providers as a critical vulnerability even for platforms with audited smart contracts. Competitors like Kalshi and ForecastEx can now point to concrete losses when arguing that regulated custody infrastructure offers stronger protection. Traders with funds on the international site face frozen positions while Polymarket investigates.
The incident stains the shared Polymarket brand, so trust damage bleeds into the regulated US venue too. Polymarket's reimbursement promise will test its treasury and set a benchmark that rivals will be measured against in future breaches. A delayed or partial payout would amplify the argument that registration matters more than speed.