Polymarket Suffers Second Multi‑Million Dollar Breach in Four Months

Polymarket’s trading platform was shut down on Oct. 29 after a malicious third‑party script infiltrated the site’s login session, searching for trading tools and requesting signatures. Blockchain analytics firm Bubblemaps estimated that more than 700 users were affected, with about $3.46 million of assets compromised. Roughly $2.7 million was converted to POL and transferred out, while $750,000 remained on the platform. The October breach followed an earlier June attack in which a compromised vendor’s script used approved authorizations to drain approximately $3 million from users’ wallets via Polymarket’s own relayer. Both incidents demonstrate how external scripts can access a user’s browser context, obtain cryptographic signatures, and move funds, raising questions about the boundary between third‑party code and the platform’s internal signing mechanisms.