--- title: How One Script Stole Millions From Polymarket #crypto... description: Hackers compromised a third-party performance-monitoring script used by Polymarket and turned it into malware. On October 29, attackers breached the vendor... canonical: https://daily.dev/posts/how-one-script-stole-millions-from-polymarket-crypto-security-tech-dhyfyk2mj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How One Script Stole Millions From Polymarket #crypto #security #tech | daily.dev og:description: Hackers compromised a third-party performance-monitoring script used by Polymarket and turned it into malware. On October 29, attackers breached the vendor... og:url: https://daily.dev/posts/how-one-script-stole-millions-from-polymarket-crypto-security-tech-dhyfyk2mj og:image: https://api.daily.dev/og/posts/DhYfYK2mJ.png og:image:alt: How One Script Stole Millions From Polymarket #crypto #security #tech og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How One Script Stole Millions From Polymarket #crypto #security #tech **[ByteMonk](https://daily.dev/sources/bytemonk)** · 1 min read · 0 upvotes · 0 comments ## Summary Hackers compromised a third-party performance-monitoring script used by Polymarket and turned it into malware. On October 29, attackers breached the vendor providing the monitoring code and swapped in a malicious version. The script used the trading software already on the page, including the transaction authorization module, to sell users' bets and withdraw funds from active sessions. The exact impact depended on how each user connected their wallet, since some wallets prompted a confirmation request. Polymarket removed the malicious code, suspended trading, and reset all user login sessions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did hackers steal funds from Polymarket users through a monitoring script? Attackers compromised the third-party vendor that supplied Polymarket's site-speed monitoring code and replaced it with a malicious version on October 29. The script used the trading software already loaded on the page, including the transaction authorization module, to sell users' active bets and withdraw funds from their wallets during live sessions. _Reviewing what access your third-party scripts actually have starts with cases like this on daily.dev._ ### What should developers check before adding a third-party monitoring or analytics script to a page? Verify exactly what the script can access on the page, not just which vendor supplies it. Third-party code loaded directly onto a page can interact with other software running there, including sensitive modules like transaction authorization, so trusting the source does not guarantee every action it triggers is safe. _Developers auditing script permissions can track supply chain security lessons like this on daily.dev._ ## Similar posts on daily.dev - [Polymarket confirms hackers stole $3M from users after third-party vendor was compromised](https://daily.dev/posts/polymarket-confirms-hackers-stole-3m-from-users-after-third-party-vendor-was-compromised-xjgaqqwd9) · The Next Web · 0 upvotes · 0 comments - [Polymarket says hackers stole users' funds](https://daily.dev/posts/polymarket-says-hackers-stole-users-funds-t57t1dzov) · TechCrunch · 0 upvotes · 0 comments - [Polymarket customers lose $3 million in supply-chain attack](https://daily.dev/posts/polymarket-customers-lose-3-million-in-supply-chain-attack-udeprymjt) · BleepingComputer · 0 upvotes · 0 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-nmpmfs4di) · Schneier on Security · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto), [#web-security](https://daily.dev/tags/web-security), [#polymarket](https://daily.dev/tags/polymarket) [View this post on daily.dev](https://daily.dev/posts/how-one-script-stole-millions-from-polymarket-crypto-security-tech-dhyfyk2mj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How One Script Stole Millions From Polymarket #crypto #security #tech","url":"https://daily.dev/posts/how-one-script-stole-millions-from-polymarket-crypto-security-tech-dhyfyk2mj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-one-script-stole-millions-from-polymarket-crypto-security-tech-dhyfyk2mj"},"datePublished":"2026-11-05T04:38:48.035Z","dateModified":"2026-11-05T04:44:58.144Z","description":"Hackers compromised a third-party performance-monitoring script used by Polymarket and turned it into malware. On October 29, attackers breached the vendor...","image":"https://i.ytimg.com/vi/eynDCMF5Wmc/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/eynDCMF5Wmc/sddefault.jpg","isAccessibleForFree":true,"articleSection":"ByteMonk","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ByteMonk","logo":"https://media.daily.dev/image/upload/s--n36_-Uve--/f_auto/v1752670492/logos/bytemonk","url":"https://daily.dev/sources/bytemonk"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-one-script-stole-millions-from-polymarket-crypto-security-tech-dhyfyk2mj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,crypto,web-security,polymarket","timeRequired":"PT1M","video":{"@type":"VideoObject","name":"How One Script Stole Millions From Polymarket #crypto #security #tech","description":"Hackers compromised a third-party performance-monitoring script used by Polymarket and turned it into malware. On October 29, attackers breached the vendor...","thumbnailUrl":"https://i.ytimg.com/vi/eynDCMF5Wmc/sddefault.jpg","uploadDate":"2026-11-05T04:38:48.035Z","duration":"PT1M","url":"https://api.daily.dev/r/DhYfYK2mJ","embedUrl":"https://www.youtube.com/embed/eynDCMF5Wmc"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ByteMonk","item":"https://daily.dev/sources/bytemonk"},{"@type":"ListItem","position":3,"name":"How One Script Stole Millions From Polymarket #crypto #security #tech"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-one-script-stole-millions-from-polymarket-crypto-security-tech-dhyfyk2mj#faq","mainEntity":[{"@type":"Question","name":"How did hackers steal funds from Polymarket users through a monitoring script?","acceptedAnswer":{"@type":"Answer","text":"Attackers compromised the third-party vendor that supplied Polymarket's site-speed monitoring code and replaced it with a malicious version on October 29. The script used the trading software already loaded on the page, including the transaction authorization module, to sell users' active bets and withdraw funds from their wallets during live sessions. Reviewing what access your third-party scripts actually have starts with cases like this on daily.dev."}},{"@type":"Question","name":"What should developers check before adding a third-party monitoring or analytics script to a page?","acceptedAnswer":{"@type":"Answer","text":"Verify exactly what the script can access on the page, not just which vendor supplies it. Third-party code loaded directly onto a page can interact with other software running there, including sensitive modules like transaction authorization, so trusting the source does not guarantee every action it triggers is safe. Developers auditing script permissions can track supply chain security lessons like this on daily.dev."}}]} ```