Polymarket 暫停交易，惡意腳本注入攻擊導致約 $2.5 million 用戶資產被盜
Polymarket Trading Halted: $2.5M Drained via Malicious Script Injection
Polymarket 在約 $2.5 million 用戶加密資產遭竊後，暫停所有交易以防止進一步損失。攻擊者入侵平台用來分發前端程式碼的第三方服務，並非直接利用 Polymarket 的智能合約漏洞。
Polymarket, the decentralized prediction market platform, has officially suspended trading following a targeted attack that resulted in the theft of approximately $2.5 million in user assets. The breach, which occurred on Thursday, October 29, 2026, highlights the persistent vulnerability of web platforms to third‑party supply chain compromises.
The Attack Vector: Malicious JavaScript Injection
According to reports from BleepingComputer, the incident was not a direct exploit of Polymarket's core smart contracts. Instead, attackers compromised a third‑party service used by the platform to deliver front‑end code.
This compromise allowed threat actors to distribute a "crypto‑draining" JavaScript snippet to users visiting the site. These scripts typically function by intercepting user interactions and prompting them to sign malicious transactions or approve unlimited token allowances, which then transfer funds directly to the attacker’s wallet.
Confirmed Facts
- Trading Suspension: Polymarket has temporarily halted all trading activity to prevent further losses while the investigation continues.
- Financial Impact: Approximately $2.5 million in cryptocurrency has been traced to a specific wallet suspected of belonging to the attacker.
- Method: The breach originated from a third‑party service used to distribute JavaScript, rather than a flaw in the underlying blockchain protocol.
Areas of Uncertainty
While the immediate threat has been addressed by halting the site, several details remain unconfirmed:
- The Third‑Party Source: The specific service, library, or CDN that was compromised has not yet been publicly named by Polymarket or security researchers.
- Total Victim Count: While $2.5 million has been traced to one wallet, the total number of individual users affected is still being assessed.
- Restitution: It is currently unclear if Polymarket will be able to recover the funds or if a compensation plan will be established for affected users.
Developer Takeaway: The Risk of "Invisible" Dependencies
For web developers and software engineers, this incident serves as a stark reminder of the risks associated with third‑party scripts (such as analytics, UI widgets, or tag managers). When a <script> tag is included from an external domain, that domain is effectively granted the ability to execute code within your users' security context.
Standard mitigations such as Subresource Integrity (SRI) and strict Content Security Policies (CSP) are critical for modern web applications, particularly those handling financial transactions or sensitive user data.
AI Disclosure: This article was written with the assistance of an AI. The content is based on technology news reports from October 29, 2026.
Illustration generated with AI.
來源：DEV Community · dev.to