Prediction market Polymarket temporarily halted trading on its international platform on 29 October after users reported withdrawals from their wallets that they had not approved, CNBC reports. A person familiar with the matter links the incident to a breach at DebugBear, a UK website performance monitoring service, which confirmed it had a security incident. Polymarket says it fixed the issue, trading resumed after about an hour and it will reimburse all affected users. Analytics firms estimate that one account withdrew at least $2.7 million from 710 wallets.

What it means: The case shows how dangerous third-party scripts loaded into a web page can be. Tools for performance monitoring, analytics or customer chat run inside the page with the same rights as the company's own code, so if the provider is breached, an attacker can change what users see or sign. In apps where users approve transactions from a browser wallet, that translates directly into stolen money. It is the second time this year Polymarket has blamed losses on a compromised supplier, which suggests its control over external scripts is still not strict enough. For any online shop or payment service, the measures are well known: limit third-party scripts on payment and login pages, use a content security policy, check file integrity and monitor changes. The PCI DSS 4.0 requirements for payment pages target exactly this risk. The timing, days before the US midterm elections and the heavy trading expected, raises attackers' interest in such platforms. The international platform is not supervised in the US, so user protection depends on the company's goodwill.

Read the original on CNBC

Related service: Custom software

Related stories