Polymarket frontend compromised via third-party vendor; $3M stolen

Affected Systems

Polymarket platform users. Attack vector: malicious JavaScript injected into frontend via compromised third-party vendor. Approximately $3 million in customer funds stolen. No CVE assigned.

Exploitation Status

Active exploitation confirmed. Attackers successfully injected malicious scripts into production frontend, resulting in $3 million theft from customer accounts. Attack executed via supply chain compromise of third-party vendor.

Business Impact

Direct financial loss to customers ($3M total). Polymarket committed to full reimbursement, limiting customer impact but creating operational cost for platform. Demonstrates risk of third-party JavaScript dependencies in web applications. Organizations using similar architectures (crypto platforms, financial services with third-party frontend integrations) should review vendor access controls and content security policies. No immediate impact to organizations not using Polymarket or the compromised vendor (vendor identity not disclosed).

Urgency

🟠 Within 24 hours

Recommended Actions

• If using Polymarket: verify account activity, reset credentials, and monitor for unauthorized transactions or wallet connections
• Review all third-party JavaScript vendors with access to production frontends; implement Subresource Integrity (SRI) hashes for external scripts
• Deploy or strengthen Content Security Policy (CSP) headers to restrict script execution to trusted sources only
• Implement runtime monitoring for unexpected DOM modifications or unauthorized script injection on customer-facing applications
• Establish vendor security assessment process including code review rights and incident notification SLAs for any third party with production access