Polymarket Frontend vergiftet: $ 3M über Vendor Script Injection gestohlen

Polymarket, the $9 billion prediction-market platform, just lost $3 million to a supply-chain attack that hit its frontend, not its backend. Hackers injected malicious JavaScript through a compromised third-party vendor, tricking users into approving fraudulent transactions on the official Polymarket website.

The Attack Vector: A Frontend Dependency, Not a Server Breach

Polymarket's own infrastructure stayed clean. The breach happened at a vendor that supplies frontend dependencies. That malicious script then ran in the browser of every visitor, prompting users to sign wallet transactions that drained their funds. This is the classic “trust the frontend you see” failure, and it cost real money.

Blockchain security firm PeckShield pegged the losses at roughly $3 million in ParyonUSD. The attacker bridged the stolen funds from Polygon to Ethereum and converted them into 1,893 ETH. Bubblemaps confirmed fewer than 15 accounts were drained, and Polymarket published a list of affected wallets.

Polymarket’s Response: Full Reimbursement, Few Technical Details

Polymarket says it will fully reimburse every customer who lost funds. That's the right call, but the announcement is thin on specifics: no vendor name, no timeline, no root-cause analysis beyond “supply-chain attack.” Independent intelligence firms filled the gap, but Polymarket needs to publish a postmortem if it wants to rebuild trust.

This isn't a novel technique. Third-party script injection has been used against LastPass, OptinMonster, and others. What makes this notable is the target: a $9 billion crypto platform with massive trading volume that claims to reflect “market expectations” for real-world events. If the frontend can be silently poisoned, the integrity of every price signal becomes questionable.

What This Enables Next: Tighter Supply-Chain Auditing for Web3 Frontends

Crypto platforms have spent years hardening smart contracts and backend APIs. The frontend dependency chain remains the soft underbelly. Expect more teams to adopt subresource integrity (SRI) checks, content security policies, and runtime script monitoring. Until every third-party JS bundle is treated as a potential attack surface, this won't be the last $3 million lesson.

Source: Polymarket customers lose $3 million in supply-chain attack
Domain: bleepingcomputer.com