Polymarket customers lose $3 million in supply-chain attack
Polymarket customers lost $3 million after hackers injected malicious JavaScript via a third-party vendor.
Polymarket, a major cryptocurrency prediction market, has reported that customers lost an estimated $3 million due to a supply-chain attack. Hackers compromised a third-party vendor, injecting malicious JavaScript into Polymarket's frontend, which tricked users into approving fraudulent transactions. The company plans to fully reimburse affected customers, and its own backend systems remained secure.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Polymarket?
Get an email when a new story names Polymarket, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers compromised a third-party vendor used by Polymarket and injected malicious JavaScript into the platform's frontend, manipulating users into approving fraudulent cryptocurrency transactions. This is a classic supply-chain attack where the weakest link was not Polymarket itself, but a trusted external dependency. The incident highlights the danger of implicit trust granted to third-party scripts and vendors — a single compromised supplier can weaponize an otherwise secure application against its own users. Organizations must treat every external dependency as a potential attack vector, not an extension of their own trusted environment.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — malicious JavaScript