A single malicious script exposes the weakness of the dependencies: Polymarket returns 3 million after an attack on the supply chain

Polymarket announced that it will fully reimburse customers who lost approximately $3 million after an intrusion that injected a malicious script into the front of its web, resulting from an attack on the supply chain of an external supplier. According to the company itself, its servers and backend logic were not compromised; the vector was a unit used in the presentation layer that allowed to run hostile JavaScript code on browsers of unanticipated users.

The fraud mechanism was classic in attacks on web applications that interact with critical wallets: the malicious script generated requests that induced users to sign transactions and fatal approvals from their wallets, allowing for the extraction of funds. Intelligence signatures in blockchain like PeckShield and visual analysis as published by Bubblemaps show the traceability of the movements, the conversion of the stolen assets and that the incident affected a small number of accounts.

The loss is limited to a few accounts does not reduce the severity of the failure: the attacks on the supply chain are especially dangerous because they break the assumption of confidence between a service and its dependencies. In the crypto ecosystem, where wallet authorizations are equivalent to asset access keys, a single malicious script can transform an information visit into an irreversible scam.

From an operational perspective, the incident shows common failures in the management of units and in the control of external resources: lack of controls such as Subresource Integrity (SRI) for CDN scripts, Lactic Content Security Policy (CSP) policies, lack of whitelists for third-party resources and insufficient review practices in the deployment pipeline. For platforms that handle volume and public confidence, these shortcomings are translated into reputational risk and regulatory pressure.

For the users concerned or at immediate risk, act quickly reduces exposure. Revocating excessive approvals from tokens managers and public revocation tools can prevent additional looting; a known option is Revoke.cash, which allows to inspect and revoke permits granted by your wallet. It is also recommended to disconnect connected sites, review the transaction history and, if possible, migrate assets to a wallet with cold keys until the investigation is completed.

For Web3 platform product and safety equipment, the lessons are clear: to minimize the attack surface on the front, to audit and set dependency versions, to apply rigorous SRI and CSP, to use reproducible package signatures and building, and to segregate the third party code in less privileged contexts. In parallel, maintaining bug bounty programs and simulations of supply chain attack helps to detect vectors that unit tests do not cover.

Polymarket's public response - and its decision to reimburse - is relevant from the point of view of user responsibility, but the community and regulators will also require more technical transparency: which supplier was compromised?, what integrity reviews?, what mitigation will be applied to keep it from happening again? Clear communication and the publication of a forensic report increase confidence and facilitate cooperation with onchain analysis of third parties.

At the forensic level, attackers often use bridges and swaps to mix and convert funds; in this case, PeckShield detected pulenteo from Polygon to Ethereum and a swap to ETH. Although the public traceability of lockchain facilitates tracking flows, recovering assets depends on actions coordinated with exchanges, bridge operators and authorities, and it is often partial or impossible if funds are fragmented and washed quickly.

Finally, this incident is a reminder that in environments where the real value is transferred with a signature, security must be integrated into each link of the chain: from the package developer to the user browser. Users, operators and service providers must assume that dependencies can fail and design barriers - technical, operational and legal - that mitigate impact when that happens.