Polymarket Supply Chain Attack Steals $2.7M via Hijacked

Introduction

A supply chain compromise targeting the prediction market platform Polymarket resulted in the theft of approximately $2.7 million in cryptocurrency from 726 user wallets on October 29. Attackers injected malicious code by hijacking a third-party page-speed optimization script provided by DebugBear, an external service integrated into Polymarket's frontend. The rogue script executed unauthorized transactions that sold affected traders' positions and transferred the proceeds to addresses controlled by the threat actors. Polymarket has confirmed it is refunding the full amount to impacted users, while blockchain analytics indicate roughly $2.64 million in assets reached the attackers' wallets.

How the Attack Unfolded

The incident exemplifies a classic software supply chain attack: instead of targeting Polymarket's infrastructure directly, the adversaries compromised a trusted third-party dependency. DebugBear's script, intended to measure and improve page load performance, was altered to include payloads that interacted with users' connected wallets. When signed-in traders visited the site, the malicious code triggered transactions that liquidated their market positions and routed the funds outward. Because the script executed in the victim's browser with the same privileges as the legitimate application, standard perimeter defenses and smart contract audits provided no protection.

Blockchain records show the stolen assets moving through a series of addresses shortly after the October 29 injection, consistent with automated laundering attempts. The total on-chain value observed aligns closely with Polymarket's disclosed figure, suggesting the platform's internal accounting matches the public ledger.

Why Third-Party Scripts Remain a Blind Spot

Modern web applications routinely load dozens of external scripts for analytics, monitoring, advertising, and performance optimization. Each script runs with full access to the page's DOM, Web3 provider objects, and user session data. If any provider is compromised — or if the delivery channel (CDN, npm registry, GitHub repository) is subverted — every downstream site inherits the malicious code. In this case, DebugBear's legitimate purpose (performance measurement) required no wallet permissions, yet the injected payload abused the existing Web3 connection established by Polymarket's own code.

The attack surface is amplified by the fact that many organizations lack visibility into the runtime behavior of third-party scripts. Content Security Policy (CSP) headers, Subresource Integrity (SRI) hashes, and strict CSP nonces can mitigate risk, but they are frequently misconfigured or omitted for scripts that update frequently. DebugBear's script, like many performance tools, may have been loaded without SRI because the vendor pushes updates automatically.

Immediate Mitigation Steps for Defenders

Organizations that integrate third-party JavaScript should take the following actions now:

• Inventory every external script loaded on production pages, including marketing, analytics, and performance tools. Map each to a business owner and a vendor contact.
• Enforce Subresource Integrity for all static third-party scripts. Where vendors require dynamic updates, negotiate a pinned version or a secure CI/CD pipeline that publishes signed builds.
• Deploy a strict Content Security Policy with nonces or hashes for inline scripts, and restrict connect-src to known API endpoints. Block wallet and ethereum provider access from untrusted origins via CSP script-src and worker-src directives.
• Implement runtime monitoring that detects unexpected DOM mutations, Web3 RPC calls, or network requests from third-party origins. Tools such as Lavascript, c/side, or custom MutationObserver-based telemetry can alert on anomalous behavior.
• Conduct vendor risk assessments that include questions about their build pipeline security, MFA enforcement for publish accounts, and incident notification SLAs.
• Prepare a rapid rollback procedure to disable or replace any third-party script within minutes, including feature flags or a kill switch in your tag manager.

Conclusion

The Polymarket attack demonstrates how a single compromised performance script can bypass smart contract audits, multi-signature treasuries, and network-level firewalls to drain user funds directly from the browser. As long as Web3 applications compose functionality from unaudited third-party JavaScript, similar incidents will recur. Security teams should prioritize script integrity controls, runtime anomaly detection, and vendor accountability programs. Grivyonx helps organizations automate these defenses through AI-driven DevSecOps pipelines and continuous cloud security posture management.