$2.5M Gone in 55 Minutes: Inside the Polymarket Supply Chain Attack
Polymarket was not breached. Its own code held up fine. A performance monitoring script loaded from somebody else’s CDN did the stealing, and about $2.5 million walked out the door before anyone hit the brakes.
What Happened?
On 29 October, a web performance monitoring file served from a vendor CDN was quietly swapped for a wallet drainer.
It only woke up inside logged-in sessions. It checked the visitor’s geoblock status, read saved login and trading credentials out of browser storage, then reached into the page and borrowed the trading client that already held the user’s signing key. No wallet popup. No approval prompt. The script swapped cash into POL and sent it to a hard-coded address, then moved open positions out in batches. Trading went cancel-only at 18:05 UTC.
Nobody broke in. A trusted script was swapped.
The platform’s own code was never touched. A performance monitoring file loaded from a vendor CDN was replaced with a wallet drainer, and it ran with every permission the page already had.
Why Nothing Blocked It
Here is the uncomfortable part. Every host that script touched was already approved on the site’s content security policy.
The browser did exactly what it was told. It loaded code from a trusted vendor, let that code talk back to the same trusted vendor, and flagged nothing. The drainer even reported each theft to the vendor’s own data endpoint, dressed up as performance metrics. No integrity check was pinned to the file, so swapping its contents cost the attacker nothing.
What’s the Impact?
Roughly 28.6 million POL, about $2.5 million, landed in one wallet and was split across three more within ten minutes. Some publicly reported individual losses run into the hundreds of thousands. The platform promised full reimbursement. The vendor still has not explained how it was breached.
The Part That Should Worry Everyone Else
This was never really a crypto story. It was a tag manager story.
Most commercial sites load somebody else’s JavaScript on pages where users log in: analytics, session replay, chat widgets, performance monitors, ad pixels. Each one runs with the same access as your own code, which makes dependency risk management a frontline control rather than a procurement checkbox. This is the same shape as a hijacked update mechanism, only delivered through a CDN instead of an installer.
The vendor told customers to rip out the embed. Fair as an emergency move, useless as a plan. You cannot remove what you never wrote down, which is why continuous attack surface management has to cover the browser, not just your edge.
Pulling the script and halting trading was the right call, and it looks a lot like what the first hour after a breach should look like.
Polymarket supply chain attack: published IOCs
Indicators reported by external researchers for the 29 October 2026 vendor script compromise. Hosts are defanged. Both vendor domains stopped resolving the same evening, so hunt retrospectively in archived logs rather than expecting live hits.
How to Avoid This
- Inventory every external script running on authenticated pages
- Pin versions with Subresource Integrity wherever the vendor allows it
- Treat your CSP allowlist as attack surface, not as protection
- Keep vendor code off pages that touch funds, keys, or credentials
- Alert on payload size and shape changes to vendor endpoints
Your Attack Surface Includes Code You Did Not Write
The vendor was approved years ago, and nobody looked again. That gap is not a tooling failure; it is a capacity failure, and it is exactly the kind of grunt work that never reaches the top of anyone’s queue.
- Red Teammate maps the external scripts loading on your authenticated pages and validates what an attacker could actually reach through them
- AppSec Teammate watches third-party code in the delivery path, not only the dependencies sitting in your repo
- SOC Teammate pulls odd vendor callbacks and scattered user reports into one case instead of five dashboards
- Consequential moves, like cutting off a vendor domain, stop at your approval gate with a record of who decided what
- Every fix gets retested, so you hold before-and-after evidence instead of a closed ticket
