Full Report
For the latest discoveries in cyber research for the week of 29th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Polymarket, a large cryptocurrency-based prediction market, has confirmed a supply chain attack after a third-party frontend vendor breach led to malicious JavaScript being injected into its website. Attackers tricked users into approving fraudulent […] The post 29th June – Threat Intelligence Report appeared first on Check Point Research.
Analysis Summary
# Incident Report: Polymarket Supply Chain Compromise
## Executive Summary
Polymarket, a prominent decentralized prediction market, suffered a supply chain attack after a third-party frontend vendor was compromised. Attackers injected malicious JavaScript into the Polymarket website to intercept user interactions and facilitate fraudulent transactions. The incident resulted in the theft of approximately $3 million from a small group of high-value accounts, though the platform's backend remained secure.
## Incident Details
- **Discovery Date:** Late June 2026 (Confirmed by June 29)
- **Incident Date:** June 2026
- **Affected Organization:** Polymarket
- **Sector:** Cryptocurrency / Decentralized Finance (DeFi)
- **Geography:** Global / Online
## Timeline of Events
### Initial Access
- **Date/Time:** June 2026
- **Vector:** Third-party Supply Chain Attack
- **Details:** Attackers breached a third-party vendor responsible for frontend components of the Polymarket website, allowing them to modify the site's source code.
### Lateral Movement
- **Details:** Not applicable in the traditional sense; the attackers moved "horizontally" from the vendor's environment into the client-side browser sessions of Polymarket users via injected scripts.
### Data Exfiltration/Impact
- **Details:** The malicious JavaScript prompted users to approve transactions that appeared legitimate but were actually transfers to attacker-controlled wallets. Approximately $3 million in cryptocurrency was stolen.
### Detection & Response
- **Discovery:** Likely identified through user reports of unauthorized transactions and internal monitoring of frontend code integrity.
- **Response:** Polymarket confirmed the breach, identified the compromised vendor, and notified users. The backend infrastructure was verified as unaffected.
## Attack Methodology
- **Initial Access:** Compromise of a third-party frontend vendor.
- **Persistence:** Injected malicious JavaScript into the web application's production environment.
- **Privilege Escalation:** Not applicable; relied on tricking users with high-level wallet permissions.
- **Defense Evasion:** Use of legitimate third-party delivery channels to bypass standard server-side security.
- **Credential Access:** Not traditional credentials; focused on hijacking active web3 browser sessions/wallet signatures.
- **Discovery:** Identification of high-value accounts (fewer than 15) to target for maximum impact.
- **Exfiltration:** Fraudulent blockchain transactions to attacker-controlled addresses.
- **Impact:** Financial theft and erosion of user trust.
## Impact Assessment
- **Financial:** Approximately $3 million USD in cryptocurrency assets stolen.
- **Data Breach:** Compromise of transaction approval workflows; no evidence of backend database exposure.
- **Operational:** Minimal disruption to core backend services, but required frontend remediation.
- **Reputational:** High; highlights risks inherent in DeFi frontend security and third-party dependencies.
## Indicators of Compromise
- **Network indicators:** Transactions directed to unauthorized/unverified wallet addresses (defanged: 0x[REDACTED]).
- **File indicators:** Malicious JavaScript snippets injected into frontend bundles.
- **Behavioral indicators:** Unusual "Approve" or "Transfer" prompts appearing on the Polymarket UI without corresponding user actions.
## Response Actions
- **Containment:** Removal of the malicious third-party script from the frontend codebase.
- **Eradication:** Auditing vendor access and rotating API keys/access tokens associated with frontend deployment.
- **Recovery:** Public disclosure of the incident and ongoing monitoring for further unauthorized activity.
## Lessons Learned
- **Vendor Risk:** Third-party frontend libraries and vendors represent a significant "blind spot" in web3 security.
- **Client-Side Security:** Backend security (which remained intact) is insufficient if the user interface (UI) can be manipulated to deceive the end-user.
- **Targeting:** Attackers are increasingly precise, targeting a small number of "whales" (high-value accounts) rather than high-volume, low-value theft.
## Recommendations
- **Subresource Integrity (SRI):** Implement SRI tags for all third-party scripts to ensure that only known, cryptographic-verified code is executed.
- **Content Security Policy (CSP):** Strengthen CSP headers to restrict the domains from which scripts can be loaded and where data can be sent.
- **Real-time Monitoring:** Deploy frontend integrity monitoring tools that alert security teams if the DOM or external scripts change unexpectedly.
- **User Education:** Advise users to utilize hardware wallets and carefully inspect transaction details (contract addresses) before signing.