Listen to the episode
TLDR
Hackers compromised a third party frontend vendor used by Polymarket and injected malicious JavaScript into the legitimate trading site. Visitors were prompted to sign fraudulent wallet transactions that silently drained their funds —...
How it works
Hackers compromised a third party frontend vendor used by Polymarket and injected malicious JavaScript into the legitimate trading site. Visitors were prompted to sign fraudulent wallet transactions that silently drained their funds —...
Red flags
- : Unexpected wallet approval or signature request appearing while browsing a trusted crypto site. Transactions asking for unlimited or unfamiliar token allowances. Frontend behaving oddly (pop ups, repeated confirmations, new contract addresses) right after a platform update or vendor change
What to do
- 1: Revoke old or unused token allowances at a reputable revoke tool and re approve only what you actively use. Read every wallet prompt carefully: check the contract, the method, and the asset being transferred before signing. Use a hardware wallet or a separate "burner" wallet for high value prediction market or DeFi accounts so a single approval cannot empty your main holdings
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/FAQ
Is Polymarket supply chain attack steals $3M via fake wallet approvals a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: Unexpected wallet approval or signature request appearing while browsing a trusted crypto site. Transactions asking for unlimited or unfamiliar token allowances. Frontend behaving oddly (pop ups, repeated confirmations, new contract addresses) right after a platform update or vendor change
What should I do first?
: Revoke old or unused token allowances at a reputable revoke tool and re approve only what you actively use. Read every wallet prompt carefully: check the contract, the method, and the asset being transferred before signing. Use a hardware wallet or a separate "burner" wallet for high value prediction market or DeFi accounts so a single approval cannot empty your main holdings
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.