Third-Party Breach at Polymarket: Supply Chain Code Injection and Detection Strategies

A recent breach at Polymarket, a decentralized information marketplace, resulted in the theft of approximately $2.94 million in user funds. The root cause was not a direct vulnerability in Polymarket's core infrastructure, but a compromise within their third-party vendor ecosystem. Attackers leveraged this trusted relationship to inject malicious code into the Polymarket website, facilitating the theft of crypto assets from active users.

For defenders, this incident serves as a stark reminder that your organization's security perimeter is only as strong as your weakest vendor link. Supply chain attacks allow threat actors to bypass traditional perimeter defenses by abusing trusted access points. This post analyzes the mechanics of the attack and provides actionable detection logic and remediation steps to identify and mitigate malicious code injection via compromised third parties.

Technical Analysis

Attack Vector: Supply Chain Compromise / Third-Party Abuse

Mechanism: The attackers compromised a third-party service provider utilized by Polymarket. By gaining access to the vendor's infrastructure or update mechanism, the attackers were able to inject malicious JavaScript into the Polymarket web application.

Impact: The injected script likely operated as a web skimmer or a drainer, targeting the browser's local storage or intercepting transaction signing requests. Since the script was served directly from the legitimate Polymarket domain, it bypassed standard Content Security Policies (CSP) that were not strictly configured to restrict inline scripts or enforce Subresource Integrity (SRI) for third-party dependencies.

Exploitation Status: Confirmed active exploitation resulting in financial loss.

Detection & Response

Detecting supply chain code injections requires monitoring for anomalies in web content integrity and suspicious process activity originating from web services. The following rules focus on identifying post-exploitation behavior (web shells) and unauthorized file modifications in web directories.

Sigma Rules

---
title: Suspicious Process Spawn by Web Server Service
id: a8b9c0d1-2e3f-4a5b-6c7d-8e9f0a1b2c3d
status: experimental
description: Detects web server processes spawning shells or script interpreters, often indicative of web shell access or code injection exploitation.
references:
 - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/22
tags:
 - attack.persistence
 - attack.t1505.003
logsource:
 category: process_creation
 product: linux
detection:
 selection:
 ParentImage|endswith:
   - '/nginx'
   - '/apache2'
   - '/httpd'
   - '/node'
 Image|endswith:
   - '/bash'
   - '/sh'
   - '/perl'
   - '/python'
   - '/php'
 condition: selection
falsepositives:
 - Legitimate administrative scripts run by web admins
level: high
---
title: Web Content Integrity Violation - JS Modification
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects modifications to JavaScript or HTML files in web root directories within a short timeframe, indicative of web skimming or defacement.
references:
 - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/04/22
tags:
 - attack.initial_access
 - attack.t1195.002
logsource:
 category: file_change
 product: linux
detection:
 selection:
 TargetFilename|contains:
   - '/var/www/html'
   - '/usr/share/nginx'
   - '/srv/www'
 TargetFilename|endswith:
   - '.js'
   - '.html'
 condition: selection
falsepositives:
 - Legitimate website deployments and updates
level: medium

KQL (Microsoft Sentinel)

This query hunts for suspicious process creation events where a web server process spawns a shell, which often occurs when an attacker executes injected code.

DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in ("nginx", "apache2", "httpd", "node", "apache")
| where FileName in ("sh", "bash", "perl", "python", "php")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for recently modified JavaScript files in common web directories, which is the primary indicator of compromise for web skimming attacks.

-- Hunt for recently modified JavaScript files in web roots
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="/var/www/**/*.js")
-- /usr/share/nginx/**/*.js", "/srv/www/**/*.js"])
WHERE Mtime > now() - 24h
ORDER BY Mtime DESC

Remediation Script (Bash)

Use this script on Linux-based web servers to audit the web root for recently modified files and identify potential injected code.

#!/bin/bash
# Security Arsenal: Web Integrity Audit
# Checks for modified files in common web roots in the last 24 hours

WEB_ROOTS=("/var/www/html" "/usr/share/nginx/html" "/srv/www")
TIME_FRAME="-1"

echo "[+] Starting Web Integrity Audit for files modified in the last 24 hours..."

for path in "${WEB_ROOTS[@]}"; do
    if [ -d "$path" ]; then
        echo "[+] Scanning $path ..."
        find "$path" -type f \( -name "*.js" -o -name "*.html" -o -name "*.php" \) -mtime "$TIME_FRAME" -ls
    fi
done

echo "[+] Audit complete. Review the list above for unauthorized changes."

Remediation

1. Vendor Risk Assessment: Immediately audit the security posture of all third-party vendors with code or script access to your production environment. Require proof of SOC 2 Type II or ISO 27001 certification.
2. Content Security Policy (CSP): Implement strict CSP headers to disallow inline scripts and restrict script sources to trusted, whitelisted domains.
3. Subresource Integrity (SRI): Enable SRI for all third-party scripts and libraries to ensure that the resources loaded match the expected cryptographic hash, preventing tampered content from executing.
4. File Integrity Monitoring (FIM): Deploy FIM agents on all web servers to alert on real-time changes to web content directories.
5. User Communication: If you suspect a similar compromise, immediately notify users to revoke browser sessions and rotate API keys or wallet permissions used during the compromise window.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub