Polymarket experienced a supply chain attack stemming from a compromise of a third-party frontend vendor. Malicious JavaScript code was injected into the Polymarket website, enabling attackers to deceive users into approving fraudulent transactions or actions. This incident underscores the threat posed by third-party component breaches in web environments, particularly in cryptocurrency platforms. No specific technical details about the injected code or exploitation methods are provided in the source data.

Users of the Polymarket platform were exposed to fraudulent transactions initiated through malicious JavaScript injected via a compromised third-party frontend vendor. This could lead to unauthorized approvals and potential financial losses for users. The integrity of the platform's frontend was undermined, affecting user trust and platform security.

No patch or official fix information is provided. Since this is a supply chain attack involving a third-party vendor, remediation would typically involve the vendor securing their systems and Polymarket reviewing and tightening third-party code integration and validation processes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.