If your product holds wallets or a checkout, every third-party script on your pages is a funds-movement path. Not page decoration.
SecurityWeek reported on October 30 that malicious code tied to a website monitoring tool was built to hijack logged-in Polymarket sessions and siphon user funds, and traders lost more than $2 million. Four independent sources covered it.
The uncomfortable part if you ship payments or crypto: nobody breached the application. A script that was sitting there to watch the site inherited the authority of a logged-in user. I have built custodial wallets, onramps and checkout flows, and this is the class of risk that stays outside the threat model, because the code is not yours...
What I do about it is boring and finite. A full inventory of third-party scripts and where each one loads. A content security policy that really restricts origins instead of reporting on them. Then a session scope review, so a browser session cannot authorize a withdrawal by itself. On a typical product that is a one-week engagement, and you get cost and timeline from me within a day.
If you run a product with wallets or checkout and have never audited this, start here: https://polycratia.com/c/7a476c15