The code that moved the money was already installed, already trusted, and loading on every page.
The Hacker News says malicious code on the prediction market Polymarket's site sold positions for some signed-in traders and sent their funds to the hackers on October 29, about $2.7 million. That code had replaced a page-speed script the site loaded from DebugBear. SecurityWeek reported a malicious Claude Code extension served in a Cursor supply chain attack: it ran host reconnaissance and tried to open a reverse SSH tunnel. The Hacker News also reported threat actors going after an unpatched maximum-severity flaw in the CryptoPayment Gateway WordPress plugin, per findings from Defused Cyber.
Three different targets, one shape: in each of them the attacker arrived through a dependency someone had already approved. Nobody kept an inventory of what their authenticated pages and build hosts were actually loading.
This is exactly why I do security reviews of payment and account flows. I look at what third-party code runs on signed-in pages, whether it is pinned or self-hosted, and whether a frontend can authorize a value-moving action at all. Scoped as one hard task, with cost and timeline back to you within a day.
If you take payments or hold balances, send me the list of external scripts your checkout and account pages load and I will tell you which ones can move money.