Real money left signed-in user accounts, and what moved it was a third-party page-speed script.
The Hacker News reported malicious code on Polymarket's website that sold positions for some signed-in traders and moved about $2.7 million to the hackers on October 29, after it replaced a page-speed script the site loaded from DebugBear. SecurityWeek described a malicious Claude Code extension served in a Cursor supply chain attack: it ran host reconnaissance and tried to open a reverse SSH tunnel. The Hacker News also reports attackers going after an unpatched maximum-severity flaw in the CryptoPayment Gateway WordPress plugin that can expose wallet credentials, according to Defused Cyber.
All three run through code you do not own: a script on your authenticated pages, an extension on a developer's machine, a plugin in your payment path. We review payment and account flows for exactly that, meaning what a signed-in page loads, what it is allowed to do, and whether frontend code can authorize anything that moves value. If nobody owns that inventory for your product, ask us for a written estimate. Cost and timeline come back within a day.