Polymarket to Refund Users After Hackers Steal $3M in Frontend Attack

Polymarket has confirmed that a compromised third-party vendor allowed attackers to inject malicious code into its frontend, draining approximately $3 million from fewer than 15 user accounts. The prediction market platform stated it will fully refund all affected users.

The attack was first flagged by on-chain security researcher Specter, who reported an apparent phishing campaign that drained funds from more than 11 victim wallets holding Polymarket’s PUSD stablecoin. PeckShield later confirmed losses of $2.94 million and noted that the attacker had bridged the stolen funds from Polygon to Ethereum, converting them into 1,893 ETH.

Polymarket acknowledged the breach through its official account, Polymarket Traders, stating: “This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We’ve contained it and removed the affected dependency.” The platform added that it is contacting impacted users and refunding them in full.

Blockchain security firm GoPlus Security described the incident as a supply chain attack, affecting about 15 accounts. Bubblemaps also concurred with the assessment, praising Polymarket’s response after the losses were contained.

This is not the first security incident for Polymarket. Last month, the platform disclosed a breach where an admin wallet used for employee reward top-ups was drained of about $700,000, likely through a private key compromise. Developer Josh Stevens confirmed at that time that a six-year-old private key had been exposed through an internal configuration, though user funds and core contracts were not affected.

The latest attack comes amid other reputational challenges for Polymarket. A recent report by the Wall Street Journal claimed the platform had paid college-age creators between $2,000 and $3,000 per month to post videos of staged bets on dummy versions of its website, with none of the over 1,100 clips traceable to real blockchain activity. Additionally, earlier this month, a trader claimed they lost $500,000 after the service allegedly changed resolution rules for a market tied to Strategy’s Bitcoin sale.

Source: https://cryptopotato.com/polymarket-to-refund-users-after-hackers-steal-3m-in-frontend-attack/