Polymarket hack causes $3 million loss for users in supply‑chain attack

Polymarket, a prediction‑market platform, disclosed that a third‑party vendor was compromised, allowing malicious JavaScript to be inserted into its frontend. The injection affected fewer than 15 accounts, leading to the theft of roughly $3 million worth of Polymarket USD tokens, which were subsequently exchanged for Ethereum. Analysts identified the incident as a supply‑chain phishing attack. Polymarket said its backend servers and infrastructure were not impacted and announced that it will fully reimburse every affected user.

The breach highlights ongoing security challenges in decentralized finance services that rely on external components for their web interfaces.