Polymarket suffers $3 million supply‑chain hack, pledges full refunds

Polymarket disclosed that a compromised third‑party vendor injected malicious code into the platform’s frontend, enabling attackers to siphon roughly $3 million from user wallets. The theft, traced to the platform’s stablecoin pUSD, was moved from Polygon to Ethereum and consolidated into a single address holding about 1,893 ETH. Fewer than 15 accounts were impacted, with losses estimated between $2.94 million and $3.1 million.

The company said the malicious script has been contained, the affected dependency removed, and that all impacted users will be refunded in full. This incident follows a separate breach in May that cost about $700,000 from an internal wallet, marking the second security failure for Polymarket within two months. The breach underscores the vulnerability of supply‑chain components in crypto applications, even when core smart contracts remain secure.

Polymarket’s response—full reimbursement and public acknowledgment—aims to preserve user trust amid growing regulatory and security scrutiny of prediction‑market platforms.