Key Points
- Hackers stole roughly $3 million from more than 11 users.
- A compromised third-party vendor injected malicious code into Polymarket's site.
- The malicious frontend tricked users into signing unauthorized transactions, draining pUSD.
- Polymarket says it contained the breach and is refunding affected users in full.
Polymarket, the largest prediction market, confirmed on Thursday that hackers stole funds from an unspecified number of its users. In an X post, the company said a compromise at a third-party vendor let attackers inject malicious code into its website "for some users." It said it has "contained" the incident and is contacting affected victims and "refunding them in full."
Blockchain security researchers put the damage at roughly $3 million drained from more than 11 wallets. The mechanism matters: the malicious frontend script tricked users into signing unauthorized transactions, siphoning pUSD — the dollar-pegged collateral token Polymarket uses for every bet. Polymarket has not disclosed which vendor or dependency was compromised.
The important distinction is where the failure happened. This was not a smart-contract exploit; the underlying protocol held. The weak point was the website — a supply-chain attack through a third party, the same class of breach that has hit crypto front ends repeatedly because the contracts can be audited to perfection while the page serving them quietly gets swapped. For a platform whose entire product is trust in a number, the timing is rough. It lands not long after a Wall Street Journal investigation found Polymarket had paid creators to stage fake winning bets — a second hit to the company's credibility inside a short window, as it pushes toward U.S. expansion and mainstream legitimacy. The full refund is the right call and an expensive one; whether users trust the front end the next time they sign is the harder thing to buy back.
Source: TechCrunch, The Next Web
Comments