Polymarket Confirms $3 Million Stolen in Frontend Attack, Promises Full Refunds
Polymarket confirmed Friday that a compromised third-party vendor allowed attackers to inject malicious code into its frontend, resulting in the theft of approximately $3 million from fewer than 15 user accounts. The platform has pledged to fully reimburse all affected users.
Security Researcher Flags Breach
The attack was initially identified by on-chain security researcher Specter, who reported that an apparent phishing campaign had drained funds from over 11 victim wallets holding Polymarket’s PUSD stablecoin. At the time of Specter’s report, estimated losses stood at $2.94 million. PeckShield later corroborated this figure, noting that the attacker had bridged the stolen funds from Polygon to Ethereum and converted them into 1,893 ETH.
Polymarket Acknowledges Incident
The prediction market platform acknowledged the breach through one of its official communication channels, Polymarket Traders. “This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We’ve contained it and removed the affected dependency,” the statement read on X. “We’re contacting impacted users and refunding them in full.”
William LeGate, who works closely with Polymarket, reiterated the commitment to compensation, confirming that the issue had been resolved and that affected users would receive their full funds back.
Supply Chain Attack Identified
Other blockchain security firms, such as GoPlus Security, characterized the incident as a supply chain attack. They reported that the malicious code impacted approximately 15 accounts, with total losses amounting to $3 million. Bubblemaps reached a similar conclusion and commended Polymarket’s swift response in containing the losses.
Previous Security Incidents
This is not the first security breach to affect Polymarket. Last month, the platform disclosed an incident where an admin wallet used for employee rewards was drained of about $700,000, likely due to a private key compromise. Initially, crypto investigator ZachXBT estimated the losses at around $520,000, with Bubblemaps later revising the figure upwards after tracing the funds.
Developer Josh Stevens confirmed at the time that a six-year-old private key had been exposed through an internal configuration error. The company subsequently rotated credentials and transitioned to key management services. Importantly, that prior incident did not affect user funds or core contracts.
Broader Reputational Challenges
While the two incidents involved distinct attack vectors, both targeted systems external to Polymarket’s core prediction markets. The latest breach occurs as the platform faces other reputational challenges. A recent report by The Wall Street Journal alleged that Polymarket paid college-age creators between $2,000 and $3,000 per month to post videos of staged bets on dummy versions of its website, with none of the over 1,100 clips demonstrably linked to real blockchain activity.
Adding to recent controversies, an early-this-month claim by a trader alleged a $500,000 loss after the prediction service purportedly altered resolution rules for a market tied to Strategy’s Bitcoin sale.
Leave a Reply