Polymarket Refunds Users After Multi-Million Dollar Exploit

Third-Party Vendor Hack Leads to Millions in Losses for Polymarket Users

A hack targeting one of Polymarket’s third-party vendors on Thursday has left the prediction market platform vulnerable, resulting in millions of dollars in losses for its users, the company announced.

Polymarket declined to comment when reached by Decrypt and has not publicly identified the compromised vendor. However, the company stated in an X post that the attack allowed hackers to inject malicious code into the prediction market’s front-end. Ultimately, the hackers made off with approximately $3 million in customer funds.

On-chain investigators at Bubblemaps concluded that the potential damage from the hack was largely contained, affecting fewer than 15 user accounts. The blockchain investigation firm did not immediately respond to Decrypt’s request for comment.

Polymarket has stated that it is in the process of fully refunding all impacted customers and that the front-end issue has been resolved and removed.

It remains unclear what measures the prediction market platform can implement to prevent similar exploits in the future, given its reliance on external, third-party businesses that are apparently integral to the site’s operations.

The attackers appear to have drained funds from Polymarket customer wallets holding pUSD, a Polymarket-specific dollar-pegged stablecoin backed by USDC, which is used for all trading on the platform. The stolen funds were then converted into ETH and consolidated into an Ethereum wallet, where they remain as of this report.

This incident follows another hack last month, which targeted a wallet used by Polymarket employees for topping up and distributing user rewards. That exploit resulted in approximately $700,000 in losses for the company and was likely caused by a private key compromise. At the time, experts indicated that it did not appear to affect the company’s core infrastructure or pose broader risks.

Both this recent exploit and the one in May highlight the capacity of hackers to infiltrate major companies through peripheral vulnerabilities, even when their core protocols remain secure.