Prediction market platform Polymarket has confirmed that hackers stole funds from some users after compromising a third-party vendor. Blockchain security firms estimate the attack drained about $3.1 million from 11 user wallets.
The company said the breach allowed attackers to place a malicious script on parts of its frontend. Polymarket has removed the affected dependency and is refunding users who lost funds.
Malicious script targeted users
Polymarket found that a third-party vendor had been compromised. The attackers used that access to inject code into the platform’s website for some users.
The script prompted affected users to sign unauthorised transactions. Those approvals allowed the attackers to move funds from connected wallets.
The incident did not involve a reported breach of Polymarket’s core trading contracts. The attack targeted users through the platform’s frontend rather than the prediction market system itself.
Analysts track $3.1m in losses
Blockchain analysts tracked about $3.1 million in stolen PUSD tokens. The funds were moved from Polygon to Ethereum and converted into ether. PeckShield identified 11 wallets affected by the attack. Polymarket has not confirmed the exact number of users involved or published a full breakdown of the losses.
The company also has not named the third-party vendor that was compromised. It did not state how long the malicious script was active before the problem was found.
Polymarket promises full refunds
Polymarket said it had contained the breach and removed the affected software component. The company is contacting affected users directly and will refund them in full.
The platform did not give a timetable for the refund process. It also has not announced whether it will change its wallet connection or transaction approval process after the attack.
The company allows users to trade contracts linked to sports, politics, economic data, entertainment and other real-world events. Users connect crypto wallets to trade and settle positions on the platform.
Platform uses blockchain settlement
Polymarket uses blockchain technology to process trades and settle market outcomes. Its markets allow users to buy and sell positions based on whether a specified event will happen.
The platform has used Polygon for parts of its trading infrastructure and supports stablecoin-based transactions. Wallet connections allow users to approve trades directly, which can expose funds when a malicious transaction is signed.