Polymarket Hack: User Losses Estimated at Nearly $3 Million

Key points:

• Polymarket lost nearly $3 million after attackers compromised a third-party dependency and injected malicious code into the platform’s web interface.
• Preliminary estimates suggest the attack affected between 11 and 15 users, while the protocol’s smart contracts and core infrastructure remained secure.

Polymarket, the decentralized prediction market platform, has disclosed a security incident that resulted in approximately $3 million in user losses. According to the team, the attack originated from a compromised third-party provider that allowed malicious code to be injected into the platform’s frontend.

Source: X.com

The company said the exploit has been fully contained, the compromised dependency has been removed, and all affected users will be fully reimbursed.

Initial estimates indicate that 11 to 15 wallets were impacted. The attackers primarily targeted pUSD, the platform’s dollar-denominated asset.

Attack Targeted the Frontend, Not Smart Contracts

Blockchain security researchers found that the stolen funds were first moved through the Polygon network before being bridged to Ethereum and swapped for ETH. According to PeckShield, roughly 1,893 ETH was consolidated into one of the attacker’s wallets.

Importantly, Polymarket’s smart contracts were not compromised. Instead, the attackers targeted the platform’s web interface. The injected malicious code could manipulate wallet interactions and trick users into approving fraudulent transactions.

While Polymarket has pledged to fully reimburse affected users, it has not yet disclosed which third-party provider was compromised, how long the malicious code remained on the website, or what additional security measures will be implemented following the incident.

Security experts say the attack serves as another reminder that protecting crypto platforms requires more than secure smart contracts. Frontend security, third-party dependencies, and the broader infrastructure users rely on are equally critical to safeguarding digital assets.