Polymarket, a decentralized prediction market platform, has confirmed that hackers stole around $3 million from users after a third-party vendor was compromised, allowing malicious code to be injected into its frontend. The breach is the latest in a series of security incidents affecting Polymarket, which has faced growing regulatory and legal pressure.

What Happened

The attack on Polymarket's users occurred when a third-party vendor was compromised, allowing hackers to inject malicious code into the platform's frontend. This allowed the attackers to siphon funds from users who interacted with the affected interface. The stolen stablecoins were then rapidly bridged across chains and converted into ETH, a common tactic used by exploiters to obscure trails and liquidate funds quickly.

According to blockchain monitoring firm PeckShield, the losses were estimated at around $3 million worth of cryptocurrency, drained from more than 11 victims. On-chain data confirmed the scale of the breach, showing that a wallet address received multiple large incoming transfers in quick succession, aligning with the timeline of the reported phishing campaign.

Polymarket responded swiftly to the incident, acknowledging that a third-party vendor had been compromised and injecting malicious scripts into its frontend for some users. The company stated that it has contained the issue and removed the affected dependency, and is contacting impacted users to refund them in full.

Background and Context

Polymarket has faced growing regulatory and legal pressure in recent months. In May, Spain blocked the platform over missing gambling licenses, joining France, Belgium, Poland, Italy, and India in restricting access. The company has also been under scrutiny for its governance structure, with a $345 million dispute over an Iran peace deal contract exposing how just nine anonymous cryptocurrency wallets control more than half of the voting power used to resolve contested outcomes on the platform.

Polymarket's security has also been tested this year. In May, blockchain investigator ZachXBT flagged a separate incident in which roughly $520,000 was drained from two smart contracts on the Polygon network. Polymarket stated at the time that the losses stemmed from a compromised six-year-old private key tied to an internal operations wallet, not from a platform exploit.

The company has also faced criticism for its marketing practices. On Sunday, a Wall Street Journal investigation revealed that Polymarket had paid online creators to post deceptive videos showing fabricated bets and fake winnings. The Journal reviewed over 1,100 videos and found that none of the wagers, representing nearly two million dollars in displayed value, were placed on the live platform.

Why It Matters

The breach highlights the importance of third-party security for decentralized platforms like Polymarket. While the platform itself was not directly breached, the compromise of a third-party vendor allowed hackers to inject malicious code into its frontend. This underscores the need for robust security measures and regular audits to prevent such incidents.

For adult-industry platforms and operators, this incident serves as a reminder of the importance of secure infrastructure and robust moderation tools. The use of decentralized prediction markets like Polymarket can provide new revenue streams and engagement opportunities, but it also introduces new risks and challenges that must be addressed.

What Comes Next

Polymarket has committed to reimbursing all affected users, and is working to contain the incident. The company's response will be closely watched by the industry, as it seeks to rebuild trust with its users and regulators. For adult-industry platforms and operators, this incident serves as a reminder of the importance of prioritizing security and user protection in their own operations.

Key Facts

  • Polymarket confirmed that hackers stole around $3 million from users after a third-party vendor was compromised.
  • The breach occurred when malicious code was injected into Polymarket's frontend, allowing attackers to siphon funds from users.
  • More than 11 victims were affected, with losses estimated at around $3 million worth of cryptocurrency.
  • Polymarket responded swiftly to the incident, acknowledging that a third-party vendor had been compromised and injecting malicious scripts into its frontend for some users.
  • The company stated that it has contained the issue and removed the affected dependency, and is contacting impacted users to refund them in full.