Polymarket $3 million loss from third-party vendor breach

Prediction market platform Polymarket confirmed on Thursday that a security breach at a third-party vendor allowed hackers to steal funds from users. The company stated it has contained the incident and will fully reimburse all affected customers.

In a post on social media platform X, Polymarket said it discovered that morning that a third-party vendor had been compromised, enabling the injection of a malicious script into the platform's frontend for some users. The company said it removed the affected dependency and is contacting impacted individuals to process refunds. A company spokesperson confirmed the breach led to stolen funds but declined to provide further details.

Blockchain security researchers estimated the losses at approximately $3 million. Analysis from firms including PeckShield and on-chain analyst Specter indicated that at least 11 victim wallets holding PUSD, Polymarket's stablecoin, were drained. The stolen assets, totaling roughly 1,893 ETH, were bridged from the Polygon network to Ethereum and consolidated, a common method to obscure the trail of stolen cryptocurrency.

The attack is characterized as a supply-chain compromise, where a vendor's code was...