Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnAISquareMore
Polymarket to reimburse users after third-party compromise triggers $3M phishing attack

Polymarket to reimburse users after third-party compromise triggers $3M phishing attack

AMBCryptoAMBCrypto2026/06/25 18:04
By:AMBCrypto

Prediction market platform Polymarket says it will fully reimburse affected users after a compromised third-party vendor injected malicious code into its frontend. This exposed some users to a phishing attack that blockchain security researchers estimate drained nearly

$3 million
.

In a statement published on

June 25
, Polymarket said it discovered the compromised vendor earlier in the day, removed the affected dependency, and contained the incident. The company added that it is contacting impacted users and will refund them in full.

The incident appears to have affected only users who interacted with the compromised frontend during the attack window rather than the platform’s underlying smart contracts.

@media only screen and (min-width: 0px) and (min-height: 0px) { div[id^="bsa-zone_1774359638628-7_123456"] { min-height: 50px; transition: min-height 0.3s ease; } } @media only screen and (min-width: 640px) and (min-height: 0px) { div[id^="bsa-zone_1774359638628-7_123456"] { min-height: 90px; } }
AD

Third-party compromise injected malicious script

According to Polymarket, the attack originated from a compromised third-party vendor that injected a malicious script into parts of the platform’s frontend.

The company said it has since removed the affected dependency and contained the incident. However, it has not disclosed the identity of the compromised vendor or released a detailed technical postmortem.

The platform emphasized that it is working directly with affected users while continuing its investigation.

Security firms estimate nearly $3M in losses

Blockchain security firm PeckShield reported that the incident appeared to be a phishing campaign targeting Polymarket users.

According to their findings, attackers drained approximately

$3 million worth of PUSD
from more than
11 victim wallets
before bridging the stolen funds from Polygon to Ethereum.

The researchers said the attacker subsequently exchanged the proceeds for roughly

1,893 ETH
, consolidating the assets into a monitored Ethereum address.

Polymarket has not publicly confirmed the estimated losses or the number of affected wallets.

Platform promises full reimbursement

Unlike many phishing incidents that leave users responsible for losses, Polymarket said it intends to reimburse everyone affected by the attack.

The company said it is contacting impacted users directly while continuing to investigate the compromise.

No timeline has been provided for either the reimbursement process or the publication of a full incident report.

Final Summary

  • Polymarket says a compromised third-party vendor injected malicious code into its frontend and has pledged to reimburse affected users.
  • Security researchers estimate the phishing campaign stole roughly $3 million before the funds were bridged to Ethereum and converted into ETH.

 

0
0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

Understand the market, then trade.
Bitget offers one-stop trading for cryptocurrencies, stocks, and gold.
Trade now!

You may also like

Nvidia acts as a "matchmaker": Anthropic and "AI Cloud" Lamda reach a $35 billion "computing power agreement"

Anthropic has signed two major computing power deals this year, totaling $80 billion. NVIDIA has evolved from being merely a chip supplier to a promoter of the "financialization of computing power infrastructure" in the ecosystem. By holding data center leases, NVIDIA provides credit endorsement and facilitates transactions for Anthropic, thereby extending its reach throughout the entire computing power supply chain. Emerging cloud providers are taking advantage of this to strongly challenge the market positions of giants like Amazon and Microsoft.

华尔街见闻2026/09/01 00:56

The US proposes a "debt relief plan" at the G20: Bessent and Walsh jointly call for "growth as the only way out of the predicament"

Against the backdrop of soaring global debt, the Iran war impacting energy markets, and rising trade tensions, U.S. Treasury Secretary Bessent and Federal Reserve Chair Walsh jointly introduced the "growth-driven debt resolution" narrative at the G20 finance ministers' meeting. Bessent stated clearly that "the only way out is growth" and called on G20 countries to implement deregulation policies. Walsh announced the end of the "era of secular stagnation," declaring that "growth is a choice."

华尔街见闻2026/09/01 00:56

Musk's tweet sends turbine blade leader tumbling! SpaceX (SPCX.US) announces in-house production of gas turbine blades, Howmet (HWM.US) suffers biggest drop in 16 months

Howmet Aerospace closed down 7.51% on Monday, with intraday losses reaching 9% and hitting a two-month low, marking its largest single-day drop since April 2025.

智通财经2026/09/01 00:51
Musk's tweet sends turbine blade leader tumbling! SpaceX (SPCX.US) announces in-house production of gas turbine blades, Howmet (HWM.US) suffers biggest drop in 16 months