Polymarket hit by $2.9M theft, users to be refunded

Polymarket said it contained the compromise and removed the affected dependency after attackers injected a malicious script into its frontend.

A third-party vendor compromise discovered Thursday allowed attackers to inject a malicious script into Polymarket's frontend, affecting multiple users.

Blockchain analyst Specter said the malicious script appeared to facilitate a phishing attack that drained an estimated $2.94 million from at least 11 Polymarket user wallets.

Polymarket said on X that the compromise has been contained and that the affected dependency has been removed. It added that users would be fully refunded.

Read more