The Polymarket platform was targeted through a supply chain attack involving a compromised third-party vendor. This compromise allowed attackers to inject malicious scripts into the frontend interface experienced by some users, facilitating a phishing campaign that resulted in the theft of roughly $3 million in pUSD tokens. The attackers bridged the stolen funds from Polygon to Ethereum and swapped them into approximately 1,893 ETH. Polymarket has since contained the incident by removing the affected dependency and committed to refunding impacted users. The attack affected at least 11 victims, but the total scope and attribution remain unclear.

Approximately $3 million worth of Polymarket's USDC-backed pUSD tokens were stolen from at least 11 users via a phishing campaign enabled by a malicious script injected through a compromised third-party vendor. This resulted in direct financial loss to users, though Polymarket has committed to refunding them. The incident also undermines user trust in the platform's security and highlights risks associated with third-party dependencies in decentralized applications.

Polymarket has contained the incident by removing the compromised third-party dependency and has committed to fully refund affected users. Users impacted by the attack will be contacted directly. No further mitigation actions are specified by the vendor at this time. Patch status is not applicable as this was a third-party vendor compromise rather than a direct software vulnerability in Polymarket itself. Users should remain vigilant against phishing attempts related to this incident.