The threat involves a supply-chain attack targeting Polymarket's frontend by exploiting a compromised third-party vendor dependency. Malicious JavaScript was injected into the platform's website, tricking users into approving fraudulent transactions. The attack did not affect Polymarket's backend infrastructure. Blockchain intelligence firms estimate losses of approximately $3 million from under 15 accounts. The attacker converted stolen ParyonUSD into roughly 1,893 Ether and moved the funds from the Polygon to the Ethereum blockchain. Polymarket announced full reimbursement for affected users but has not provided detailed technical disclosures.

Approximately $3 million was stolen from a small number of Polymarket user accounts due to fraudulent transaction approvals caused by malicious script injection. The platform's backend and servers remained secure, limiting the breach scope to frontend compromise via a third-party vendor. The financial loss impacts affected users directly, but Polymarket's commitment to full reimbursement mitigates long-term user financial damage. The incident highlights risks associated with supply-chain dependencies in web platforms.

Polymarket has committed to fully reimbursing customers who lost funds in this incident. Since the attack exploited a third-party vendor dependency, remediation should focus on securing and auditing all supply-chain components and dependencies. Users should remain vigilant for phishing attempts and unauthorized transaction requests. Patch status is not yet confirmed—check Polymarket's official advisories for updates on fixes or vendor mitigations. No direct patch or fix details are currently available.