NewsPublished 26 Jun 2026

Polymarket customers lose $3 million in supply-chain attack

Source Bleeping Computer

Description

Polymarket says it will fully reimburse customers who lost an estimated $3 million after hackers injected a malicious script into the platform's frontend following a breach at a third-party vendor. [...]

Impact

Approximately $3 million was stolen from a small number of Polymarket user accounts due to fraudulent transaction approvals caused by malicious script injection. The platform's backend and servers remained secure, limiting the breach scope to frontend compromise via a third-party vendor. The financial loss impacts affected users directly, but Polymarket's commitment to full reimbursement mitigates long-term user financial damage. The incident highlights risks associated with supply-chain dependencies in web platforms.

Defensive guidance

Polymarket has committed to fully reimbursing customers who lost funds in this incident. Since the attack exploited a third-party vendor dependency, remediation should focus on securing and auditing all supply-chain components and dependencies. Users should remain vigilant for phishing attempts and unauthorized transaction requests.

Summary

The threat involves a supply-chain attack targeting Polymarket's frontend by exploiting a compromised third-party vendor dependency. Malicious JavaScript was injected into the platform's website, tricking users into approving fraudulent transactions. The attack did not affect Polymarket's backend infrastructure. Blockchain intelligence firms estimate losses of approximately $3 million from under 15 accounts. The attacker converted stolen ParyonUSD into roughly 1,893 Ether and moved the funds from the Polygon to the Ethereum blockchain. Polymarket announced full reimbursement for affected users but has not provided detailed technical disclosures.

References

bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Jun 2026, 18:12 UTC

References

Community reviews