TL;DR
Hackers drained roughly three million dollars from Polymarket users via a compromised vendor that injected malicious code into its frontend.
Polymarket confirmed on Thursday that hackers stole funds from users after a third-party vendor was compromised, allowing malicious code to be injected into the prediction market’s website. Blockchain monitoring firm PeckShield estimated the losses at roughly three million dollars worth of cryptocurrency, drained from more than 11 victims.
The company said in a post on X that it had “contained” the incident and removed the affected dependency. Polymarket said it is contacting victims and “refunding them in full,” though it did not specify how many users were affected or name the compromised vendor.
Polymarket spokesperson Connor Brandi confirmed to TechCrunch that the breach led to funds being stolen but declined to provide additional details. The company did not respond to specific questions about the incident.
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!
On-chain data reviewed by blockchain analyst Specter showed funds being drained from victim wallets holding PUSD, Polymarket’s stablecoin. The stolen assets were rapidly bridged from Polygon to Ethereum and converted into roughly 1,893 ETH, a common tactic used by attackers to obscure the trail and liquidate funds quickly.
The attack was a supply chain compromise rather than a direct breach of Polymarket’s own infrastructure. A third-party vendor’s code was tampered with, and the malicious script was served to some users through Polymarket’s frontend. Users who interacted with the affected interface had their funds siphoned without the platform’s core smart contracts being exploited.
It is not the first time Polymarket’s security has been tested this year. In May, blockchain investigator ZachXBT flagged a separate incident in which roughly $520,000 was drained from two smart contracts on the Polygon network. Polymarket said at the time that the losses stemmed from a compromised six-year-old private key tied to an internal operations wallet, not from a platform exploit.
The hack caps what has been Polymarket’s worst week. On Sunday, a Wall Street Journal investigation revealed that the company had paid online creators to post deceptive videos showing fabricated bets and fake winnings. The Journal reviewed more than 1,100 videos and found that none of the wagers, representing nearly two million dollars in displayed value, were placed on the live platform, prompting Polymarket to say it would audit its promotional content.
The scandals arrive during a period of intensifying regulatory and legal pressure. A Google engineer was charged last month with insider trading after using internal search data to profit more than one million dollars on Polymarket. Spain blocked the platform in May over missing gambling licences, joining France, Belgium, Poland, Italy, and India in restricting access.
Polymarket has also faced structural questions about its governance. A $345 million dispute over an Iran peace deal contract earlier this month exposed how just nine anonymous cryptocurrency wallets control more than half the voting power used to resolve contested outcomes on the platform.
The company, founded by Shayne Coplan, became the dominant prediction market during the 2024 US presidential election and has continued to grow rapidly. Combined monthly trading volume across Polymarket and rival Kalshi quadrupled from under five billion dollars to 24 billion dollars between September 2025 and April 2026. Whether that growth trajectory survives a convergence of security failures, marketing fraud, and regulatory crackdowns is the question the company now faces.
