Polymarket refunds users after $3m crypto hack
A third-party breach at prediction market Polymarket allowed hackers to steal roughly $3 million in cryptocurrency, compounding recent trust issues surrounding the platform's business practices.
Polymarket has confirmed that hackers drained cryptocurrency from an undisclosed number of user accounts following a security compromise at a third-party vendor. The attack vector involved the injection of malicious code directly into the prediction market’s website, though the company noted this only affected a specific subset of visitors.
The financial scale of the theft is beginning to emerge through independent blockchain analysis. Monitoring firm PeckShield flagged a concurrent phishing campaign targeting the platform's users, estimating that hackers extracted roughly $3 million worth of digital assets. A separate blockchain analyst corroborated the losses, identifying more than 11 distinct victims whose funds were stolen.
Polymarket moved to reassure users by stating on X that the incident is now contained, pledging to refund all affected individuals in full. However, precise details regarding the specific vendor involved remain scarce. Spokesperson Connor Brandi confirmed the theft of funds to TechCrunch but declined to answer specific questions about the mechanics of the breach.
For market participants, the breach highlights the inherent dangers of platforms that interface traditional web architecture with cryptocurrency settlements. Because Polymarket pays out user winnings entirely in digital currencies, a compromise of the web-facing frontend represents a critical failure point. The reliance on external vendors creates an expanded attack surface that sophisticated phishing operations can exploit to bypass a user's personal security measures.
This security lapse compounds a week of severe reputational damage for the platform. On Sunday, an investigation exposed that Polymarket had financed deceptive promotional content, paying online creators to post videos falsely claiming they had won lucrative bets. The company responded to that controversy by committing to an audit of its marketing practices, but this latest hack will further test user confidence in its operational security.
