3 Million Stolen in Polymarket Platform Hack: Investors Lose Millions

Post Views: 9

Decentralized prediction market platform Polymarket has announced plans to reimburse users impacted by a security breach.

Reimbursement and Breach Announcement

Polymarket, which facilitates cryptocurrency-based trading on real-world event outcomes, reported that a third-party vendor was compromised, leading to the insertion of a malicious script into its frontend infrastructure. The incident was identified on Thursday, with the company stating that the affected dependency has been removed and the issue contained. Polymarket confirmed that affected users will receive full compensation but did not specify the number of individuals impacted or the exact cryptocurrency value stolen.

Details of the Security Incident

The breach was disclosed by Blockchain security firm PeckShield, which reported that approximately $3 million in pUSD, Polymarket’s USDC-backed stablecoin, was pilfered through a phishing operation. The stolen funds were transferred from the Polygon blockchain to Ethereum, where they were converted into roughly 1,893 ETH. A blockchain analyst corroborated the financial loss, estimating the total at nearly $3 million, with at least 11 victims affected.

Blockchain security firm PeckShield disclosed that approximately $3 million in pUSD, Polymarket’s USDC-backed stablecoin, was pilfered through a phishing operation. The stolen funds were transferred from the Polygon blockchain to Ethereum, where they were converted into roughly 1,893 ETH. A blockchain analyst corroborated the financial loss, estimating the total at nearly $3 million, with at least 11 victims affected.

Third-Party Supply Chain Vulnerability

The breach highlights vulnerabilities in third-party supply chains, as the malicious script was introduced via an external vendor. While Polymarket emphasized containment measures, the lack of transparency surrounding the incident has raised concerns about the platform’s security protocols. The phishing campaign reportedly targeted users to gain access to sensitive systems, enabling the unauthorized transfer of funds.

Security Concerns and Expert Opinions

PeckShield’s analysis underscores the growing risks associated with decentralized finance (DeFi) platforms, where exploits can rapidly escalate due to the immutable nature of blockchain transactions. No official statement has been released by Polymarket detailing the technical specifics of the breach, such as the methods used to compromise the vendor or the timeline of the attack. The absence of clarity on these aspects complicates efforts to assess the full extent of the damage.

Ongoing Investigation and Future Updates

Security experts have noted that such incidents underscore the importance of rigorous third-party risk management and continuous monitoring of digital assets. As the investigation progresses, further details about the attack vector, affected systems, and potential regulatory implications are expected to emerge. SecurityWeek has sought additional information from the company regarding the stolen amount and affected user count, with updates pending.