Polymarket said a vendor compromise allowed attackers to inject a malicious script into its frontend, leading to a $2.9 million theft. The company said it contained the incident, removed the affected dependency and will refund users.
Polymarket said a vendor compromise allowed attackers to inject a malicious script into its frontend, leading to a $2.9 million theft. The company said it contained the incident, removed the affected dependency and will refund users.
Polymarket said it was hit by a compromise that led to $2.9 million being stolen from users after attackers injected a malicious script into the platform’s frontend. The prediction market platform said the issue was contained and that users affected by the theft will be refunded.
Polymarket said it was hit by a compromise that led to $2.9 million being stolen from users after attackers injected a malicious script into the platform’s frontend. The prediction market platform said the issue was contained and that users affected by the theft will be refunded.
The incident matters because it points to a recurring risk for crypto platforms: even when core systems are not described as breached, compromised third-party dependencies can create a path to user losses through the interface people rely on to interact with a service. For users, the episode is a reminder that frontend and vendor security can be as important as smart contract or wallet security.
According to the supplied report, Polymarket removed the affected dependency after identifying the compromise. The company also said it had contained the malicious activity, limiting the immediate impact of the attack.
The theft adds to broader concerns around supply-chain security in crypto, where injected scripts or compromised vendors can expose users during routine platform interactions. In this case, Polymarket’s stated response centers on containment, dependency removal and reimbursement for affected users.
No additional details were provided in the supplied material about the attackers, the exact number of affected users or the timing of the refunds. Polymarket’s commitment to reimburse users is the central user-facing outcome disclosed in the source.
Keep exploring
Standard Chartered has issued 2030 price targets for Uniswap, Aave, Morpho and Chainlink, tying the outlook to a large expansion in tokenization and DeFi activity. The bank’s forecast assumes the sector grows significantly over the rest of the decade.
Read
Mastercard is acquiring stablecoin infrastructure company BVNK in a deal valued at $1.8 billion, according to CoinDesk. The transaction highlights continued interest from major payments companies in crypto and stablecoin infrastructure.
Read
XRP has lagged behind the broader crypto bounce even as exchange-traded funds continue drawing investor money. The gap highlights how market participation is not moving evenly across digital assets.
Read