Polymarket hit by $2.9M theft, users to be refunded
Polymarket said it contained the compromise and removed the affected dependency after attackers injected a malicious script into its frontend.
A third-party vendor compromise discovered Thursday allowed attackers to inject a malicious script into Polymarket’s frontend, affecting multiple users.
Blockchain analyst Specter said the malicious script appeared to facilitate a phishing attack that drained an estimated $2.94 million from at least 11 Polymarket user wallets.
Polymarket said on X that the compromise has been contained and that the affected dependency has been removed. It added that users would be fully refunded.