Polymarket hack losses climb to US$3.1M

• Losses from Polymarket's frontend phishing attack have increased to approximately US$3.1 million across 11 user wallets.
• Polymarket said a compromised third-party vendor allowed malicious code to be injected into parts of its website and pledged to fully refund affected users.
• The incident comes as the prediction market platform faces increased regulatory scrutiny in the United States over its advertising and market practices.

Polymarket said a compromise involving a third-party vendor allowed malicious code to be injected into parts of its frontend, contributing to a phishing attack that has now resulted in approximately US$3.1 million in losses across 11 user wallets.

The platform said it has removed the affected dependency, contained the incident and is contacting impacted users after pledging to provide full refunds to everyone affected by the attack.

"We've contained it & removed the affected dependency," Polymarket said, adding that it was "contacting affected users and refunding them in full."

Blockchain security firms said the attackers stole PUSD from Polygon wallets before bridging the funds to Ethereum (CRYPTO:ETH), where the assets were converted into approximately 1,893 ETH.

The incident targeted users through Polymarket's website interface rather than its core protocol, highlighting the risks posed by compromised third-party software dependencies even when underlying smart contracts remain secure.

The latest attack follows previous security incidents involving the platform and comes amid a broader increase in reported cryptocurrency security breaches during the second quarter of the year.

Polymarket is also facing increased regulatory scrutiny after US lawmakers asked the Commodity Futures Trading Commission to review allegations relating to advertising practices and oversight of prediction market platforms.

At the time of reporting, Ethereum price was $1,567.96.