Polymarket hacked

[Oshosondy]

This is according to Polymarket on X

This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We've contained it & removed the affected dependency. We're contacting impacted users & refunding them in full.


$2.94 million was stolen.

AI summary of the incident:

Polymarket reported a $2.94 million theft after a third-party vendor breach let attackers inject malicious code into the platform’s frontend. The incident, uncovered on June 26, 2026, impacted at least 11 users through phishing attacks. The company says the issue is resolved, the faulty dependency removed, and full refunds will be issued. Traders are now watching altcoins to watch amid rising fear and greed index volatility.

If you want to know more about the incident: https://www.kucoin.com/news/flash/polymarket-loses-2-9m-to-theft-promises-full-refunds

No problem, Polymarket has said everyone affected are going to be refunded.

[Wiwo]

This is the risks that comes with third party involvement.

Well the conclusion is that, poly market made a refund to the affected user's/vendors effected.

Traffics comes with attention and hacks, this is a call for poly market to upt their development. 

[Merit.s]

If funds are refunded as Polymarket said, it will build more trust on gamblers to use Polymarket for their gambling activities. That's a good one from them. It's such a huge funds, though.

No company, entity or individual that's bigger than been hacked. Sometimes, we fall for simple mistakes that we know the consequences just because we're in a rush or neglect it. Hackers/Scammers are seriously aiming big businesses.

[CryptSafe]

Well, they can come on air to say that they got hacked and will get everyone affected refunded, that's fine, but we all know how they operate. They can not be trusted, and I would not be surprised to hear the possibility in the future that they masterminded the act just to paint themselves in a good light in the eyes of the community, who knows. We all know Polymarket has been called out severally by many big names for their ill acts, and now they have announced that they got hacked. Well, it is good to hear that they promise tomake refund to those who were affected.

[$crypto$]

$2.94 million is a small amount for Polymarket let alone the evaluation of this market is quite large, so it is natural that if anyone is affected will be compensated in full, this is only a third party who is affected while the Polymarket site is still operating without any impact.

I am sure that users do not have any doubts about this incident, which means they will not lose confidence in this platform.

[Dunamisx]

This is according to Polymarket on X

This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We've contained it & removed the affected dependency. We're contacting impacted users & refunding them in full.


$2.94 million was stolen.

AI summary of the incident:

Polymarket reported a $2.94 million theft after a third-party vendor breach let attackers inject malicious code into the platform’s frontend. The incident, uncovered on June 26, 2026, impacted at least 11 users through phishing attacks. The company says the issue is resolved, the faulty dependency removed, and full refunds will be issued. Traders are now watching altcoins to watch amid rising fear and greed index volatility.

If you want to know more about the incident: https://www.kucoin.com/news/flash/polymarket-loses-2-9m-to-theft-promises-full-refunds

No problem, Polymarket has said everyone affected are going to be refunded.

These are the likes of story you will be well served when you are making use of a 3rd party services like this, to me I don't see poly market as gambling but a kind of service that those that go for it undergo extreme risk and the entire procedures in this gameplay is not really transparent or done in a trusted manner, they can always come up with any thing as an excuse to why you can always lose at the end, it is still more better to make use of a casino and Gamble your sport games and enjoy the value of your money than risking it on prediction market.

[Agbe]

If funds are refunded as Polymarket said, it will build more trust on gamblers to use Polymarket for their gambling activities. That's a good one from them. It's such a huge funds, though.

No company, entity or individual that's bigger than been hacked. Sometimes, we fall for simple mistakes that we know the consequences just because we're in a rush or neglect it. Hackers/Scammers are seriously aiming big businesses.

People need the system more secured than the refunding. In my own understanding, Polymarket is doing it to regain it clients so that when it comes back, none of the users of their service will leave but to stay put to continue gambling. To create trust is majorly from the withdrawal and respond from the support. When they fully come back to operation, they will improve on their security. Any website that is dealing with money and Government Security issues should be well secured because those are the target for the internet scammers.

[Smartprofit]

In my opinion, the hacking of any decentralized project is a serious blow to the free internet. 🙋

The Polymarket project is currently under significant pressure from regulators. Let me remind you of the recent scandal involving a fake Polymarket website and payments to influencers who placed fictitious bets. Back then, Polymarket's marketers seriously compromised their own leadership. And now a new scandal has emerged. I think the Polymarket team had no choice but to compensate all those affected. Otherwise, they could have faced sanctions from regulators.

At the same time, I am very concerned that decentralized systems are increasingly being attacked by malicious actors. Perhaps this is due to the development of artificial intelligence, which facilitates the success of these attacks, or perhaps problems arise at the intersection of Web 3.0 and Web 2.0. It's hard to say... But despite all its shortcomings, I really like the Polymarket forecasting platform.  I wish her all the best in the future!

[rdluffy]

It's scary to be honest:

In practice, phishing scripts can trick users into approving malicious actions, entering credentials into spoofed interfaces, or signing transactions that benefit attackers.

They didn't need direct access to Polymarket
Just imagine if that breach had lasted a few days?
You could be on a trustworthy site and not even realize you're being lured into a phishing scam

[Alex077]

This is according to Polymarket on X
This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We've contained it & removed the affected dependency. We're contacting impacted users & refunding them in full...

Yeah, but there’s an important detail here. Based on Polymarket’s statement, the blockchain itself and the platform’s smart contracts weren’t hacked. As we can see, this wasn’t a blockchain security failure but a classic supply chain attack.
But these type of attacks are especially dangerous because users can visit the legitimate website without realizing that the interface has already been compromised and is serving malicious code.
And we must draw a conclusion that this incident is another reminder that the security of crypto platforms depends on much more than just the blockchain itself. And the main - third-party services, libraries, and software providers can become the weakest link, and sometimes that’s exactly where attackers choose to strike.

[PostQuantumBTC]

Well, they can come on air to say that they got hacked and will get everyone affected refunded, that's fine, but we all know how they operate. They can not be trusted, and I would not be surprised to hear the possibility in the future that they masterminded the act just to paint themselves in a good light in the eyes of the community, who knows. We all know Polymarket has been called out severally by many big names for their ill acts, and now they have announced that they got hacked. Well, it is good to hear that they promise tomake refund to those who were affected.

Did Polymarket of offend you? Or you lost money which is huge on the site? Do not mind me, I am just kidding. Polymarket and other prediction markets are new, it is normal for them to face regulatory pressure. To me they are good sites but it is hard to know which category they should be classified under. This is a thread about hack and not a thread about the bad things about Polymarket. I do not see anything bad about Polymarket so far a country legalized gambling.

[BlackBoss_]

No problem, Polymarket has said everyone affected are going to be refunded.

It's always big problem when people store their money on online platforms. Polymarket can refund their users this time but how about in the future, nobody knows?

Especially if in the future, Polymarket becomes smaller and weaker than they are now.

Reminder: do not keep your money in online accounts.

It's boring to repeatedly warn people about this risk, and warnings are like enough, even overwhelming for people, it's only their responsibility to take care of their fund properly.

[YellowSwap]

That's close to $3 million, that's a lot of money, I will be disappointed if they just let it go like that just because they can afford to refund users, they should make that stolen money become useless to those who stole it.

Even if they can not go after them and track them down they should find a way to lock or block that address, this is why I don't completely hate the fact that stable coins can freeze a wallet address, it's always because of criminal cases like this.

Like I used to tell people, if you don't do anything evil online USDt and others have no reason to freeze your address, and if you think I am wrong show me a innocent person that got his or her address freezed for nothing.

[robelneo]

Well, they can come on air to say that they got hacked and will get everyone affected refunded, that's fine, but we all know how they operate. They can not be trusted, and I would not be surprised to hear the possibility in the future that they masterminded the act just to paint themselves in a good light in the eyes of the community, who knows. We all know Polymarket has been called out severally by many big names for their ill acts, and now they have announced that they got hacked. Well, it is good to hear that they promise tomake refund to those who were affected.

You have a good point, brother. With all the bad news surfacing about the prediction markets, where Polymarket is the ruler, they need a good PR move, and this could be one of them.
Refunding users when there is a hack is a good way to build your reputation in the community, but after that, they still need to continue building their reputation with all the charges coming in.

[BitMaxz]

That's close to $3 million, that's a lot of money, I will be disappointed if they just let it go like that just because they can afford to refund users, they should make that stolen money become useless to those who stole it.

Even if they can not go after them and track them down they should find a way to lock or block that address, this is why I don't completely hate the fact that stable coins can freeze a wallet address, it's always because of criminal cases like this.

Like I used to tell people, if you don't do anything evil online USDt and others have no reason to freeze your address, and if you think I am wrong show me a innocent person that got his or her address freezed for nothing.

I believe this is a hassle because they will need law enforcement and evidence, such as transaction hashes and addresses, and then they will go through a lengthy process until they receive a law enforcement request to tether to freeze those funds.

That's why I think they come up with easier solutions for their affected customers. Refunding them would be the fastest solution.

What they need to focus on right now is that the security of their site's frontend or backend; they should improve their security to avoid a similar case again in the future because this type of script has been pretty common in marketing since 2017. It is likely a combination of hijacking and spoofing.

[sunsilk]

It's the first concern that got to my mind about the refunds for the users affected by the hack.

Nice to know that they're going to refund wholly the affected ones with this.

This hack will give them more time to improve their security and to make sure that no one gets affected again by giving some warning which is a must for platforms like them.

[rat03gopoh]

Well, they can come on air to say that they got hacked and will get everyone affected refunded, that's fine, but we all know how they operate. They can not be trusted, and I would not be surprised to hear the possibility in the future that they masterminded the act just to paint themselves in a good light in the eyes of the community, who knows. We all know Polymarket has been called out severally by many big names for their ill acts, and now they have announced that they got hacked. Well, it is good to hear that they promise tomake refund to those who were affected.

That's a pretty cheap recipe to make them sound responsible in the eyes of many regulators. I'm not sure they actually did it. However, I wouldn't discount the assumption that it didn't exist.
Digging deeper into the replies to their tweets, several people did report these signs of compromise, and they hadn't previously received an enthusiastic response. I suspect they're gathering several other reports before finally coming to a conclusion.

[PrivacyG]

this is why I don't completely hate the fact that stable coins can freeze a wallet address, it's always because of criminal cases like this.

Are you sure it is ALWAYS because of criminal cases?  They have a perfect 100 percent positive rate for crime when freezing wallets?

[PX-Z]

This is the risks that comes with third party involvement.

Its always the irresponsible third party platform, trusting them to have more reach and access on your platform will be so risky especially a platform where there are hundred of thousands of users, regardless the security API shared is strict since the malicious attack will look like just normal POST/GET request.

[Darker45]

From one of the comments, it's interesting to note that repeated efforts were earlier exerted warning them of a vulnerability. They were ignored.


https://x.com/SkeeSkiiirt/status/2070415172364317107


https://x.com/leaveVeeAlone/status/2065953504850518119

It's always big problem when people store their money on online platforms. Polymarket can refund their users this time but how about in the future, nobody knows?

The news says at least 11 Polymarket wallets were affected. The damage so far is $2.94 million. It averages hundreds of thousands per wallet. These bettors are courting risk storing big amounts in a relatively unsafe platform.

They can refund it until they can't. Polymarket is rich. But if they're hit big time, they might crumble. And it seems, at least as far as the impression on how they handle potential security threats are concerned, this might not be the last.