Polymarket to refund users after third-party hack steals $3 million
Polymarket said it is refunding users after hackers stole roughly $3 million by injecting a malicious script into the platform's frontend through a compromised third-party vendor. The supply-chain attack, disclosed Thursday, targeted the vendor integration rather than Polymarket's core smart contracts. The platform contained the compromise and removed the affected dependency. The incident follows a separate breach disclosed in April 2026, intensifying scrutiny of Polymarket's security infrastructure as trading volumes grow. The platform did not specify which vendor was compromised or the exact number of affected users.
Polymarket's second frontend breach in two months forces the platform to absorb user losses while rival operators watch whether traders migrate on security fears. Any sustained outflow would hand market share directly to Kalshi and other regulated venues at a moment when Meta's Arena looms.