The prediction market says a compromised vendor caused the problem on its international platform, and it has referred the matter to law enforcement
Polymarket says it has fixed a security issue on its international platform. The cause was not its own code but a third-party provider that got compromised.
The prediction market has also referred the matter to law enforcement. That step turns an engineering cleanup into a potential criminal case.
What happened
The research describes this as a supply-chain attack. Malicious code was reportedly injected into the platform’s frontend on or around June 25, 2026. The frontend is the website layer users click through. It sits on top of the smart contracts that actually hold and move funds.
That injected code reportedly enabled unauthorized transactions from user wallets. Approximately $2.94 million in pUSD was drained from more than 11 wallets.
The attackers then reportedly converted the stolen pUSD into ETH. The swaps came to around 1,893 ETH, according to the research.
Polymarket moved to contain the malicious code. It also removed the compromised vendor dependency from its stack.
Refunds and what was not touched
Affected users are being offered full refunds, per the research.
Polymarket also stressed that its core smart contracts were not compromised. Its backend infrastructure was likewise unaffected, the platform said.
The platform’s position is that there is no ongoing risk to users of its services. The vendor at the center of the incident has not been publicly named.
Blockchain security firms, including PeckShield, are reportedly monitoring the situation.
A familiar weak spot
This is not the first time Polymarket has run into trouble through outside code. The research points to earlier issues tied to third-party providers, including a reported incident in December 2025.
Those prior problems reportedly involved vulnerabilities linked to authentication providers and other frontend scripts.
Crypto raises the stakes on that math. In traditional finance, a bad script on a bank website might expose login details. In crypto, a bad script can ask a user to sign a transaction that moves real money in seconds.
What this means
For Polymarket users, the immediate picture looks manageable. The issue is reported fixed, the vendor dependency is gone, and refunds are on the table. The scale was contained to a relatively small number of wallets.
For the industry, supply-chain attacks are a stubborn category. A protocol can pass a smart contract audit and still be exposed through an analytics script, a login provider or a widget it did not write. Audits that stop at the contract layer cover only part of the attack surface.
The law enforcement referral is the other thread to watch. It signals Polymarket intends to pursue the people behind the attack rather than simply absorb the loss. Any progress there, or any naming of the compromised vendor, would add clarity on how the breach unfolded.
