Polymarket Third-Party Vendor Breach Drains $3M in User Funds

According to Polymarket and on-chain investigators at Bubblemaps, a compromised third-party vendor allowed attackers to inject malicious code into Polymarket's front-end on Thursday (June 25), draining roughly $3 million in user funds. The attackers accessed users' wallets through a malicious script served by the breached vendor and drained pUSD, the platform's USDC-backed stablecoin.

The stolen funds were then bridged from Polygon to Ethereum and converted into approximately 1,893 ETH, with fewer than 15 user accounts affected. Polymarket confirmed it has contained the breach, removed the affected dependency, and pledged to refund impacted customers in full. The company declined to name the compromised vendor.