Third-Party Breach at Polymarket Led to Nearly $3 Million in User Crypto Theft

Polymarket said attackers stole funds from an undisclosed number of users after compromising a third-party vendor and injecting malicious code into the company's website. The platform said the incident has been contained, affected customers are being notified, and victims will be fully reimbursed. A company spokesperson confirmed the theft but did not disclose how many users were impacted.

Independent blockchain researchers described the activity as a phishing-style campaign that drained more than 11 Polymarket wallets holding PUSD, with estimated losses of about $2.94 million to $3 million. Researchers also reported that the attacker moved the stolen assets from Polygon to Ethereum and converted them into roughly 1,893 ETH, indicating a rapid effort to launder the proceeds after the website compromise.