-
Hackers stole roughly $3 million from Polymarket users after compromising a third-party service.
-
Malicious code injected into the website tricked users into approving fraudulent wallet transactions.
-
Polymarket says it has contained the attack and will pay back all affected users.
A prediction market’s website, Polymarket, just got hit and the bad actors responsible took approximately $3 million worth of cryptocurrency. How they got in was through one of the company’s third-party vendors that they compromised. According to security experts, this is a supply-chain attack.
According to reports, the attackers managed to inject malicious code into part of Polymarket’s website. The altered code displayed deceptive transaction requests to certain visitors, causing users to unknowingly approve transfers that drained funds from their cryptocurrency wallets.
Polymarket later confirmed that it removed the compromised software and said it would fully reimburse affected users for their losses. The incident has renewed concerns about supply-chain attacks, which have increasingly become one of the most dangerous threats facing cryptocurrency platforms and online services.
Third-Party Vendor Became Entry Point
Rather than directly breaching Polymarket’s infrastructure, the attackers reportedly targeted a third-party provider connected to the platform. They introduced malicious scripts into parts of the website. When users connected their cryptocurrency wallets and attempted to interact with the platform, some saw deceptive approval requests.
The vulnerability of third-party vendors is a growing concern across all sectors, a recent breach involving a vendor exposed the personal data of more than 3 million Texans.
By approving these transactions, victims unknowingly granted attackers access to their funds. Supply-chain attacks have become increasingly attractive to cybercriminals because a single compromised vendor can potentially expose thousands of users simultaneously. Polymarket stated that it has stopped the attack, removed the compromised component, and continues to investigate the incident.
Attack Sparks Debate Across X
The incident quickly generated discussion across X, where users debated not only the security failure but also the broader risks facing decentralized and cryptocurrency platforms.
User @Yawaru, posting under the name Moon King Yawaru, warned that artificial intelligence may further worsen future attacks. “Nothing is going to be easier for AI-assisted hackers to break than AI-assisted vibe coding.”
The comment reflects growing concerns that rapidly generated software code, especially code produced with heavy reliance on AI tools, could introduce vulnerabilities that attackers later exploit.
Another user, @fibodotfun, argued that the incident demonstrates the dangers associated with off-chain infrastructure. “Supply-chain attack on a frontend is a reminder that off-chain platforms carry an attack surface you can’t fully audit.”
The user suggested that systems relying heavily on front-end interfaces and external services may remain vulnerable even when underlying blockchain infrastructure remains secure.
Meanwhile, @gaba_gool22, who operates the Gabagool 22 Trading Bot account, highlighted the broader implications for the cryptocurrency industry. “Supply chain attacks are a serious risk, not just for users but for market integrity. $3 million is a substantial hit.”
The account also praised Polymarket’s decision to reimburse affected users, saying the move helps preserve trust in the platform. Later, @fibodotfun again emphasized the importance of fully on-chain settlement systems. “No frontend to compromise, no off-chain resolution. The chain is the umpire.”
Growing Threat to Crypto Platforms
Supply-chain attacks have become increasingly common across both traditional technology companies and cryptocurrency platforms. Instead of attacking a target directly, cybercriminals compromise trusted vendors, software libraries, plugins, analytics services, or development tools that organizations rely on. Once malicious code enters the supply chain, attackers can affect large numbers of users simultaneously.
Security researchers note that cryptocurrency users remain particularly vulnerable because blockchain transactions are generally irreversible. Once a user approves and executes a malicious transaction, recovering the funds becomes extremely difficult. In this case, Polymarket’s commitment to fully reimburse affected users may help reduce the long-term impact of the incident.
