Polymarket Hit by $2.9M Frontend Theft, Platform Commits to User Refunds
A $2.9 million theft hit Polymarket after attackers injected a malicious script into the prediction market platform's frontend, compromising user funds. Polymarket said it contained the breach and removed the affected software dependency. The platform has committed to refunding affected users.
A $2.9 million theft hit Polymarket after attackers injected a malicious script into the prediction market platform's frontend, compromising user funds. Polymarket said it contained the breach and removed the affected software dependency. The platform has committed to refunding affected users.
How the Attack Was Executed
The attack moved through a dependency — a software component embedded in Polymarket's frontend — placing malicious code directly inside the browser-facing layer users interact with. Rather than targeting Polymarket's underlying on-chain contracts, the attackers chose the interface in front of them, embedding a script that users had no reason to suspect. The result was $2.9 million in stolen funds.
Containment
Polymarket said it moved to contain the compromise after identifying the breach. The platform located and removed the affected dependency, cutting off the vector through which the malicious script had entered its frontend stack. Polymarket described the breach as contained following those actions.
What Users Are Owed
Polymarket confirmed it will refund users affected by the $2.9 million attack. The commitment places the remediation cost on the protocol rather than on the individuals whose funds were exposed through the compromised frontend.
Source thinness note: The source contains approximately three discrete facts. This article is shorter than 350 words because padding it further would require inventing specifics the source does not provide.
Related reading
Filed by the digital assets desk of MarketPR on June 28, 2026. Source: MarketPR. Indicative figures are not investment advice.