MarketPR
NETCloudflare Q3 Revenue Forecast Slows As Restructuring Costs RiseOct 21PFEPfizer Shareholders Lost 8.8% Over Five Years Despite DividendsOct 21AACPApogee Acquisition Corp files 8-K to restate Q2 financial statementsOct 21EQPTEquipmentShare raises 2026 rental revenue growth outlook to 43%Oct 21CLFCleveland-Cliffs reports Q3 2026 net income of $165 millionOct 21MKSIMKS Inc. agrees to sell Ophir Optics to TTM Technologies for $650 millionOct 21SLNMerck KGaA to Acquire Silence Therapeutics in $1.3 Billion Cash DealOct 21SLGNSilgan Forms Metal Packaging Partnership With AIP FundsOct 21GEGE Aerospace raises 2026 guidance on record engine ordersOct 21INSMInsmed adds Sanofi and Verily executives to boardOct 21NETCloudflare Q3 Revenue Forecast Slows As Restructuring Costs RiseOct 21PFEPfizer Shareholders Lost 8.8% Over Five Years Despite DividendsOct 21AACPApogee Acquisition Corp files 8-K to restate Q2 financial statementsOct 21EQPTEquipmentShare raises 2026 rental revenue growth outlook to 43%Oct 21CLFCleveland-Cliffs reports Q3 2026 net income of $165 millionOct 21MKSIMKS Inc. agrees to sell Ophir Optics to TTM Technologies for $650 millionOct 21SLNMerck KGaA to Acquire Silence Therapeutics in $1.3 Billion Cash DealOct 21SLGNSilgan Forms Metal Packaging Partnership With AIP FundsOct 21GEGE Aerospace raises 2026 guidance on record engine ordersOct 21INSMInsmed adds Sanofi and Verily executives to boardOct 21
NewsDigital Assets

Polymarket Hit by $2.9M Frontend Theft, Platform Commits to User Refunds

A $2.9 million theft hit Polymarket after attackers injected a malicious script into the prediction market platform's frontend, compromising user funds. Polymarket said it contained the breach and removed the affected software dependency. The platform has committed to refunding affected users.

By Renata OstrowskiDigital Assets DeskJune 28, 20262 min read
Share

Key takeaways

  • Polymarket lost $2.9 million after attackers injected a malicious script into the platform's frontend, compromising user funds.
  • The attack came through a software dependency in the frontend rather than Polymarket's on-chain contracts.
  • Polymarket contained the breach by locating and removing the affected dependency that delivered the malicious script.
  • Polymarket has committed to refunding all users affected by the $2.9 million theft.
  • The refund commitment places the remediation cost on the protocol rather than on affected users.

A $2.9 million theft hit Polymarket after attackers injected a malicious script into the prediction market platform's frontend, compromising user funds. Polymarket said it contained the breach and removed the affected software dependency. The platform has committed to refunding affected users.

How the Attack Was Executed

The attack moved through a dependency — a software component embedded in Polymarket's frontend — placing malicious code directly inside the browser-facing layer users interact with. Rather than targeting Polymarket's underlying on-chain contracts, the attackers chose the interface in front of them, embedding a script that users had no reason to suspect. The result was $2.9 million in stolen funds.

Containment

Polymarket said it moved to contain the compromise after identifying the breach. The platform located and removed the affected dependency, cutting off the vector through which the malicious script had entered its frontend stack. Polymarket described the breach as contained following those actions.

What Users Are Owed

Polymarket confirmed it will refund users affected by the $2.9 million attack. The commitment places the remediation cost on the protocol rather than on the individuals whose funds were exposed through the compromised frontend.

*Source thinness

Related reading

About this story

Filed by the digital assets desk of MarketPR on June 28, 2026. Source: cointelegraph.com. Indicative figures are not investment advice.

←Back to the news index

More from the Newsroom

All stories →
01Digital Assets

Plex Media Server flaws under active exploitation

Active exploitation is underway against recently fixed vulnerabilities in the Plex Media Server, with successful attacks installing malware including cryptominers and residential proxy apps, a researcher said.

Miles Broadbent2 min read
02Digital Assets

MARA Holdings Bitcoin Exposure Drives 17% Stock Drop Amid Collateral Risks

MARA Holdings (MARA) shares declined 17.0% between October 6 and October 13, 2026, a steeper drop than the S&P 500's 0.2% decline over the same period. This movement coincided with reports on October 10 that MARA sold approximately $81…

Miles Broadbent2 min read
03Digital Assets

Cipher Digital Drops 13% on $850M Convertible Note Offering

Cipher Digital (CIFR) shares closed at $11.34, a decline of 12.77%, following the company's announcement of a plan to raise $850 million through an offering of 0% convertible notes due in 2032. The stock traded on high volume, coming in…

Miles Broadbent2 min read

Frequently asked

How much was stolen in the Polymarket attack?

Attackers stole $2.9 million in user funds from Polymarket.

How did the attackers carry out the theft?

They injected malicious code through a software dependency embedded in Polymarket's browser-facing frontend, rather than targeting its on-chain contracts.

Will affected users get their money back?

Yes, Polymarket has confirmed it will refund users affected by the attack, putting the cost on the protocol itself.

How did Polymarket stop the attack?

Polymarket said it contained the breach by locating and removing the affected dependency, cutting off the vector the malicious script used to enter its frontend.