Polymarket Announces $2.7 Million Theft and $3.9 Million Refund Plan After Third‑Party Script Breach

Polymarket, the decentralized prediction‑market platform, disclosed that a malicious third‑party script resulted in the theft of roughly $2.7 million from user accounts, and it has pledged to return $3.9 million in total, covering both the stolen funds and additional compensation for users who suffered losses while the platform was paused.

The breach was traced to a script supplied by an external vendor that Polymarket integrated into its front‑end code. Security analysts say the script was altered to exfiltrate private keys and authentication tokens, allowing attackers to move assets from affected wallets. The intrusion was detected after users reported unexpected balance drops, prompting an emergency audit that confirmed the malicious code.

Polymarket, which allows participants to wager on the outcomes of real‑world events, has grown rapidly since its launch in 2020, positioning itself as a mainstream gateway to decentralized finance. Like many blockchain‑based services, it relies on a combination of on‑chain smart contracts and off‑chain infrastructure, including third‑party libraries for analytics, UI components, and user verification. The incident underscores the vulnerability that arises when external code is not sufficiently sandboxed or audited.

In response, the platform announced a comprehensive remediation plan. Users whose balances were depleted will receive full restitution, while those who incurred “pause losses”—funds that could not be accessed or redeployed during the system shutdown—will be compensated as part of the $3.9 million package. Polymarket said the refunds will be processed in stages over the next several weeks, with priority given to accounts that provided verifiable loss documentation.

The hack arrives at a time when regulators and investors are scrutinizing the security practices of crypto‑related services. Industry observers note that reliance on third‑party scripts is a common but often under‑examined risk vector, especially for platforms that handle sizable sums of user capital. The incident may prompt broader calls for standardized security audits and stricter vendor vetting across the sector.

Polymarket’s leadership has pledged to cooperate fully with law‑enforcement agencies and independent forensic teams to identify the perpetrators and prevent future exploits. The company also indicated that it will roll out additional safeguards, including stricter code review protocols and enhanced monitoring of external dependencies. Users awaiting refunds are advised to monitor official communications for updates on claim procedures and timelines.