Polymarket to Refund Users Following $3 Million Cybersecurity Breach

Polymarket, a decentralized prediction market platform, reported that hackers compromised a third-party vendor, leading to the theft of approximately $3 million in crypto from a small number of users. The security issue has since been addressed, and the platform is in the process of reimbursing all impacted customers.

The breach occurred when attackers gained access through a vulnerable third-party service, allowing them to inject harmful code into the platform's front-end. This enabled them to withdraw funds from the affected users' wallets, which predominantly held pUSD, Polymarket's stablecoin pegged to the US dollar. The stolen assets were later converted to Ethereum and stored in a new wallet.

According to on-chain analysis by Bubblemaps, the fallout from this exploit was somewhat limited, as only around 15 user accounts were affected. However, this incident marks Polymarket's second significant security breach in just two months, with the prior incident in May resulting in a loss of approximately $700,000 from employee wallets.

Polymarket has confirmed that it is proactively refunding the impacted users and has contained the exploit. Nevertheless, the company has not detailed how it plans to mitigate future vulnerabilities stemming from reliance on external vendors. The incident raises concerns about security protocols within platforms that depend heavily on third-party integrations.

"Currently, Polymarket is ensuring that the affected users are reimbursed in full," a representative clarified. The company’s commitment to user support reflects its aim to maintain trust, even as it navigates the challenges of the incident.

Moving forward, observers will be watching closely for any further actions that Polymarket takes to improve its security infrastructure, especially regarding third-party relationships that could introduce vulnerabilities.