Polymarket has fixed a security issue on its international platform stemming from a compromised third-party vendor rather than its own code. The prediction market has referred the incident to law enforcement, escalating the matter beyond an engineering problem to a potential criminal investigation.
What Occurred
Researchers described the incident as a supply-chain attack, with malicious code reportedly injected into Polymarket's frontend on or around June 25, 2026. The frontend layer allows users to interact with the platform's underlying smart contracts that hold and manage funds.
The injected code reportedly enabled unauthorized transactions from user wallets. Approximately $2.94 million in pUSD was drained from more than 11 wallets. Attackers then converted the stolen pUSD into ETH, with swaps totaling around 1,893 ETH according to research.
Polymarket contained the malicious code and removed the compromised vendor dependency from its technology stack.
Response and Scope
Affected users are being offered full refunds. Polymarket emphasized that its core smart contracts and backend infrastructure were not compromised, stating there is no ongoing risk to platform users. The compromised vendor has not been publicly named.
Blockchain security firms, including PeckShield, are reportedly monitoring the situation.
Broader Context
This is not Polymarket's first encounter with third-party security problems. The platform previously faced issues tied to authentication providers and other frontend scripts, including a reported incident in December 2025.
In cryptocurrency platforms, the stakes of frontend vulnerabilities are higher than in traditional finance. While a compromised script on a bank website might expose login credentials, a malicious script in crypto can prompt users to sign transactions that move real money within seconds.
Industry Implications
Supply-chain attacks represent a persistent vulnerability category in crypto. A protocol can pass smart contract audits and still face exposure through third-party analytics scripts, login providers, or widgets. Security audits focused solely on the contract layer cover only a portion of the attack surface.
The law enforcement referral signals Polymarket's intent to pursue those responsible for the attack rather than absorb the loss as a cost of operations. Any developments from law enforcement or public identification of the compromised vendor could provide clarity on how the breach occurred.
