Refund

when

Polymarket

Polymarket has <a href="https://x.com/PolymarketTrade/status/2070155882906730671?s=20" rel="noopener noreferrer nofollow">contained a third-party vendor compromise</a> after a malicious script was injected into its frontend for some users. The affected dependency has been removed, and impacted users are being contacted for full refunds.
The confirmation links the earlier pUSD wallet drains to a frontend supply-chain incident rather than a confirmed Polymarket smart-contract exploit. The active failure point was the compromised vendor dependency that reached some users through the platform interface.
The affected users appear to match the earlier onchain alert tied to an <a href="https://x.com/SpecterAnalyst/status/2070152064051605517?s=20" rel="noopener noreferrer nofollow">estimated $2.94 million</a> drain from 11 or more wallets holding pUSD. The attacker swapped stolen assets into ETH and consolidated funds through 0xe65b1C586757c5510B60F998Eebb14C1eF71E1eD.
<h2 id="pusd-drains-moved-into-eth">pUSD Drains Moved Into ETH</h2>
The stolen funds came from wallets holding <a href="https://polygonscan.com/address/0xc011a7e12a19f7b1f670d46f03b03f3342e82dfb" rel="noopener noreferrer nofollow">pUSD</a>, Polymarket’s dollar-denominated trading collateral on Polygon. Earlier onchain tracking identified four additional theft addresses: 0xC771A30a7c1aCA828eeEF7B822ac864a64cBaAe2, 0xC44F2Ca6B30A54d17a62ceF8FAdaF2e8C8632eC4, 0x10366AdBB5C4101A65C840Da6639546179C5A107 and 0x7BCECe0d8fd92ECCf39Bc35242c6D9aAc0aA75A6.
The attack path fits a malicious frontend pattern. A user can land on a legitimate site, see a familiar interface and still be exposed if a compromised dependency injects wallet-draining logic into the session. The chain and core market contracts do not need to fail for users to lose funds through approvals, signatures or transaction prompts served through the frontend.
That makes Polymarket’s refund commitment the central user update. Affected users are now being contacted directly, while the compromised dependency has been removed from the frontend stack.
<h2 id="frontend-risk-hits-a-growing-prediction-market">Frontend Risk Hits A Growing Prediction Market</h2>
The incident lands as Polymarket is pushing into more distribution channels and consumer-facing trading flows. A recent Polymarket-powered launch brought prediction markets into <a href="https://cryptoadventure.com/polymarket-powered-predicton-brings-prediction-markets-into-telegram-on-ton/" rel="noopener noreferrer nofollow">TON</a> through Telegram-native wallets, widening access beyond the core web interface and exposing the product to more wallet environments.
The platform has also faced broader pressure around growth, promotion and user acquisition. One recent report tied Polymarket’s chief marketing officer to more than $2.5 million in PayPal transfers for creator campaigns, raising <a href="https://cryptoadventure.com/polymarket-cmos-2-5m-paypal-trail-raises-influencer-disclosure-questions/" rel="noopener noreferrer nofollow">disclosure</a> questions around paid promotion in prediction markets. Another report accused Polymarket-linked marketing of using fake-win videos to attract U.S. users, adding <a href="https://cryptoadventure.com/polymarket-faces-wsj-scrutiny-over-fake-win-videos-targeting-u-s-users/" rel="noopener noreferrer nofollow">scrutiny</a> around how offshore prediction-market products are promoted to restricted audiences.
The latest issue is different because it centers on user-wallet safety, frontend integrity and vendor security. A compromised dependency can place malicious wallet logic in front of users even when the interface looks familiar, which makes third-party scripts, dependency controls and emergency rollback systems part of the security perimeter for trading apps.
The confirmed compromise leaves <a href="https://cryptoadventure.com/polymarket-review-2026-fees-liquidity-resolution-risk-and-who-it-suits/" rel="noopener noreferrer nofollow">Polymarket</a> with a narrow recovery path: reimburse affected users, remove the compromised dependency and harden the frontend supply chain. The monitor-flagged loss estimate remains near $2.94 million, with stolen pUSD swapped into ETH and consolidated through 0xe65b1C586757c5510B60F998Eebb14C1eF71E1eD.
The post <a href="https://cryptoadventure.com/polymarket-to-refund-users-after-vendor-script-drains-2-94m/" rel="noopener noreferrer nofollow">Polymarket To Refund Users After Vendor Script Drains $2.94M</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Polymarket To Refund Users After Vendor Script Drains $2.94M

Table of Contents

Crypto Adventure

Other articles published on Jun 25, 2026

Join our free newsletter for daily crypto updates!