Dollars

DeFi

Million

April

Polymarket

<p>A compromised third-party provider allowed hackers to inject malicious code on Polymarket’s interface, stealing about 3 million dollars from more than 11 users. The predictive markets platform controlled the incident and announced full reimbursement for the victims. In a sector under increasing scrutiny, the flaw raises questions about the security of front-end layers.</p>
<div class="in-brief">
 <div class="in-brief--container"><span></span><span></span>
  <h2 class="in-brief--title" id="in-brief">In brief</h2>
  <ul>
   <li>Hackers stole about 3 million dollars from more than 11 Polymarket users via a compromised third-party provider.</li>
   <li>The malicious code targeted the web interface and not the smart contracts, prompting victims to approve fraudulent transactions.</li>
   <li>Polymarket ensures full reimbursement for victims and has removed the third-party dependency causing the breach.</li>
  </ul>
 </div>
</div>
<h2 id="h-comment-les-pirates-ont-contourne-les-defenses-de-polymarket">How did hackers bypass Polymarket’s defenses?</h2>
<p>The blockchain security firm Peckshield estimated the damage at 3 million dollars, spread over at least 11 victims. However, <a href="https://www.cointribune.com/en/polymarket-rebounds-with-growing-user-activity-as-wash-trading-concerns-rise/" rel="noopener noreferrer nofollow">Polymarket</a> did not suffer a direct breach. The attackers targeted a third-party provider whose code was delivered via the platform’s web interface, injecting a fraudulent script that prompted users to validate fake transactions.</p>
<div class="my-4">
 <div class="ads "></div>
</div>
<div class="affiliate-button"><a href="https://coinbase-consumer.sjv.io/qzm0Jq" rel="noopener noreferrer nofollow">Your 1st cryptos with Coinbase</a><a href="https://www.cointribune.com/en/sponsored-content/" rel="noopener noreferrer nofollow">This link uses an affiliate program.</a>
</div>
<p>This type of attack, called a “supply chain compromise,” is particularly feared in the crypto industry. Instead of targeting a platform’s directly secured systems, hackers go up to its software dependencies.&nbsp;</p>
<p>Visitors loading the compromised page saw apparently legitimate signature requests, which actually gave attackers control over their wallets.</p>
<p>According to Polymarket itself, the platform removed the affected dependency and now has full control over the incident.<a href="https://news.bitcoin.com/polymarket-3-million-third-party-breach/" rel="noopener noreferrer nofollow"> On-chain markets never exposed locked funds</a>; only users who approved fraudulent transactions saw their wallets drained.</p>
<h2 id="h-un-secteur-sous-pression-reglementaire-et-securitaire">A sector under regulatory and security pressure</h2>
<p>The incident occurs as prediction markets face a period of increased scrutiny. <a href="https://www.cointribune.com/en/crypto-polymarket-and-kalshi-seek-to-expand-their-activity-to-derivatives/" rel="noopener noreferrer nofollow">Polymarket and its competitor Kalshi recorded a record April 2026</a>, and Polymarket claims over 100 million transactions to date. This visibility attracts regulators as much as attackers.</p>
<p>On the regulatory side, the CFTC recently took legal action against Kentucky, which is trying to apply its own rules to prediction markets by equating them with sports betting, a jurisdictional battle between federal authority and local legislators illustrating ongoing regulatory tensions around platforms like Polymarket and Kalshi.&nbsp;</p>
<p>The platform had also deployed Chainalysis monitoring tools to strengthen the integrity of its markets. This June hack adds operational security to an already long list of concerns.</p>
<p>This hack demonstrates <a href="https://www.cointribune.com/en/121-crypto-hacks-billions-evaporated-defi-faces-its-worst-year-since-2022/" rel="noopener noreferrer nofollow">a reality well-known to DeFi protocols</a> and exchanges: the robustness of smart contracts does not protect against flaws that settle upstream, in the visible layer. Polymarket handles the crisis with quick reimbursements, but trust in the security of web interfaces remains the sector’s weak link.</p>

Polymarket : An External Breach Costs the Platform 3 Million Dollars

Table of Contents

Cointribune EN

Other articles published on Jun 27, 2026

Join our free newsletter for daily crypto updates!