Polymarket customer suffers $3 million loss in supply chain attack.

Polymarket, a company that provides prediction market services, has announced that some customers suffered losses due to malicious JavaScript being inserted into its website. Polymarket says it will fully compensate its customers.

This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We've contained it & removed the affected dependency. We're contacting impacted users & refunding them in full.

— Polymarket Traders (@PolymarketTrade) June 25, 2026

Polymarket customers lose $3 million in supply-chain attack
https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/

According to Polymarket, a third-party vendor was compromised, and malicious scripts were injected into the frontend for some users. Polymarket confirmed the issue and removed the affected dependencies, resolving the problem.

Polymarket has not disclosed details, but experts are estimating the amount of damage based on the movement of money.

According to blockchain analytics firm PeckShield, there is evidence that approximately $3 million worth of Polymarket USD (tokens) were stolen from Polymarket and exchanged for Ethereum (cryptocurrency). PeckShield has determined that this incident is a phishing scam.

#PeckShieldAlert Specter has reported that a #phishing campaign appears to be targeting #Polymarket users, with ~$3M worth of $PUSD drained.

The attacker bridged the stolen funds from #Polygon to #Ethereum and swapped them into ~1,893 $ETH . pic.twitter.com/Li4nZY1me4

— PeckShieldAlert (@PeckShieldAlert) June 25, 2026

Data analytics firm Bubblemaps reports that fewer than 15 accounts were affected by this incident.

Great response by @Polymarket 👏

We counted:

• <15 accounts affected
• $3M in losses (being refunded)

The damage was largely contained https://t.co/vu8dGtM5je pic.twitter.com/oCNCbcCH9E

— Bubblemaps (@bubblemaps) June 25, 2026

Polymarket's own servers and backend infrastructure were not affected by this incident.