A third-party vendor has been compromised, and some Polymarket users have lost money to hackers, according to a tweet from the betting site. The company has not confirmed how much was lost, though independent monitors on X suggest it could be around $3 million. “This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We’ve contained it & removed the affected dependency,” Polymarket wrote on X. “We’re contacting impacted users & refunding them in full.” One X account that claimed there were about “$3 million in losses” saw a response from Polymarket’s head of experience, William LeGate, who tweeted: “We are refunding affected users in whole, there are no user ‘losses’.” And while that’s not exactly confirmation that it’s $3 million, it’s hard not to conclude the amount lost to hackers was in the millions.
LeGate responded to another X account that tweeted about the hackers, saying “estimated losses of $2.94M so far.” That account, which monitors blockchain transactions, claims there are at least 11 victims who had PUSD, Polymarket’s stablecoin, drained from their wallets. That was then swapped for Ethereum to launder the crypto, according to the account, which provided wallet addresses for the allegedly stolen funds.
