A massive cryptocurrency heist has shaken Polymarket, one of the world’s largest prediction markets, with hackers making off with an estimated $3 million in a sophisticated supply-chain attack. The incident highlights the increasing threat posed by these types of attacks, where malicious actors inject malware into trusted third-party software or services to gain access to sensitive systems.
Polymarket allows users to trade contracts based on collective estimates of various events’ outcomes, including sports, economic indicators, and even military conflicts. Founded in 2020, the platform has grown to become a significant player in the cryptocurrency market, valued at $9 billion and handling billions of dollars in trading volume. However, on this occasion, unsuspecting users were tricked into approving fraudulent transactions on the official Polymarket website after malicious JavaScript was injected through a frontend vendor.
In a supply-chain attack, hackers target a trusted third-party provider that supplies software or services to the main platform. This can be done by compromising a dependency or vendor’s server, allowing attackers to inject malware directly into the system. In this case, Polymarket’s own servers and backend infrastructure were not impacted, but users still suffered significant losses.
According to blockchain security firm PeckShield, the incident was a phishing campaign that stole approximately $3 million worth of ParyonUSD from users. The stolen funds were later swapped for 1,893 Ether on the Ethereum network. Independent analytics firm Bubblemaps estimates that less than 15 accounts were affected by the incident.
The attack is a stark reminder of the importance of thorough security testing and validation across all layers of an organization’s infrastructure. Supply-chain attacks can be particularly devastating because they often go undetected until it’s too late, as evidenced by Polymarket’s experience.
While Polymarket has pledged to fully reimburse customers who lost funds in the incident, this attack serves as a warning sign for other organizations to review their security protocols and ensure that all vendors and dependencies are thoroughly vetted. By doing so, companies can reduce the risk of falling victim to these types of attacks.
In practical terms, users and organizations alike should remain vigilant when it comes to supply-chain risks. Regularly test your systems and dependencies for vulnerabilities, and never underestimate the importance of thorough security testing and validation. Remember that a single weak link in the chain can have catastrophic consequences – as Polymarket’s customers have unfortunately discovered.
Source: Bleeping Computer — 2026-06-26