Polymarket suffers supply chain attack via compromised third-party JS vendor

Polymarket lost approximately $3.1 million after attackers compromised a third-party JavaScript vendor used by its frontend. Malicious script injected into the site prompted users to approve fraudulent wallet transactions, draining pUSD stablecoins from up to 15 wallets.

Heat

Confidence

95%

Evidence

Updated

2026-07-09 09:51 UTC

Why It Happened

The attacker exploited a supply chain weakness: the third-party JS vendor's code was not audited for security, allowing the injection of malicious logic that altered user wallet approval requests. Polymarket's smart contracts themselves were not breached.

Outcome So Far

Stolen funds (~$3.1M in pUSD) were swapped to 1,893 ETH, bridged from Polygon to Ethereum mainnet, and then laundered. No additional details on recovery or further actions have been confirmed.

Actors

PolymarketBet on the future, profit from truth.

Polymarket is the world’s largest prediction market, allowing you to stay informed and profit from your knowledge by betting on future events across various topics. Studies show prediction markets are often more accurate than pundits because they combine news, polls, and expert opinions into a single value that represents the market’s view of an event’s odds. Our markets reflect accurate, unbiased, and real-time probabilities for the events that matter most to you. Markets seek truth.

UNUnknown Attackerattacker

Timeline order

2026-06-29
Post

Parent event 01

X conversation update

1 related posts from @SlowMist_Team

Halborn warns about supply chain attack risks

Halborn Security tweets that smart contract audits do not protect against supply chain attacks, citing the Polymarket incident as a clear example.

X conversation update

3 related posts from @SlowMist_Team, @BullishTimes_, @HalbornSecurity

Related posts@SlowMist_Team@BullishTimes_@HalbornSecurity

@SlowMist_Team2026-06-30 09:26 UTC

Open on X11.2K views · 58 likes · 5 reposts

@BullishTimes_2026-06-30 08:47 UTC

Open on X290 views · 13 likes · 5 reposts

@HalbornSecurity2026-06-30 15:00 UTC

Open on X1.5K views · 2 likes · 4 reposts

2026-07-01
Post

Parent event 04

X conversation update

1 related posts from @SlowMist_Team

Polymarket hack disclosed

BullishTimes reports that Polymarket was drained for $3.1M via a compromised third-party JS vendor. The malicious script injected into the frontend caused users to approve unauthorized transfers. Funds were swapped to ETH and bridged to Ethereum mainnet.