Polymarket Hack Exposes 700 Users to $2.7M Loss
Polymarket says a breach at a third-party service provider led to unauthorised transfers affecting about 700 users. Blockchain analysts estimate roughly $2.7 million in crypto assets was moved; a broader estimate that includes positions still on the platform puts the affected value at about $3.46 million.
The suspected attack used malicious JavaScript embedded through a compromised third-party service to abuse logged-in trading sessions and sell users’ prediction-market positions. Polymarket said its smart contracts were not exploited. The platform temporarily restricted trading for about an hour, fixed the issue and restored service. It has promised full compensation, but has not announced a payment timeline or final list of affected users.
The incident follows a separate third-party security breach in June that reportedly caused about $3 million in losses. The repeat raises questions about Polymarket’s vendor security and trading-permission controls.
Bearish
The immediate impact is bearish for confidence in Polymarket and prediction-market platforms, rather than a direct signal for the wider crypto market. The reported use of malicious website code to exploit logged-in trading sessions shows that risks can extend beyond smart-contract vulnerabilities and private-key theft. Traders may withdraw funds, reduce exposure or demand stronger security controls until Polymarket clarifies the affected accounts and completes compensation.
The platform restored trading after about an hour and promised full reimbursement, which may limit prolonged disruption if it follows through. However, this is reportedly the second third-party security incident this year, following losses of about $3 million in June. Repeated breaches can weigh on user growth and platform activity over the longer term, particularly if vendor oversight and transaction permissions are not strengthened. The article does not indicate a broad protocol failure or market-wide contagion, so effects on major crypto assets may remain limited. Traders should watch for compensation updates, withdrawals, platform volumes and any evidence of further unauthorised transactions.