Polymarket Users Lose $3.1M in a Frontend Supply-Chain Attack

Polymarket revised the amount stolen from its users in a June 25 attack on its website up to $3.1 million on June 27, above the $2.9 million to $3 million first estimated. The money was taken from 11 user wallets and all of it was PUSD, the dollar-denominated token the prediction market uses to settle positions, with fewer than 15 accounts affected in total. Polymarket's contracts and its markets were not involved. The theft ran through the platform's frontend — the code a browser downloads and runs when a user opens the site — after a compromised third-party vendor began serving malicious JavaScript to some visitors through a script the site loads, CoinDesk reported. Polymarket removed the code and pledged full reimbursement to affected PUSD holders.

The Mechanism: A Genuine Site Serving a Vendor's Compromised Script

A supply-chain attack on a frontend does not require the attacker to break into the target at all. The site was Polymarket's own, at the correct address, and users reached it exactly as they always had; nothing about the page was a copy or a lookalike. What changed was one of the ingredients. Web applications of this kind assemble their pages partly from code supplied by outside vendors — analytics, error monitoring, support widgets and similar tooling — and each of those scripts runs inside the page with the same privileges as the site's own code, able to see what the user sees and to change what the page does next. Compromise the vendor and the malicious code is delivered by the legitimate site to everyone who loads it.

That is what makes the class of attack hard for an individual to defend against. The usual advice for avoiding a drained wallet — check the domain, do not follow links from social media, use a bookmark — assumes the danger arrives from somewhere the user can inspect. Here it arrived from inside the product, the same structural weakness behind a wallet drained through something its owner had already trusted, in that case the standing token approvals that emptied the jaredfromsubway.eth trading bot of $7.5 million days earlier.

The Money: Bridged to Ethereum and Consolidated Into 1,893 ETH

The stolen PUSD did not stay where it was taken. It was moved from Polygon, the network on which the drained wallets held it, across a bridge to Ethereum — a bridge being the mechanism that locks a token on one chain and issues a claim on it on another — and there converted into roughly 1,893 ETH and consolidated into a single wallet. Consolidation is routine at this stage of a theft, since a thief who intends to move funds onward has to gather them first, and it is also the point at which a total becomes countable. That is the plainest reading of the revision: the figure rose to $3.1 million once the flows had been traced, not because more accounts were found.

The Response: Full Reimbursement, an Unnamed Vendor, an Open CFTC Matter

Polymarket stripped the malicious code out of its frontend and committed to making affected PUSD holders whole, a promise made easier by the small number of victims. The company has not identified the vendor whose script was compromised, and it has not said how long that code was live before it was found — a figure known in incident response as dwell time, and the one that determines how many users were exposed rather than how many lost funds. Both omissions matter to other operators, since a compromised supplier rarely serves only one customer. Separately, the Commodity Futures Trading Commission has an ongoing investigation into Polymarket, a regulatory matter that remains open.

What Is Unresolved: The Code Nobody Audits

The incident closes out a month in which the largest losses came from operational failures rather than flaws in contract code, the starkest being Humanity Protocol's drain on June 9 after multisig keys meant for four separate people were backed up to a single machine. PeckShield counted $75.87 million stolen across 40 incidents in June, down 7.13% from May's $81.7 million. The question the Polymarket case leaves open is one of inventory: which third-party scripts a production site loads, what each is permitted to do inside the page, and who checks that the supplier's own systems have not been taken over. None of that is settled by auditing a contract, and none of it was visible to the 11 wallet holders who lost money.