Polymarket issues refund to customers following $3m hack

A Polymarket third-party vendor was the victim of a cyberattack on June 25, leading to a refund of approximately $3m to users affected by the hack, with all issues now “contained and removed” according to the operator. 

Polymarket addressed the hack, having said, “This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. 

“We've contained it & removed the affected dependency. We're contacting impacted users & refunding them in full.”

While the operator has begun the process of returning the multi-million-dollar sum, less than 15 accounts were reportedly affected by the attack. Attackers seem to have taken funds from wallets which contained pUSD, a Polymarket-specific stablecoin used to facilitate trading. 

The hackers then converted the stolen funds into ETH and compiled them into an Ethereum wallet where they currently remain. 

The June 25 attack represents the second to be reported by Polymarket within the last month, following a hack which cost the operator nearly $700,000 and was most likely the cause of a private key compromise. 

On June 23 as well, Polymarket was accused of paying influencers to promote fake trades and fabricate winnings as part of marketing efforts conducted across the US, potentially leading to regulatory ramifications.

The Commodity Futures Trading Commission has yet to comment on the matter, but a Polymarket spokesperson confirmed the operator has started conducting a “comprehensive audit of active promotional content to ensure it complies with our standards, as well as applicable regulatory and legal disclosure requirements."

Polymarket’s recent issues are particularly noteworthy as Kalshi announced intentions to introduce an IPO by late 2027 or early 2028, following a recent Series F funding round which valued the operator at approximately $22bn.