Polymarket Hacked for $3 Million: Hackers Attacked via the Website

The prediction platform Polymarket has officially admitted — they were hacked. Hackers stole about $3 million from user wallets. They did not breach the smart contracts or the platform\'s internal security — a malicious JavaScript script was injected directly into the code of the official website. 

The theft mechanics worked as follows: 

• a user visits the official Polymarket website;

• along with the normal page, a malicious script loads into their browser;

• the script silently launches a wallet drainer — a program designed to empty crypto from the wallet; 

• a window opens asking to sign a transaction, but under the guise of standard actions, they are presented with a request to transfer funds to the hackers; 

• the person clicks "Confirm" and all tokens fly away.

In other words, the victims signed the transfer of their own funds to the scammers themselves, thinking they were performing standard actions on the platform. 

PeckShield analysts found out that the hackers did not scatter their efforts on small balances. They targeted precisely — looking for large wallets. As a result, they emptied just 11 addresses but took 3 million dollars. 

What Polymarket Did

The company reacted quickly:

• Cut out the malicious code — disabled the integration with the compromised third-party vendor.

• Launched a full audit — checking all external libraries and integrations on the website.

• Promised compensations — management officially stated that they will return all funds to the affected victims from reserve funds.

Polymarket got off relatively easy — 11 victims, 3 million in damages, promises of compensation. But the very fact of the attack shows: even top crypto platforms are vulnerable through standard web components. And until developers learn to better control third-party dependencies, such incidents will keep repeating.