Polymarket Hit by $2.7 Million Loss Following Vendor Script Breach

Decentralised prediction market Polymarket has suffered a security breach resulting in the unauthorised withdrawal of approximately $2.7 million. According to initial reports, the compromise was executed via a malicious third-party vendor script, highlighting the vulnerability of platform front-ends to supply-chain intrusions.

The breach marks the second substantial security incident experienced by the venue during 2026. Vendor script compromises typically occur when attackers gain control over external software tools, analytics trackers, or content delivery networks embedded into a platform's website. Once altered, the rogue code can manipulate user sessions, alter transaction destinations, or deceive traders into signing malicious wallet approvals.

Prediction platforms such as Polymarket allow users to buy and sell outcome-based contracts on political, financial, and cultural events. While the underlying smart contracts governing such event markets may remain mathematically sound on the blockchain, the web interfaces through which users connect their digital wallets remain susceptible to classic front-end vulnerabilities.

The loss of $2.7 million highlights persistent operational hurdles for decentralised trading venues as they handle increasingly large trading volumes. Maintaining rigorous oversight of third-party software components is vital in non-custodial environments, where transactions are irreversible once confirmed on the network. Comprehensive details regarding potential user reimbursements, the specific software vendor involved, and updated security measures across the platform are expected as investigations proceed.