Polymarket hacked: $3.1 million gone
•
4 Jul 2026 •
Reading time: 3 minutes
A cyberattack has hit Polymarket, an online prediction platform, resulting in an estimated loss of $3.1 million in cryptocurrencies for several users. The company states that the incident stemmed from a compromised external software provider and not from a flaw in its internal infrastructure.
Attack revealed by suspicious transactions
Several users reported unusual transactions, followed by the disappearance of funds from their cryptocurrency wallets. These reports gradually revealed a cyberattack targeting the interface used by Polymarket visitors.
According to CertiK, a security firm specialising in blockchain technology, eleven accounts are believed to have been directly affected by the attack. The total losses are estimated at $3.1 million in cryptocurrencies. Following the theft, the funds are believed to have been distributed across several digital wallets, a method that makes them more difficult to trace. This type of dispersal does not necessarily erase the trail, but it complicates the work of identification and recovery.
An external provider at the centre of the incident
Polymarket stated on the social media platform X that the attack did not stem from a vulnerability in its smart contracts, nor from a breach of its infrastructure. According to the platform, an external software provider had been hacked. This breach reportedly allowed malicious code to be injected into the site’s public interface.
In practical terms, users were reportedly exposed to a tampered page capable of tricking them into approving dangerous transactions without realising it. By authorising these transactions, they allegedly gave the hackers access to their cryptocurrency wallets.
The incident is described as a supply chain attack. This method involves not targeting the end platform directly, but compromising a supplier or tool used by it. Once this supplier has been compromised, the hackers can target users of the platform in question without needing to breach its main defences.
However, the fact that the attack originated from an external supplier does not negate the financial impact suffered by the victims, nor does it dispel concerns about the overall security of the platform’s service.
Following the discovery of the attack, Polymarket states that it has removed the malware. The platform also states that it has implemented additional security measures in the wake of the incident. It further confirms that it is in contact with the affected users.
A ban in Belgium
In Belgium, the platform is banned because it does not hold a licence issued by the Gaming Commission. This lack of authorisation means that Polymarket is not permitted to legally offer its services to Belgian players.
The company behind Polymarket had also been issued with a penalty payment by the Dutch regulator, on the grounds that players based in the Netherlands were still able to place bets on the platform.