Polymarket suffered a vulnerability attack from a third-party vendor, leading to the theft of approximately $3 million, and the platform has pledged full compensation.

Prediction market platform Polymarket disclosed on Thursday that a third-party vendor of its was hacked, with attackers injecting malicious code into the platform’s frontend to steal roughly $3 million in Polymarket’s proprietary stablecoin pUSD from fewer than 15 user accounts. The funds were later converted to ETH and aggregated into a single Ethereum wallet, and as of press time, the assets have not been moved. Polymarket noted that the frontend vulnerability has been identified and patched, with affected users to receive full compensation, though the platform declined to name the specific compromised vendor. This marks Polymarket’s second security incident in two months. Last month, hackers exploited a private key leak to breach an internal wallet used for user deposits and reward distributions, leading to approximately $700,000 in losses. Both incidents were peripheral breaches that did not impact the core protocol, but the consecutive security lapses underscore the potential risks stemming from the platform’s reliance on third-party vendors. Polymarket had recently faced controversy over a Wall Street Journal investigation that alleged it illegally marketed to U.S. users through simulated trades and fake profit videos; the latest security incident has added further pressure on the platform.