Prediction market giant Polymarket was hit by a cyberattack and the company confirmed the theft of user funds: here's what we know

The Polymarket prediction platform was hacked via a compromised third-party vendor dependency, injecting malicious scripts into its interface.
Around $3 million in cryptocurrency stolen from ~11 users, according to PeckShield; Polymarket reimburses victims in full and eliminates the affected dependency
Community reactions to X were critical, with some blaming previous “mocking hackers”; One victim speculated that the breach may have involved the Xorek Cloud VPS

Polymarket, a prediction platform where people trade on the probability of different real-world events, was hacked and allegedly lost around $3 million in user funds. The company now fully reimburses victims.

In a short post published on X earlier this week, Polymarket confirmed the news and said it discovered that a third-party vendor had been compromised. Through that compromise, the attackers injected a malicious script “into our interface for some users.”

Polymarket has since said it contained the incident and removed the affected agency, but did not say which agency it was. It did not say which third-party vendor was compromised. Additionally, it said it is currently contacting affected users and refunding them in full, but did not indicate how many people were affected or how much money is at stake.

Context-dependent vulnerabilities

This morning we discovered that a third-party vendor had been compromised, injecting a malicious script into our interface for some users. We have contained it and removed the affected dependency. We will contact affected users and refund the full amount.June 25, 2026

In its article, TechCrunch cited blockchain monitoring company PeckShield, which claims that around $3 million in cryptocurrency was stolen in the attack. The publication also reported that around 11 people were affected. Polymarket allows its users to receive payments in cryptocurrencies.

The X users who left comments on Polymarket’s ad don’t seem at all surprised by the violation. “I spent weeks telling you this and you ignored it,” one person said. “Next time I find a vulnerability, I’ll sell it to criminal gangs.” Three users suggested that Polymarket deserved what had happened for “mocking hackers” in the past. One made a sly joke saying, “How did you not predict this?”

Polymarket did not say which third-party provider was compromised, but one of the users who lost funds in this attack speculates that it occurred through the Xorek Cloud VPS:

“I recently purchased a VPS from Xorek Cloud and stored my private key on it,” they said on X. “I’m not sure how the compromise occurred, but that’s the only possible security risk I can think of.”