Polymarket Drained of $2.65M in Frontend JavaScript Exploit
Key Summary
Polymarket lost $2.65M across 995 accounts after attackers injected malicious JavaScript through a third-party service provider. On-chain data shows the hacker converted stolen funds to POL tokens within sixty minutes.
Key Bullets
- Blockchain analyst Conor Grogan confirmed that exactly 995 user accounts were drained for a total loss of $2,654,211.42.
- The attacker converted all stolen capital into 28,600,000 POL tokens within a tight sixty-minute execution window.
- Polymarket management halted trading on the international platform and promised full financial restitution to all affected users.
- On-chain investigators tracked the wallet balance scaling from $412K to $2,680,000 between 17:05 UTC and 18:05 UTC.
Prediction Market Loses Millions to Exploit
Polymarket lost $2.65M from 995 user accounts Tuesday afternoon after an attacker compromised a third-party JavaScript component embedded in the frontend of the prediction market. On-chain data monitored by blockchain analyst Conor Grogan showed the single largest victim wallet dropped $341,000, while a second account lost $307,000 during the breach. Funds vanished instantly. Trading activity halted.
Independent investigator StarPlatinum tracked the rapid drain via public transaction logs on the network. An empty wallet began receiving funds at 17:05 UTC and accumulated $412,000 by 17:25 UTC. The balance spiked to $2.02M at 17:50 UTC before topping out at $2.68M just one hour after the first transaction. The attacker moved fast.
Stolen Assets Swapped Into POL Tokens
The attacker immediately converted all stolen capital into 28,600,000 POL tokens to evade potential asset freezes on centralized venues and token contracts. Public transaction logs confirm the swap happened directly on-chain while victims broadcasted emergency warnings across social media channels. One user posting on X claimed a personal loss of $800,000 alongside a peer losing $600,000 within the same timeframe.
Polymarket executives confirmed via public statements that the exploit originated from a compromised external vendor rather than internal protocol infrastructure. Platform engineers pulled the plug on trading operations immediately following the alert. Company representatives stated that every impacted account holder will receive full compensation from treasury reserves.
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.