Polymarket frontend compromised, users warned off site
Security & Exploits ·
Reports of an active wallet-draining script on Polymarket's homepage prompted warnings for users to avoid the site entirely, with losses reported in the hundreds of thousands.
A post circulating on X urged people to stay away from the Polymarket website, stating the frontend was confirmed compromised and that an active drain was underway, per the original warning. The author said some users traced the issue to a script embedded on the site's homepage, and followed up with a second post reiterating that the site should not be opened at all. The warning also tagged a Polymarket-affiliated account directly in the thread, seeking acknowledgment of the issue.
The core risk centered on wallet connections and signing. Users were told not to connect a wallet or approve any transaction, including attempts to withdraw funds, since withdrawal flows were identified as the specific vector through which wallets were being drained. That guidance suggests the compromise was positioned to intercept legitimate-looking user actions rather than requiring a separate phishing link.
Corroborating accounts in the same period described multiple users reporting unauthorized fund transfers and stolen balances, with losses described in the hundreds of thousands, which pushed Polymarket into a cancel-only trading mode and a pause on relayer actions while the matter was investigated, as detailed by wublockchain.xyz. Separate reports in the cluster indicate Polymarket later confirmed a third-party provider breach was responsible for the drains and committed to full reimbursement for affected users, with the trading API subsequently restored.
Across the cluster, seven distinct sources tracked the incident, pointing to broad visibility of the event as it unfolded in near real time. The sequence moved from informal social-media warnings to an official acknowledgment of a third-party compromise and a reimbursement pledge, alongside operational steps like halting trading and pausing relayer functions.
Unresolved at this stage are the precise scope of affected wallets, the total amount drained, and the identity of the compromised third-party provider referenced in the official confirmation. It also remains unclear how long the malicious script was live on the homepage before detection, and whether reimbursement will cover all reported losses or only a verified subset. Further detail from Polymarket's investigation is expected to clarify these points.