Polymarket Promises Full Refunds Following $2.94 Million Phishing Attack

Blockchain analyst Specter identified the incident as a targeted phishing operation rather than a flaw in the protocol itself. The injected script prompted users to interact with a compromised interface, granting attackers direct access to connect wallets and drain assets. Victims saw their funds converted into ETH and funneled into a single consolidated address before the platform contained the breach.

This security failure marks the 89th crypto breach recorded in the second quarter, a record-breaking figure according to data from DefiLlama. While Polymarket asserts that its core smart contracts remain secure, this incident follows a $600,000 theft from the platform just one month prior, which was attributed to a compromised private key used for internal operations. With private key exploits accounting for 43% of losses across the industry this month, the platform faces increasing scrutiny over its third-party security management and operational safeguards.