A massive security breach has reportedly seen nearly 1,000 accounts on the crypto-based prediction market Polymarket drained, with the attack leading to losses of more than $2.6M.
Blockchain analyst Conor Grogan revealed that a total of 995 accounts were hit by the attack, resulting in losses of roughly $2.65 million.
The two biggest losses detected by Grogan were $341K and $307K.
Moreover, the analyst also revealed that the attacker has converted all stolen funds into Polygon's native token (POL). This move might have been made to avoid having the funds frozen.
"If you are a @Polymarket user lock your account. I just got drained $800,000," a trader warned via X.
The trader also claimed that a friend lost another $600K and warned users not to interact with the website.
How did the attack happen?
As noted by blockchain investigator StarPlatinum, the attacker stole roughly $2.68M in just one hour.
The data shows that at about 17:05 UTC, an empty wallet began receiving funds.
At 17:25 UTC, the wallet had amassed roughly $412K.
However, the figure jumped to $2.02M at 17:50 UTC and reached roughly $2.68M at 18:05 UTC.
In total, the attacker has amassed some 28.6M POL tokens, as noted.
So far, it appears that the attack might have occurred due to a hack of a third-party JavaScript component that was embedded in the Polymarket website.
Another massive Polymarket hack
It's not the first time that the popular prediction market has faced a massive hack leading to a multimillion-dollar security breach.
In June, Polymarket also faced a similar hack. The attack happened when hackers compromised a third-party vendor and injected malicious JavaScript into the frontend of Polymarket.
In total, some $2.94 million was stolen from at least 11 wallets.
Polymarket reacts to a massive hack
Now, Polymarket has reportedly confirmed that the security breach occurred due to a hack of a third-party service provider.
The company also vowed to make every affected user whole. In other words, users who suffered losses due to the attack will be compensated.
Arman Shirinyan
Dan Burgin
