Polymarket Hit by a Double Whammy of "Outflows" and "Allegations"

Polymarket, a leading decentralized prediction market, suffered a security breach resulting in the loss of approximately $3 million (480 million yen) in crypto assets. The incident was caused by a third-party vendor compromise that allowed malicious code to be embedded into the platform's front-end.

Although the company immediately pledged to fully reimburse affected users, this marks the second consecutive month it has fallen victim to a security incident. Compounding these issues, reports from The Wall Street Journal have brought to light allegations of deceptive marketing practices—specifically the use of videos depicting "fake trades"—and suspicions regarding unusually high win rates among certain insiders. With the U.S. Commodity Futures Trading Commission (CFTC) tightening regulatory scrutiny and competitors gaining ground, the company faces an extremely critical situation.

Polymarket has long championed a transparent market model built on blockchain smart contracts, designed to operate without a centralized authority. However, the interfaces users actually interact with—such as the front-end and APIs—are fundamentally "Web2-style" systems.

No matter how robust the back-end infrastructure may be, if an external vendor's system serving as an entry point is compromised, user assets can easily be stolen. This highlights a fundamental challenge: even when a system is decentralized, the pursuit of user convenience can inadvertently create single points of failure.