Polymarket confirmed a frontend injection attack that allowed hackers to steal roughly $3 million in user assets, the platform’s second security failure in under two months. A compromised third-party provider was the entry point, according to the original report, which noted that fewer than 15 accounts were hit. The stolen funds were almost entirely in pUSD, the platform’s native stablecoin, and were later swapped for ETH on-chain. The attack was contained quickly once discovered.