The major prediction market platform Polymarket has acknowledged that hackers have taken funds from an undisclosed number of users following a breach involving a third-party.

In a post on X on Thursday, Polymarket mentioned that a vulnerability at a third-party vendor enabled hackers to insert harmful code into its site “for some users.” The firm stated it has “contained” the situation and is now reaching out to the impacted individuals and “fully refunding” them.

As of Thursday afternoon, the exact details of the incident remain uncertain. 

When contacted by TechCrunch, Polymarket representative Connor Brandi verified that the breach resulted in the theft of users’ funds but refrained from sharing further details and did not answer specific inquiries regarding the event.

Around the same time as Polymarket’s announcement, the blockchain analytics firm PeckShield noted on X that a phishing campaign was aimed at Polymarket users. PeckShield reported that hackers had taken approximately $3 million in cryptocurrency. 

Additionally, a blockchain analyst reported comparable losses, asserting that the funds were misappropriated from more than 11 victims. 

Polymarket provides users the option to receive payments in cryptocurrency. 

In recent days, two individuals on social media alleged that their funds on Polymarket had been taken.

This breach marks yet another setback for a company already facing negative press this week. On Sunday, an investigation unveiled that Polymarket had compensated online creators to share misleading videos depicting them winning substantial bets that were actually fabricated. In response, the company stated it would review its advertising materials.