What happened
Polymarket users lost approximately $3M after a compromised third-party vendor injected malicious code into the Polymarket frontend on June 25, 2026. Polymarket said it contained the incident and would refund affected users in full.
The incident was a frontend supply-chain compromise: a third-party dependency or vendor serving Polymarket's website was altered to inject transaction-draining JavaScript into the user-facing application.
How it happened
The vendor compromise allowed a malicious script to run for some Polymarket users. The script induced affected users to authorize transfers from wallets holding pUSD and other crypto assets; analysts estimated about $3M was stolen from a small number of users.
Protocol details
Funds Recovery
Recovered
$1
Net Loss
$3.0M
Evidence
- report @polymarkettrade incident report x.com
- analysis DeFiLlama defillama.com
- analysis TechCrunch — Polymarket says hackers stole users' funds techcrunch.com
- analysis Decrypt — Polymarket to refund users after website exploit decrypt.co
- analysis Monitoring Room — Polymarket International incident record monitoringroom.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
