Polymarket

<p>Polymarket has confirmed that attackers compromised a third party vendor and used the access to inject malicious code into the platform’s frontend, leading to a phishing attack that drained an estimated $2.94 million from users.</p>
<div id="cn-block-summary-block_ac3537d078c0762b5eacc3aaf5d21559" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Polymarket said a third party vendor compromise enabled a phishing attack that stole about $2.94 million from at least 11 user wallets.</li>
   <li>The platform removed the malicious dependency, contained the incident and said all affected users will receive full refunds.</li>
   <li>DefiLlama recorded the attack as the 89th crypto security breach of the second quarter, the highest quarterly total by incident count on its records.</li>
  </ul>
 </div>
</div>
<p>Polymarket disclosed on X that it has removed the affected dependency, contained the incident, and will fully reimburse affected users.&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We've contained it &amp; removed the affected dependency. We're contacting impacted users &amp; refunding them in full.</p>— Polymarket Traders (@PolymarketTrade) <a href="https://x.com/PolymarketTrade/status/2070155882906730671?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 25, 2026</a>
  </blockquote>
 </div>
</figure>
<p>Blockchain analyst Specter estimated that the attack drained funds from at least 11 wallets after the malicious script appeared on the platform’s frontend.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>It appears there may be a phishing attack targeting Polymarket users, with estimated losses of $2.94M so far.<br><br>The attacker has drained funds from 11+ victim wallets holding PUSD, swapped the stolen assets for ETH, and consolidated the proceeds into the following address:… <a href="https://t.co/6WfS0JhdDG" rel="noopener noreferrer nofollow">pic.twitter.com/6WfS0JhdDG</a></p>— Specter (@SpecterAnalyst) <a href="https://x.com/SpecterAnalyst/status/2070152064051605517?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 25, 2026</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="frontend-compromise-targets-user-wallets">Frontend compromise targets user wallets</h2>
<p>Specter identified the attack as a phishing campaign rather than a protocol exploit. The analyst said the injected script enabled attackers to steal funds from connected wallets after users interacted with the compromised interface.</p>
<p>You might also like: <a href="https://crypto.news/bitcoin-price-analysis-btc-bulls-fight-to-defend-60k-after-liquidation-wipeout/" rel="noopener noreferrer nofollow"> Bitcoin price analysis: BTC bulls fight to defend $60K after liquidation wipeout </a></p>
<p>DefiLlama <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">recorded</a> the incident as the 89th reported crypto security breach of the second quarter, making it the highest quarterly total by incident count in the platform’s records.</p>
<p>DefiLlama also reported $74.9 million in losses across 29 crypto exploits during June. That total exceeded May’s $60.5 million but remained well below April’s $644 million.</p>
<p>The platform listed the $36 million <a href="https://crypto.news/humanity-protocol-blames-north-korea-linked-hackers-for-36m-theft/" rel="noopener noreferrer nofollow">Humanity Protocol exploit</a> as June’s largest attack. Other major incidents included a $4.7 million <a href="https://crypto.news/axelar-shuts-down-secret-network-bridge-routes-after-4-7m-exploit/" rel="noopener noreferrer nofollow">exploit</a> involving the Secret Network bridge, two separate $2.1 million exploits affecting <a href="https://crypto.news/aztec-probes-2m-transfer-from-old-payments-product/" rel="noopener noreferrer nofollow">Aztec</a>, and a $1.7 million bridge <a href="https://crypto.news/taiko-warns-users-to-exit-bridges-after-1m-vault-exploit/" rel="noopener noreferrer nofollow">exploit</a> on Taiko.</p>
<p>DefiLlama reported that private key compromises accounted for 43% of exploit losses over the past 30 days. Fake proof exploits represented 10% of losses, while reverse MEV honeypots accounted for 8%.</p>
<h2 class="wp-block-heading" id="previous-exploit-traced-to-compromised-private-key">Previous exploit traced to compromised private key</h2>
<p>Polymarket <a href="https://crypto.news/polymarket-hit-zachxbt-flags-520k-uma-adapter-loss/" rel="noopener noreferrer nofollow">disclosed</a> a separate security incident about a month earlier after attackers exploited a six year old private key used for internal top up operations and stole about $600,000.</p>
<p>Security researchers, including ZachXBT, PeckShield, and Bubblemaps, initially flagged suspicious activity involving Polymarket’s UMA CTF Adapter contract on Polygon. Bubblemaps reported that attackers withdrew 5,000 POL every 30 seconds before estimating total losses at roughly $600,000.</p>
<p>Polymarket protocol contributor Shantikiran Chanal later attributed that incident to a compromised wallet used for internal operations rather than a vulnerability in the platform’s contracts or core infrastructure.&nbsp;</p>
<p>Josh Stevens, the company’s vice president of engineering, stated at the time that user funds and smart contracts remained secure and that all permissions linked to the compromised key had been revoked.</p>
<p>Read more: <a href="https://crypto.news/south-korea-revises-debt-relief-rules-to-include-crypto-assets/" rel="noopener noreferrer nofollow"> South Korea revises debt relief rules to include crypto assets </a></p>

Polymarket to refund users after $2.94M frontend phishing attack

Table of Contents

crypto.news

Other articles published on Jun 26, 2026

Join our free newsletter for daily crypto updates!