Refund

Secret

Polymarket

Humanity

<p>Attackers exploited a third-party vendor compromise to inject malicious code into Polymarket’s frontend, triggering a phishing flow that ultimately drained funds from at least 11 user wallets, according to blockchain analyst Specter. Specter estimated the stolen amount at $2.94 million, citing activity linked to the compromised user interface.</p>
<p>Polymarket said it has contained the incident, removed the affected dependency, and will fully refund affected users. The case adds to a broader security trend flagged by DefiLlama, which reports that the quarter is now the most-hacked on record by incident count.</p>
<h2 id="key-takeaways">Key takeaways</h2>
<ul>
 <li>Specter attributed the Polymarket incident to a third-party vendor compromise that allowed malicious script injection into the platform’s frontend.</li>
 <li>The phishing mechanism reportedly led to an estimated $2.94 million drained from at least 11 Polymarket user wallets.</li>
 <li>Polymarket says containment is complete, the compromised dependency has been removed, and users will be fully refunded.</li>
 <li>DefiLlama data shows crypto security breaches in the second quarter hit a record pace, while June totals climbed to $74.9 million across 29 reported incidents.</li>
 <li>Across the last 30 days, DefiLlama reports private key compromises as the largest share of losses (43%), with “fake proof” exploits (10%) and reverse MEV honeypots (8%) following.</li>
</ul>
<h2 id="how-the-polymarket-frontend-compromise-unfolded">How the Polymarket frontend compromise unfolded</h2>
<p>According to Specter, the attackers leveraged a third-party vendor breach to slip malicious scripting into Polymarket’s website experience. Specter said the injected code appeared designed to support a phishing attack—meaning users could be induced to sign or approve actions that transferred funds instead of completing the intended transaction.</p>
<p>Specter’s analysis estimated the theft at roughly $2.94 million, impacting at least 11 Polymarket user wallets. The figure is based on observed drain activity associated with the phishing pattern described by Specter.</p>
<p>Polymarket responded publicly on X, stating that it identified and contained the compromise, removed the affected dependency, and confirmed that affected users would be fully refunded. <a href="https://sovrn.co/1h8llaz" rel="noopener noreferrer nofollow">Cointelegraph</a> sought further comment from Polymarket but did not receive a response before publication.</p>
<h2 id="june-exploit-losses-climb-still-below-april-s-peak">June exploit losses climb—still below April’s peak</h2>
<p>While the Polymarket case is a notable incident, it sits within a wider wave of exploit activity. DefiLlama data cited in the report shows crypto exploit losses in June reached $74.9 million across 29 reported incidents, a rise from May’s $60.5 million total.</p>
<p>Even with the month-over-month increase, June’s total remained far below April’s $644 million figure, underscoring how uneven the exploit landscape has been across the year. The same DefiLlama dataset also marks the second quarter as the most-hacked period on record by incident count, extending the high frequency of breaches reported so far.</p>
<h2 id="largest-june-incidents-highlight-recurring-bridge-and-exploit-risk">Largest June incidents highlight recurring bridge and exploit risk</h2>
<p>DefiLlama’s breakdown points to several major June events that drove losses higher. The largest reported incident in June was a $36 million Humanity Protocol exploit. Other large items included a $4.7 million Secret Network bridge exploit and two separate Aztec exploits valued at $2.1 million each.</p>
<p>The list also includes a $1.7 million bridge exploit on Taiko. Together, these events reinforce a familiar theme in crypto security reporting: cross-chain bridge systems and complex protocol integrations continue to concentrate losses when vulnerabilities are discovered or supply-chain components are compromised.</p>
<h2 id="attack-vectors-shift-private-key-compromises-lead-phishing-cases-remain-a-concern">Attack vectors shift: private key compromises lead, phishing cases remain a concern</h2>
<p>DefiLlama’s methodology breaks down the last 30 days of reported exploit losses by technique. Private key compromises accounted for 43% of losses, making them the most common category in the period. “Fake proof” exploits represented 10%, while reverse MEV honeypots made up 8% by the same breakdown.</p>
<p>The Polymarket incident is described differently from those categories in the underlying reporting: Specter framed it as a frontend injection leading to phishing, which in practice can overlap with user-level security failures rather than only on-chain vulnerabilities. Regardless of the taxonomy, the operational takeaway is similar—attackers increasingly combine supply-chain weaknesses with user-targeted deception to move funds.</p>
<p>The threat also has a local history on Polymarket. About a month earlier, the prediction market disclosed a separate $600,000 exploit tied to a six-year-old private key used for internal top-up operations. Josh Stevens, Polymarket’s vice president of engineering, said then that contracts and user funds were safe and that permissions tied to the key had been revoked, reflecting a response approach aimed at limiting exposure after discovery.</p>
<h2 id="what-to-watch-next-for-polymarket-users">What to watch next for Polymarket users</h2>
<p>With Polymarket stating it has removed the compromised dependency and will refund impacted users, the next signals to monitor are whether any residual scams continue via cached pages, third-party scripts, or follow-on attempts against user approvals. More broadly, investors and users should track whether the second-quarter record pace continues and whether DefiLlama’s technique breakdown shows phishing-style incidents rising alongside private key compromises.</p>
<p>This article was originally published as <a href="https://www.cryptobreaking.com/polymarket-sees-2-9m-theft/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Polymarket Sees $2.9M Theft, Refund Plan Approved for Users</a> on <a href="https://www.cryptobreaking.com/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Crypto Breaking News</a> – your trusted source for crypto news, Bitcoin news, and blockchain updates.</p>

Polymarket Sees $2.9M Theft, Refund Plan Approved for Users

Table of Contents

Crypto Breaking News

Other articles published on Jun 26, 2026

Join our free newsletter for daily crypto updates!