Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained
Polymarket web app users
Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users.
Why this severity: $3.0M reported stolen.
- Started
- Jun 25, 2026
- Closed
- Jul 1, 2026
- Reported stolen
- $3.0M
At risk
- Polymarket web app users
- Polygon wallets
- Ethereum wallets
What to do now
- Revoke unexpected token approvals on Polygon (revoke.cash or your wallet's approvals page).
- Wait for Polymarket's official refund contact; never share your seed phrase or keys with anyone claiming to be support.
Stay safe
Am I affected?
If you used the Polymarket website around 25 June 2026 and approved a wallet prompt you didn't expect, check your pUSD balance and transaction history.
What to do now
- Revoke unexpected token approvals on Polygon (revoke.cash or your wallet's approvals page).
- Wait for Polymarket's official refund contact; never share your seed phrase or keys with anyone claiming to be support.
How to avoid this
- Even a genuine site can serve malicious code through a vendor. A trade should never ask you to approve an unknown spender or move your whole balance.
- Keep only your trading money in the wallet connected to the site.
Timeline 3
Halborn's June review listed the vendor-driven front-end attack at about $3M stolen from site visitors.
SourceBubblemaps estimated about $3M stolen from fewer than 15 users; PeckShield said victims' pUSD was drained and the funds were converted to ETH.
SourcePolymarket said a third-party vendor was compromised and malicious code was injected into its website; it removed the code, patched the issue and promised full refunds.
Source
News & write-ups ›2
How this method works
The real website of a dapp you trust is taken over (DNS, hosting or a script it loads) and starts serving a drainer. Read about front-end and dns hijacks →
Follow new drains and updates in your feed reader or Telegram RSS bot.