{
 "slug": "polymarket-frontend-vendor-compromise-jun-2026",
 "title": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
 "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026",
 "json": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "polygon",
  "ethereum"
 ],
 "method": "front-end-hijack",
 "product": "Polymarket web app users",
 "tags": [
  "polygon",
  "ethereum",
  "front-end-hijack",
  "polymarket",
  "supply-chain",
  "third-party-vendor",
  "injected-script",
  "pusd",
  "prediction-market"
 ],
 "amountUsd": 3000000,
 "victims": null,
 "startedAt": "2026-06-25",
 "closedAt": "2026-07-01",
 "updatedAt": "2026-07-01T12:00:00Z",
 "summary": "Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users.",
 "timeline": [
  {
   "date": "2026-06-25",
   "title": "Polymarket said a third-party vendor was compromised and malicious code was injected into its website; it removed the code, patched the issue and promised full refunds.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/"
  },
  {
   "date": "2026-06-26",
   "title": "Bubblemaps estimated about $3M stolen from fewer than 15 users; PeckShield said victims' pUSD was drained and the funds were converted to ETH.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/"
  },
  {
   "date": "2026-07-01",
   "title": "Halborn's June review listed the vendor-driven front-end attack at about $3M stolen from site visitors.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Polymarket users lose estimated $3 million in front-end exploit",
   "url": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "publisher": "Unchained",
   "date": "2026-06-26"
  },
  {
   "kind": "writeup",
   "title": "Month in Review: Top DeFi Hacks of June 2026",
   "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026",
   "publisher": "Halborn",
   "date": "2026-07-01"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you used the Polymarket website around 25 June 2026 and approved a wallet prompt you didn't expect, check your pUSD balance and transaction history.\n\n## What to do now\n- Revoke unexpected token approvals on Polygon (revoke.cash or your wallet's approvals page).\n- Wait for Polymarket's official refund contact; never share your seed phrase or keys with anyone claiming to be support.\n\n## How to avoid this\n- Even a genuine site can serve malicious code through a vendor. A trade should never ask you to approve an unknown spender or move your whole balance.\n- Keep only your trading money in the wallet connected to the site.",
 "notes": null,
 "agentBrief": "# Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained\n\n- Severity: Critical · Status: Contained (past)\n- Chains: Polygon, Ethereum · Method: Front-end and DNS hijacks\n- Started: Jun 25, 2026 · Last update: Jul 1, 2026 · Reported stolen: $3.0M\n- Who/what: Polymarket web app users\n\nPolymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users.\n\n## Am I affected?\nIf you used the Polymarket website around 25 June 2026 and approved a wallet prompt you didn't expect, check your pUSD balance and transaction history.\n\n## What to do now\n- Revoke unexpected token approvals on Polygon (revoke.cash or your wallet's approvals page).\n- Wait for Polymarket's official refund contact; never share your seed phrase or keys with anyone claiming to be support.\n\n## How to avoid this\n- Even a genuine site can serve malicious code through a vendor. A trade should never ask you to approve an unknown spender or move your whole balance.\n- Keep only your trading money in the wallet connected to the site.\n\n## Sources\n- Polymarket users lose estimated $3 million in front-end exploit (Unchained, 2026-06-26): https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/\n- Month in Review: Top DeFi Hacks of June 2026 (Halborn, 2026-07-01): https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026\n\nFull record: https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026 · JSON: https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}