# Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained

- Severity: Critical · Status: Contained (past)
- Chains: Polygon, Ethereum · Method: Front-end and DNS hijacks
- Started: Jun 25, 2026 · Last update: Jul 1, 2026 · Reported stolen: $3.0M
- Who/what: Polymarket web app users

Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users.

## Am I affected?
If you used the Polymarket website around 25 June 2026 and approved a wallet prompt you didn't expect, check your pUSD balance and transaction history.

## What to do now
- Revoke unexpected token approvals on Polygon (revoke.cash or your wallet's approvals page).
- Wait for Polymarket's official refund contact; never share your seed phrase or keys with anyone claiming to be support.

## How to avoid this
- Even a genuine site can serve malicious code through a vendor. A trade should never ask you to approve an unknown spender or move your whole balance.
- Keep only your trading money in the wallet connected to the site.

## Sources
- Polymarket users lose estimated $3 million in front-end exploit (Unchained, 2026-06-26): https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/
- Month in Review: Top DeFi Hacks of June 2026 (Halborn, 2026-07-01): https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026

Full record: https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026 · JSON: https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.