# Front-end and DNS hijacks · Drain Watch

4 incidents, 0 live. JSON: https://drains.watch/t/front-end-hijack.json · RSS: https://drains.watch/t/front-end-hijack/feed.xml

- [Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained](https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026) (closed, Critical, Contained, since Jun 25, 2026)
- [CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals](https://drains.watch/i/cow-swap-dns-hijack-apr-2026) (closed, Critical, Contained, since Apr 14, 2026)
- [Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt](https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026) (closed, High, Partly contained, since Mar 11, 2026)
- [Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer](https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025) (closed, Critical, Contained, since Nov 21, 2025)