Polygon
5 incidents, 1 live. 13 days since the last new one.
4 drains in the last 12 months
4 drains in the last 12 months
4 drains in 2026
1 drains in 2025
Live
-
Critical◐Partly contained
Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M
Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct.
Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers·Tron, Ethereum, BNB Chain, Polygon, Solana, Bitcoin·$102M stolen·Since Oct 9, 2026·
Past
June 2026 1
-
Critical✓Contained
Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained
Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users.
Polymarket web app users·Polygon, Ethereum·$3.0M stolen·Since Jun 25, 2026·
May 2026 1
-
Critical✕Still active
'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included
Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet.
Seed phrases made by some less widely used mobile software wallets (2018 onward)·Solana, Bitcoin, Ethereum, Polygon, Tron·$5.0M stolen·Since May 27, 2026·
January 2026 1
-
High✓Contained
Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds
Polycule, a Telegram bot for trading on Polymarket, confirmed on 13 Jan 2026 that it had been hacked and that about $230,000 of user funds held in bot-managed Polygon wallets was taken. The team took the bot offline and promised a patch and compensation; no official root cause was published, and some rivals called it a rug pull. Custodial Telegram bots keep users' private keys on their own servers, so one breach can drain every user at once. Keep only small trading balances in any bot wallet.
Polycule Telegram trading bot users (Polymarket, Polygon)·Polygon·$230K stolen·Since Jan 13, 2026·
May 2025 1
-
Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account
On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know.
Startup founders in Polygon's investment network·Multiple EVM chains·Since May 13, 2025·
No drains match these filters.