{
 "tag": "polygon",
 "name": "Polygon",
 "group": "Chains",
 "incidents": [
  {
   "slug": "ledger-cryptobilis-tampered-hardware-wallets",
   "title": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets",
   "json": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin"
   ],
   "method": "supply-chain",
   "product": "Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers",
   "tags": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin",
    "supply-chain",
    "ledger",
    "hardware-wallet",
    "cryptobilis",
    "reseller",
    "hardware-implant",
    "seed-phrase-theft",
    "tether-freeze"
   ],
   "amountUsd": 102000000,
   "victims": 324,
   "startedAt": "2026-10-09",
   "closedAt": null,
   "updatedAt": "2026-10-16T12:00:00Z",
   "summary": "Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct."
  },
  {
   "slug": "polymarket-frontend-vendor-compromise-jun-2026",
   "title": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026",
   "json": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "polygon",
    "ethereum"
   ],
   "method": "front-end-hijack",
   "product": "Polymarket web app users",
   "tags": [
    "polygon",
    "ethereum",
    "front-end-hijack",
    "polymarket",
    "supply-chain",
    "third-party-vendor",
    "injected-script",
    "pusd",
    "prediction-market"
   ],
   "amountUsd": 3000000,
   "victims": null,
   "startedAt": "2026-06-25",
   "closedAt": "2026-07-01",
   "updatedAt": "2026-07-01T12:00:00Z",
   "summary": "Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users."
  },
  {
   "slug": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "title": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026",
   "json": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana",
    "bitcoin",
    "ethereum",
    "polygon",
    "tron"
   ],
   "method": "key-leak",
   "product": "Seed phrases made by some less widely used mobile software wallets (2018 onward)",
   "tags": [
    "solana",
    "bitcoin",
    "ethereum",
    "polygon",
    "tron",
    "key-leak",
    "weak-randomness",
    "prng",
    "seed-phrase",
    "mobile-wallet",
    "coinspect",
    "ill-bloom"
   ],
   "amountUsd": 5000000,
   "victims": 431,
   "startedAt": "2026-05-27",
   "closedAt": "2026-07-06",
   "updatedAt": "2026-07-06T12:00:00Z",
   "summary": "Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet."
  },
  {
   "slug": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "title": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026",
   "json": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "polygon"
   ],
   "method": "key-leak",
   "product": "Polycule Telegram trading bot users (Polymarket, Polygon)",
   "tags": [
    "polygon",
    "key-leak",
    "polycule",
    "polymarket",
    "telegram-bot",
    "custodial-bot",
    "trading-bot"
   ],
   "amountUsd": 230000,
   "victims": null,
   "startedAt": "2026-01-13",
   "closedAt": "2026-01-14",
   "updatedAt": "2026-01-14T12:00:00Z",
   "summary": "Polycule, a Telegram bot for trading on Polymarket, confirmed on 13 Jan 2026 that it had been hacked and that about $230,000 of user funds held in bot-managed Polygon wallets was taken. The team took the bot offline and promised a patch and compensation; no official root cause was published, and some rivals called it a rug pull. Custodial Telegram bots keep users' private keys on their own servers, so one breach can drain every user at once. Keep only small trading balances in any bot wallet."
  },
  {
   "slug": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "title": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025",
   "json": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Nailwal said the calls showed AI-generated videos of him, the Polygon Ventures lead and a supposed team member, used to get targets to install malware."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Startup founders in Polygon's investment network",
   "tags": [
    "multi-evm",
    "social-engineering",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "polygon",
    "malware",
    "founders",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-05-13",
   "closedAt": "2025-05-14",
   "updatedAt": "2025-05-14T12:00:00Z",
   "summary": "On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know."
  }
 ],
 "changes": [
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-16",
   "title": "Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-14",
   "title": "Ledger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-13",
   "title": "Ledger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-11",
   "title": "Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.",
   "sourceUrl": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-10",
   "title": "Ledger confirmed that at least one affected device contained an unauthorized hardware implant.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Coordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Ledger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-06",
   "title": "Coinspect warned publicly about the Ill Bloom flaw and released a wallet checker; about $2M more had moved from exposed wallets.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-01",
   "title": "Halborn's June review listed the vendor-driven front-end attack at about $3M stolen from site visitors.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-26",
   "title": "Bubblemaps estimated about $3M stolen from fewer than 15 users; PeckShield said victims' pUSD was drained and the funds were converted to ETH.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-25",
   "title": "Polymarket said a third-party vendor was compromised and malicious code was injected into its website; it removed the code, patched the issue and promised full refunds.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-05-27",
   "title": "An attacker drained about $3.1M from 431 wallets whose seeds were generated with weak randomness.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026"
  },
  {
   "incident": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-14",
   "title": "Odaily published an ExVul Security analysis of the risks of custodial prediction-market bots.",
   "sourceUrl": "https://www.odaily.news/en/post/5208756",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026"
  },
  {
   "incident": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-13",
   "title": "Polycule confirmed its Telegram trading bot was hacked, about $230,000 of user funds lost; the bot was taken offline.",
   "sourceUrl": "https://www.odaily.news/en/post/5208756",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-14",
   "title": "CryptoSlate reported the warning and his advice to sign wallet transactions only from a separate, dedicated laptop.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-13",
   "title": "Nailwal warned on X that a hijacked Polygon Ventures Telegram account was sending founders to deepfake Zoom calls.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  }
 ]
}