{
 "tag": "polymarket",
 "name": "Polymarket",
 "group": "Other",
 "incidents": [
  {
   "slug": "polymarket-frontend-vendor-compromise-jun-2026",
   "title": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026",
   "json": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "polygon",
    "ethereum"
   ],
   "method": "front-end-hijack",
   "product": "Polymarket web app users",
   "tags": [
    "polygon",
    "ethereum",
    "front-end-hijack",
    "polymarket",
    "supply-chain",
    "third-party-vendor",
    "injected-script",
    "pusd",
    "prediction-market"
   ],
   "amountUsd": 3000000,
   "victims": null,
   "startedAt": "2026-06-25",
   "closedAt": "2026-07-01",
   "updatedAt": "2026-07-01T12:00:00Z",
   "summary": "Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users."
  },
  {
   "slug": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "title": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026",
   "json": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "polygon"
   ],
   "method": "key-leak",
   "product": "Polycule Telegram trading bot users (Polymarket, Polygon)",
   "tags": [
    "polygon",
    "key-leak",
    "polycule",
    "polymarket",
    "telegram-bot",
    "custodial-bot",
    "trading-bot"
   ],
   "amountUsd": 230000,
   "victims": null,
   "startedAt": "2026-01-13",
   "closedAt": "2026-01-14",
   "updatedAt": "2026-01-14T12:00:00Z",
   "summary": "Polycule, a Telegram bot for trading on Polymarket, confirmed on 13 Jan 2026 that it had been hacked and that about $230,000 of user funds held in bot-managed Polygon wallets was taken. The team took the bot offline and promised a patch and compensation; no official root cause was published, and some rivals called it a rug pull. Custodial Telegram bots keep users' private keys on their own servers, so one breach can drain every user at once. Keep only small trading balances in any bot wallet."
  }
 ],
 "changes": [
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-01",
   "title": "Halborn's June review listed the vendor-driven front-end attack at about $3M stolen from site visitors.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-26",
   "title": "Bubblemaps estimated about $3M stolen from fewer than 15 users; PeckShield said victims' pUSD was drained and the funds were converted to ETH.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-25",
   "title": "Polymarket said a third-party vendor was compromised and malicious code was injected into its website; it removed the code, patched the issue and promised full refunds.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-14",
   "title": "Odaily published an ExVul Security analysis of the risks of custodial prediction-market bots.",
   "sourceUrl": "https://www.odaily.news/en/post/5208756",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026"
  },
  {
   "incident": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-13",
   "title": "Polycule confirmed its Telegram trading bot was hacked, about $230,000 of user funds lost; the bot was taken offline.",
   "sourceUrl": "https://www.odaily.news/en/post/5208756",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026"
  }
 ]
}