Polymarket users lose $3 million after frontend hack

2026-06-26

A compromised third-party vendor allowed attackers to inject a malicious script into Polymarket's frontend for some users, leading to a phishing-style drain of about $3 million from at least 11 wallets holding PUSD, with the stolen funds swapped to ETH and sent to a single address. Polymarket removed the bad dependency, contained the issue, and says it will issue a full refund to affected users.