Polymarket users lose $2.9M in third-party vendor compromise, refunds promised

Attackers injected a malicious script into Polymarket's frontend via a third-party vendor, draining an estimated $2.94 million from at least 11 user wallets. Polymarket says the compromise is contained and users will be fully refunded.

• Blockchain analyst Specter identified the attack as a phishing-style drain affecting at least 11 Polymarket user wallets.
• Polymarket said the malicious dependency has been removed and affected users will receive full refunds.
• The attack is the 89th reported crypto security breach of Q2 2026, making it the most-hacked quarter on record by incident count.
• June exploit losses total $74.9M across 29 incidents, with private key compromises accounting for 43% of losses over the past 30 days.

Coinporta summarises news for fast scanning. Full reporting belongs to the source.

Last updated 28 Jun 2026