Polymarket Hackers Drain $2.9M From User Wallets, Funds To Be Refunded

Crypto Security News

A third-party vendor breach let attackers inject a malicious script into Polymarket's website on June 25, 2026. The script triggered a phishing attack that drained about $2.9 million from user wallets. Polymarket said it removed the bad code and will fully refund affected users.

The attackers targeted wallets holding pUSD, Polymarket's dollar-pegged stablecoin backed by USD Coin (

). Once they gained control of the funds, they swapped the pUSD for Ethereum (

) and moved everything into a single wallet. As of the latest reports, the stolen ETH had not left that wallet. This kind of attack relies on a tactic known as

, which tricks victims into approving transactions that drain their funds.

Vendor Compromise Triggers Frontend Hack

Blockchain analyst Specter first

the breach, tracing the theft to at least 11 user wallets. Bubblemaps, a separate on-chain investigation firm, put the number of affected accounts at fewer than 15. Both estimates point to a narrow but costly attack.

Polymarket

the incident on X, saying the compromised vendor had been removed from its system. The company declined to name the vendor involved.

Repeat Incidents Highlight Security Gaps