Breaches and incidentsBriefConfirmed by two or more outlets
Polymarket: compromised third-party vendor injected a malicious approval prompt into the front end
Confirmed 25 Jun 2026: about USD 2.94M taken from at least 11 user wallets (Specter); Bubblemaps counted fewer than 15 accounts.
- Disclosed
What happened
- Root cause per Polymarket: “a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users”. The script showed a malicious ERC-20 approval or signature request inside the real interface, which let the attacker move pUSD. Vendor not named. Contracts not breached.
- Attribution: none.
- Response: Polymarket removed the dependency and committed to full refunds. This was the first of two front-end vendor compromises at Polymarket in 2026 (see 29 Oct).
Sources
- https://cside.com/blog/polymarket-client-side-supply-chain-attack
- https://cointelegraph.com/news/polymarket-vendor-compromise-drains-29m-users
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.