Pierluigi Paganini
June 26, 2026
Polymarket confirmed that a security breach at a third-party vendor allowed attackers to inject malicious code into its website, leading to the theft of funds from an undisclosed number of users.
The company said it has contained the incident and is contacting affected customers. The firm announced it will fully reimburse user losses, however the technical details of the attack have not yet been disclosed.
The attack first came to light when blockchain security researcher Specter spotted a phishing campaign that drained more than 11 Polymarket wallets holding PUSD.
The experts estimanted losses of $2.94 million and reported the attacker moved the stolen funds from Polygon to Ethereum and converted them into 1,893 ETH.
Earlier this week, Polymarket said it would review its promotional content after an investigation found it had paid creators to post fake videos showing fabricated betting wins.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Polymarket)
