Polymarket will fully reimburse users after a third-party contractor hack resulted in $3 million in stolen funds.
Polymarket, a popular prediction market platform, has announced plans to fully reimburse users affected by a recent hack that exploited a vulnerability in a third-party contractor's system. The breach reportedly resulted in the theft of approximately $3 million.
We recently discovered that a third-party vendor had been compromised, which led to a malicious script being injected into our platform's frontend for certain users. We have isolated the issue and removed the affected component. We are proactively contacting users impacted by this and will reimburse them in full.
— Polymarket Traders (@PolymarketTrade) June 25, 2026
Connor Brandi, a representative from Polymarket, confirmed to TechCrunch that user funds were indeed stolen during the incident but did not provide further comments.
Incident Overview
According to on-chain analysis by PeckShield, the estimated losses from the attack are around $3 million. Analyst Specter noted that over 11 wallets were affected, with losses reported at approximately $2.94 million.
It appears there may be a phishing attack targeting Polymarket users, with estimated losses of $2.94M so far. The attacker has drained funds from 11+ victim wallets holding PUSD, swapped the stolen assets for ETH, and consolidated the proceeds into a specific address.
— Specter (@SpecterAnalyst) June 25, 2026
Bubblemaps reported that fewer than 15 accounts were impacted and provided details of some affected user addresses. The company indicated that the potential damage had been largely contained.
Some Polymarket accounts affected:
0x349606c1b77F3Ba668879CbC9347f15a44cF8fc4
0xFB84a9d631A3a19204B82c78dFeb90b220255fB5
0x4aeC70021891EA712AAf3e2dD76c30f6b09A4ce9
0x987B441a20Dd4AA4bA6d53069E852E7f820adF43
0x2d7BE5170a8026c18709EAEa1027c7f12E8Ce2Ce…
— Bubblemaps (@bubblemaps) June 25, 2026
The attackers withdrew pUSD from user wallets, which is backed by USDC at a 1:1 ratio according to Polymarket's documentation. Following the withdrawal, the stolen assets were converted to ETH and consolidated into a single Ethereum address, where they remain at this time. The attack targeted the user interface rather than the underlying smart contracts, although the company has not revealed the identity of the compromised contractor or the duration that the malicious code was active.
Recurring Security Issues
This incident marks the second security breach for Polymarket in just a few months. In May, a wallet's private key used for internal operations was compromised, leading to losses of around $700,000, though user funds were reportedly safe at that time. In a broader context, this is the third similar incident within six months, with a previous attack in December 2025 linked to vulnerabilities in a third-party provider, details of which remain undisclosed.
The increase in such attacks is concerning, especially as other platforms like Ekubo, TrustedVolumes, and THORChain have also faced security breaches in recent months.
