{"id":"polymarket-website-crypto-theft-jun-2026","category":"breach","status":"live","title":"Polymarket website compromise steals about US$3 million; full reimbursement remains unconfirmed","tldr":"A compromised website supplier let attackers steal about US$3 million from Polymarket customers. Polymarket said it removed the malicious code and would refund victims. Check June account activity and contact support about losses or unpaid refunds.","summary":"On 25 June 2026, Polymarket disclosed that a compromised third-party vendor had introduced malicious code into its website for some users. Attackers stole customer cryptocurrency through the affected trading interface. PeckShield estimated losses at approximately US$3 million, while Bubblemaps identified fewer than 15 affected accounts; Polymarket did not publish a final victim count or loss total in its initial disclosure. The company's statement, reproduced by crypto.news, said it had removed the affected dependency, contained the incident and was contacting affected users and refunding them in full. It did not identify the supplier. As at 3 November, the sources reviewed do not establish that every June victim received reimbursement or that the stolen funds were recovered. Polymarket's October refund figures concern a separate attack and do not establish the outcome of this theft.","action":"If you used Polymarket around 25 June, check your wallet and trading history for unrecognised activity and contact Polymarket support about any loss or outstanding reimbursement. There is no device or app update to install for this website incident.","product":"Polymarket website and customer crypto wallets","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["polymarket","crypto","theft","supply-chain","website-compromise"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security incident – third-party vendor compromised (separate October incident)","url":"https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj","by":"Polymarket","date":"2026-10-30"},{"kind":"news","title":"Polymarket to refund users after $2.94M frontend phishing attack — reproduces Polymarket's June statement","url":"https://crypto.news/polymarket-to-refund-users-after-2-94m-frontend-phishing-attack/","by":"crypto.news","date":"2026-06-26"},{"kind":"news","title":"Polymarket customers lose $3 million in supply-chain attack","url":"https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/","by":"BleepingComputer","date":"2026-06-26"},{"kind":"news","title":"Polymarket to Refund Users After Scammers Swipe Millions in Website Exploit","url":"https://decrypt.co/372129/polymarket-refund-users-scammers-swipe-millions-website-exploit","by":"Decrypt","date":"2026-06-25"},{"kind":"news","title":"Polymarket’s traders lost funds through a website supplier. How safe is the trading screen?","url":"https://crypto.news/polymarkets-traders-lost-funds-through-a-website-supplier-how-safe-is-the-trading-screen/","by":"crypto.news","date":"2026-10-30"}],"started":"2026-06-25","closed":null,"created":"2026-11-03T21:34:53.828Z","updated":"2026-11-03T21:34:53.828Z","cve_notes":[],"timeline":[{"at":"2026-10-30","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"A retrospective reported that the June coverage did not establish completion of every refund. It distinguished June's reimbursement commitment from a new promise following a separate vendor compromise on 29 October.","url":"https://crypto.news/polymarkets-traders-lost-funds-through-a-website-supplier-how-safe-is-the-trading-screen/","by":"crypto.news","patch":null},{"at":"2026-06-26","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"BleepingComputer reported PeckShield's estimate of approximately US$3 million stolen and Bubblemaps' finding of fewer than 15 affected accounts. These were analysts' estimates, rather than a final accounting from Polymarket.","url":"https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/","by":"BleepingComputer","patch":null},{"at":"2026-06-25","added":"2026-11-03T21:25:43.261Z","kind":"disclosed","text":"Polymarket said a compromised third-party vendor had injected malicious code into its website for some users. Its statement, reproduced by crypto.news, said it had removed the affected dependency, contained the incident and was contacting affected customers and refunding them in full.","url":"https://crypto.news/polymarket-to-refund-users-after-2-94m-frontend-phishing-attack/","by":"crypto.news","patch":"na"}],"url":"https://hard.fyi/live/polymarket-website-crypto-theft-jun-2026/","json":"https://hard.fyi/api/live?id=polymarket-website-crypto-theft-jun-2026"}