Polymarket — June 2026 Supply Chain Attack
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2z8xuJ…4opaSummary
On June 25, 2026, Polymarket, a prominent prediction market platform, suffered a supply chain attack through a compromised third-party frontend vendor. Attackers injected malicious JavaScript that drained approximately $3.1 million in pUSD from at least 11 user wallets on Polygon, with stolen funds bridged to Ethereum and converted to roughly 1,893 ETH. The incident occurred against a backdrop of a concurrent CFTC marketing-fraud investigation and a prior private key compromise in May 2026.
Connected Entities
5 entities · 60 linked investigations- ZachXBT→mentioned with→Ethereum(70%)
- Polymarket — June 2026 Supply Chain Attack→mentioned with→ZachXBT(70%)
- Polymarket — June 2026 Supply Chain Attack→mentioned with→Ethereum(80%)
- Polymarket — June 2026 Supply Chain Attack→mentioned with→Polygon(80%)
- Polymarket — June 2026 Supply Chain Attack→mentioned with→Polymarket(70%)
- Polygon→mentioned with→Ethereum(70%)
Timeline(8 events)
April 2026
Polymarket launches pUSD, an ERC-20 stablecoin backed 1:1 by USDC, as primary collateral on Polygon.
Our Crypto Talk22 May 2026
ZachXBT flags suspicious on-chain activity on Polygon linked to Polymarket. Attacker exploits a compromised private key belonging to an internal operations wallet and drains between $520,000 and $700,000. Polymarket states user funds and contracts are safe.
CoinDesk20 June 2026
The Wall Street Journal publishes an investigation alleging Polymarket used influencers in promotional videos depicting fake winning bets with no real money wagered; approximately 70 percent of videos reviewed contained allegedly deceptive content.
Crypto Briefing25 June 2026
Supply chain attack occurs. A compromised third-party frontend vendor injects malicious JavaScript into Polymarket's website. At least 11 user wallets are drained of approximately $2.94–$3.1 million in pUSD on Polygon. Stolen funds are bridged to Ethereum and swapped for approximately 1,893 ETH, consolidated into address 0xe65b1C586757c5510B60F998Eebb14C1eF71E1eD.
Crypto Briefing / Our Crypto Talk25 June 2026
Polymarket confirms the breach, removes the compromised dependency, and pledges full refunds to affected users. The compromised vendor is not named publicly.
Crypto Times26 June 2026
CNBC reports the CFTC has opened a new investigation into Polymarket's marketing practices, citing a source with knowledge of the inquiry. U.S. senators urge the CFTC to probe the platform's alleged deceptive advertising.
CNBCDecision Log
- hash: 8QZQYGPMtXzSSKEn7XjJTo7ubihvAq8GDjPZTdecNftM
This investigation is cryptographically anchored to the Solana blockchain (1 event). 16 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/28/2026, 5:08:17 PM
last updated: 9/23/2026, 4:30:51 AM
4 viewsavoid.net — verified advice for a post-truth world