Polymarket hit by second frontend attack after mocked breach claims
Polymarket's frontend infrastructure was compromised when an unnamed third-party JavaScript vendor was hit by a supply chain attack, according to a June 26, 2026 security rollup. The injected malicious script manipulated blockchain transactions for some users without breaching Polymarket's core smart contracts or exchange backend. The incident came weeks after the platform had publicly mocked hackers who claimed to have breached it, and follows closely on the heels of another frontend attack that drained $3.1 million in PUSD from 11 wallets. Polymarket has since revised that earlier loss figure to $3.1 million and committed to refunds.
Polymarket must now defend user trust across two confirmed frontend exploits within days while absorbing $3.1 million in refunds and fending off CFTC and Senate scrutiny. Kalshi and Meta's emerging Arena platform are both positioned to capture traders who question whether Polymarket's infrastructure can safeguard their funds.