Polymarket confirms $3 million loss from frontend supply-chain attack
Polymarket disclosed on June 26, 2026, that attackers stole roughly $3 million in user funds by injecting a malicious script through a compromised third-party vendor on its frontend. The platform contained the breach, removed the affected dependency, and pledged full refunds to affected users. Blockchain intelligence firm AMLBot traced the stolen PUSD to 11 Ethereum wallets. The incident did not involve Polymarket's core smart contracts. The international Polymarket platform is distinct from the separately CFTC-regulated Polymarket US DCM.
Polymarket must now refund roughly $3 million while defending against a CFTC probe into staged bets and bipartisan Senate demands for investigation. The supply-chain breach gives competitors like Kalshi a concrete trust argument to pitch institutions and retail users on alternative venues.
Refund execution and disclosure quality in the coming two weeks will determine whether this remains a recoverable operational hit or accelerates user migration and deepens CFTC scrutiny of the platform's operational security as part of its broader integrity review.
The frontend attack joins the CFTC probe and Senate demands as the third concurrent crisis threatening Polymarket's operational credibility and CFTC exchange designation, after investigators began examining fake bets and staged trades.