Polymarket Wallet Theft After Frontend Script Injection

The incident concerned a reported theft of about $3.1 million in Polymarket’s PUSD token from 11 user wallets, disclosed in reporting dated 2026-06-27.^[1] The available record described the event as a user-wallet compromise associated with Polymarket’s web interface rather than as a protocol-level drain of treasury assets or a smart-contract exploit.^[1][3] At the same time, the public characterization of the mechanism was not fully uniform: Polymarket attributed the event to a compromised third-party vendor that injected malicious code into its frontend for some users, while PeckShield described the activity as a phishing campaign targeting Polymarket users.^[3][5]

The earliest pivotal element established in the record was Polymarket’s statement that a third-party vendor had been compromised and that this compromise resulted in a malicious script being injected into the frontend seen by some users.^[3] That description matters because it places the initial point of failure outside the core application logic and inside a dependency or service relationship that had effective control over code delivered to end users.^[3] In practical terms, the reported mechanism implied that users interacted with a legitimate interface that had been altered in transit or at the dependency layer, creating conditions under which wallet approvals or signing flows could be manipulated without a direct breach of the users’ devices being established in the public record.^[3] As of 2026-06-27, however, the dossier did not establish the exact malicious payload, the duration of exposure, or whether all affected users encountered the same injected behavior.

A second pivotal element was the reported scope of loss. CoinDesk stated that hackers stole about $3.1 million in PUSD from 11 user wallets.^[1] The concentration of losses in a limited number of wallets suggested a targeted or selectively successful campaign rather than a platform-wide compromise affecting all active users, although the present record did not establish how the 11 wallets were selected or whether they shared common behavioral or technical characteristics.^[1] Because the losses were described at the wallet level, the incident appears in the record as a compromise of user-controlled assets mediated through the frontend environment, not as an unauthorized transfer from a centralized omnibus account.^[1][3]

The third pivotal element was post-theft movement. Reporting stated that the stolen assets were taken from Polygon and immediately bridged to Ethereum.^[2] That sequence is consistent with a common laundering or obfuscation step in cross-chain thefts: assets are removed from the chain of origin and transferred into another execution environment before further dispersal.^[2] In this case, the bridge movement was attributed in the reporting to external blockchain-intelligence analysis rather than to a public law-enforcement filing or a platform-issued forensic report.^[2] The brief did not provide transaction hashes, destination addresses, or subsequent routing behavior after arrival on Ethereum, so the public record summarized here supports only the narrower statement that the funds were reported to have moved from Polygon to Ethereum.^[2]

Public explanation of the attack vector remained partly bifurcated. Polymarket’s own statement framed the event around a compromised vendor and malicious frontend dependency, whereas PeckShield said hackers had deployed a phishing campaign targeting Polymarket users.^[3][5] These descriptions are not necessarily mutually exclusive. A malicious script inserted into a legitimate frontend can function as a phishing instrument if it induces users to sign deceptive approvals or transactions while believing they are interacting with the expected interface.^[3][5] Even so, the present dossier did not establish whether the operative theft mechanism was a fraudulent signature request, a token approval abuse, credential capture, or another user-action pathway. For that reason, the most defensible classification on the current record is a hybrid one: social engineering delivered through a third-party frontend compromise.^[3][5]

Polymarket stated that it had contained the incident and removed the affected dependency.^[4] That response indicated that the platform treated the malicious code path as identifiable and severable, at least at the dependency level described in its statement.^[4] The same statement said the platform was contacting impacted users and refunding them in full.^[4] On the available record, this refund commitment was the principal remediation measure publicly disclosed. No court filing, insurer statement, or later platform accounting was included in the brief to confirm whether refunds had been completed, whether they covered all categories of loss, or whether reimbursement came from treasury funds, reserves, counterparties, or another source.^[4]

The documented consequences were therefore threefold. First, users reportedly lost about $3.1 million in PUSD across 11 wallets.^[1] Second, the stolen assets were reportedly bridged from Polygon to Ethereum, complicating straightforward chain-local tracing.^[2] Third, the incident occurred amid separate reporting that Polymarket was under federal investigation over allegedly deceptive social media promotions, a contextual factor noted by CoinDesk but not causally linked in the present record to the theft itself.^[6] Beyond those points, the brief did not establish arrests, civil litigation, asset freezes, or a confirmed recovery amount.^[4]