2026 Polymarket — frontend supply-chain attack through a compromised vendor dependency; about $3M drained (PeckShield estimate), fewer than 15 accounts per Bubblemaps
Data compromised
Funds from user wallets. Users were deceived into authorising fraudulent transactions on the legitimate site. Bubblemaps reported fewer than 15 affected accounts and published a list of some accounts and the wallets holding the funds. Polymarket said it would fully reimburse affected customers.
Technical writeup
The total stolen is an estimate. PeckShield said roughly $3 million in pUSD was bridged from Polygon to Ethereum and swapped for about 1,893 ETH. Another tally put the loss at about $2.94 million from at least 11 wallets. PeckShield describes the activity as phishing, while Polymarket and BleepingComputer describe a supply-chain attack; the sources do not reconcile these. Polymarket has since reported a separate supply-chain incident on October 29, 2026 (polymarket-debugbear-script2026). recordsAffected 0 because the count of accounts is not a company figure.
Root cause
Malicious JavaScript was injected into Polymarket’s website through a compromised third-party dependency. Polymarket attributed the incident to a supply-chain attack affecting a dependency on its website and said its own servers and backend were not affected. The vendor has not been named, and the start date has not been disclosed.