Polymarket Frontend Hack — $2.6M Drained, Platform Halted
Polymarket's frontend was compromised via a third-party provider injection attack, draining multiple user accounts. The platform entered cancel-only mode, identified and fixed the exploit, and committed to making all victims whole.
What we know
The attack broke in real-time when an account on X tweeted he had been drained of $800k, with a friend losing $600k. Another account on X broke it to 148k viewers via Discord reports. Another account on X identified the mechanism: a malicious script injected into the frontend selling positions and withdrawing funds. @cz_binance confirmed it as a front-end injection attack — showing users a valid-looking transaction while submitting a malicious one. Another account on X identified the hacker wallet (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) with ~$2.6M exploited. Polymarket confirmed the fix and pledged full refunds, halting trading while investigating. Another account on X estimated total losses under $3M. Another account on X blasted the use of third-party providers as inexcusable in 2026.
Sources
“injection attack on the front end, injecting incorrect tx but showing valid tx for user to sign”
View post →By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.