Polymarket Suffers Major Hack Through Third-Party Vendor
A third-party vendor breach hit Polymarket on Thursday. Hackers injected a malicious script onto the platform’s website. The script targeted multiple users and triggered a phishing attack.
Blockchain analyst Specter revealed the details. The attack stole roughly $2.94 million (about Rs. 27.75 crore) in cryptocurrency from at least 11 user wallets.
Polymarket quickly responded on X. The team confirmed the compromise remained isolated. They removed the affected dependency immediately. In addition, the firm promised full refunds to all impacted users.
Polymarket continues to show strong growth. Its total value locked now stands at $450 million (around Rs. 4,247 crore). This marks a 301 percent increase from $112 million (roughly Rs. 1,057 crore) recorded a year earlier, according to DeFiLlama data.
Previous Incident Highlights Ongoing Risks
About a month earlier, Polymarket faced another breach worth $600,000 (approximately Rs. 5.6 crore). That incident stemmed from an old private key used for internal top-ups. However, Josh Stevens, vice president of engineering at Polymarket, assured that no user funds were lost. The contracts stayed secure, and the team had already revoked all permissions.
Crypto Exploit Losses Rise in June
Crypto hacks kept increasing through June. Losses reached $74.9 million (about Rs. 706 crore) across 29 incidents. This figure rose from $60.5 million (roughly Rs. 571 crore) in May. Still, it stayed far below April’s total of $644 million (around Rs. 6,078 crore), per DeFiLlama.
Private key exploits caused the highest share. They accounted for 43 percent of all losses in the past 30 days. Proof exploits followed at 10 percent. Reverse MEV honeypots made up 8 percent of the attacks. These honeypots create fake trading opportunities to trick automated bots.
Q2 2026 Becomes Record Hacked Quarter
Market insights provider Unfolded reported a troubling trend. The second quarter of 2026 recorded the highest number of crypto protocol hacks ever. A total of 83 attacks took place.
KelpDAO suffered the biggest loss with a $293 million (around Rs. 2,774 crore) hack. Drift Protocol came next after losing $280 million (roughly Rs. 2,652 crore).
Other notable incidents also occurred. Hackers stole $1.7 million (about Rs. 16 crore) from Taiko, an Ethereum layer-2 blockchain, by compromising its chain state verification. Secret Network Bridge lost $4.7 million (approximately Rs. 44.5 crore) due to an infinite mint bug. Meanwhile, THORchain paused trading after a suspected $10 million (roughly Rs. 94.7 crore) exploit. The network has since resumed full operations, including trading, signing, swaps, and liquidity provider functions.
Crypto platforms continue to strengthen their defenses. Users and developers must stay vigilant against evolving threats.