Polymarket Account Security: Lessons from the June 2026 Frontend Hack
On June 25, 2026, a frontend supply-chain attack via a third-party vendor caused a malicious PUSD→ETH swap contract to execute against user wallets, compromising approximately $3.1M across 11+ accounts. Polymarket issued full refunds to all affected users. The lesson is structural: scope your signing keys so a hot key can trade but never withdraw, and treat any “recovery service” that asks for a seed phrase as a scam — there is nothing for it to recover.
What happened on June 25, 2026?
The attack chain had four steps:
- A third-party frontend vendor was compromised (supply-chain vector — the platform’s own contracts were never touched)
- Injected code presented users with a malicious approval request
- The contract swapped PUSD → ETH into an attacker-controlled address
- Approximately $3.1M was taken across 11+ accounts
The instructive part is the vector: users approved a transaction, not a private-key leak. Every control below is about shrinking what one approval or one leaked key can do.
Did Polymarket reimburse victims?
Yes — full refunds to all verified victims, a documented official response. This is also exactly why post-hack “recovery services” are fraudulent by construction: the platform already made victims whole, so anyone offering to “recover June hack funds” is either double-dipping or inventing a loss. Legitimate support never asks for seed phrases, private keys, or “verification deposits.”
How do Session Keys actually bound the damage?
Polymarket’s Session Keys (beta, Deposit Wallets only) are the platform-native version of key separation — a separate EOA signer the wallet owner authorizes for trading:
- Fixed expiry: 180 days (the contracts reject other values — 4,315 hours)
- Scoped venues: CLOB orders, Combos RFQ, or All; a narrower scope is safer
- A Session Key cannot withdraw funds from the Deposit Wallet — the single most important boundary
- Orders are isolated: a Session Key sees only its own orders; the owner cannot fetch orders the Session Key submitted
- Authorization requires a Builder API key; revocation runs through the Relayer and completes after the key’s open orders cancel
Practical setup: cold key (hardware wallet) holds the owner role and does nothing but withdrawals; a Session Key does day-to-day trading; if a hot machine is compromised, the attacker gets a trader, not your balance.
What are the red flags of a recovery scam?
- Asks for your seed phrase or private key — always fraudulent, no exceptions
- Asks you to “verify” by sending funds to any address
- Contacts you first — DM, Telegram, WhatsApp, comment replies
- Promises to recover funds lost in the June 2026 hack (already refunded)
- Impersonates support handles with lookalike characters (0 for O, rn for m)
- Urgency: “your account will be frozen in 24 hours”
FAQ
Q: Was my account affected if I traded in June 2026? A: Only users who approved the malicious contract transaction were affected; refunds covered all verified victims.
Q: Is Session Key the same as a private key for my wallet? A: No — it is a separate signer with scoped, time-limited trading access that cannot withdraw. Your owner key stays cold.
Q: Is Polymarket’s frontend safe now? A: The vendor dependency was remediated after June 25, 2026. Standard hygiene still applies: verify URLs, never approve unexpected transactions, review every approval request’s target contract.
Q: Should I move funds off Polymarket after the hack? A: Personal risk decision. The attack was vendor-side, not protocol-side; key separation and position sizing remain the primary controls.
Sources
Disclaimer
Not financial advice. Educational purposes only. Updated October 2026.