What Happened in the June 2026 Polymarket Frontend Hack? Lessons for Users

Srey Leak· security · Updated October 2026

On June 25, 2026, a frontend supply-chain attack via a third-party vendor caused a malicious PUSD→ETH swap contract to execute against user wallets, compromising approximately $3.1M across 11+ accounts. Polymarket issued full refunds to all affected users. The lesson is structural: scope your signing keys so a hot key can trade but never withdraw, and treat any “recovery service” that asks for a seed phrase as a scam — there is nothing for it to recover.

What happened on June 25, 2026?

On June 25, 2026 a compromised third-party frontend vendor injected code into a top prediction market’s UI, presenting users with a malicious PUSD→ETH approval that took approximately $3.1M across 11+ accounts — the platform’s contracts were never touched.

The attack chain had four steps:

A third-party frontend vendor was compromised (supply-chain vector — the platform’s own contracts were never touched)
Injected code presented users with a malicious approval request
The contract swapped PUSD → ETH into an attacker-controlled address
Approximately $3.1M was taken across 11+ accounts

The instructive part is the vector: users approved a transaction, not a private-key leak. Every control below is about shrinking what one approval or one leaked key can do.

Did Polymarket reimburse victims?

Yes — full refunds to all verified victims, a documented official response. This is also exactly why post-hack “recovery services” are fraudulent by construction: the platform already made victims whole, so anyone offering to “recover June hack funds” is either double-dipping or inventing a loss. Legitimate support never asks for seed phrases, private keys, or “verification deposits.”

How do Session Keys actually bound the damage?

Polymarket’s Session Keys (beta, Deposit Wallets only) are the platform-native version of key separation — a separate EOA signer the wallet owner authorizes for trading:

Fixed expiry: 180 days (the contracts reject other values — 4,315 hours)
Scoped venues: CLOB orders, Combos RFQ, or All; a narrower scope is safer
A Session Key cannot withdraw funds from the Deposit Wallet — the single most important boundary
Orders are isolated: a Session Key sees only its own orders; the owner cannot fetch orders the Session Key submitted
Authorization requires a Builder API key; revocation runs through the Relayer and completes after the key’s open orders cancel

Practical setup: cold key (hardware wallet) holds the owner role and does nothing but withdrawals; a Session Key does day-to-day trading; if a hot machine is compromised, the attacker gets a trader, not your balance.

Did the same attack happen again?

Yes — on October 29, 2026, a compromised third-party monitoring script (DebugBear RUM) served a browser-side drainer on the genuine polymarket.com, draining ~$2.64M from 726 accounts within about an hour. Trading resumed the same day, with full reimbursement pledged.

The October incident is the June pattern repeated nearly verbatim: contracts held, users signed what the compromised page asked them to sign. The difference is scale — June hit 11+ concentrated accounts for $3.1M; October swept 726 accounts for $2.7M in under an hour. See the full hack timeline and the October 29 double-breach analysis (the same day also saw the record $6.3B Binance theft). The standing lesson for both: verify what you sign on any page, however legitimate the domain looks, and keep approvals minimal — old allowances stay valid across breaches.

What are the red flags of a recovery scam?

Asks for your seed phrase or private key — always fraudulent, no exceptions
Asks you to “verify” by sending funds to any address
Contacts you first — DM, Telegram, WhatsApp, comment replies
Promises to recover funds lost in the June 2026 hack (already refunded)
Impersonates support handles with lookalike characters (0 for O, rn for m)
Urgency: “your account will be frozen in 24 hours”

FAQ

Q: Was my account affected if I traded in June 2026? A: Only users who approved the malicious contract transaction were affected; refunds covered all verified victims.

Q: Is Session Key the same as a private key for my wallet? A: No — it is a separate signer with scoped, time-limited trading access that cannot withdraw. Your owner key stays cold.

Q: Is Polymarket’s frontend safe now? A: The vendor dependency was remediated after June 25, 2026 — but a second frontend supply-chain incident occurred on October 29, 2026 through a different third-party script. Standard hygiene applies permanently: verify URLs, never approve unexpected transactions, review every approval request’s target contract.

Q: Should I move funds off Polymarket after the hack? A: Personal risk decision. The attack was vendor-side, not protocol-side; key separation and position sizing remain the primary controls.

Sources

Disclaimer

Not financial advice. Educational purposes only. Updated November 2026.