When Was Polymarket Hacked? Full Timeline: December 2025, June 2026, October 2026

Srey Leak· security · Updated October 2026

Answer: Polymarket has been hacked three times: December 2025 (auth), June 2026 (frontend, $3.1M), October 29 2026 (vendor script, $2.64M/726 wallets).

Polymarket has confirmed three security incidents. On December 24-25, 2025, a vulnerability in a third-party email-authentication provider (Magic Labs) let attackers drain user accounts — even ones with two-factor authentication. On June 25, 2026, a compromised vendor injected malicious script into Polymarket’s frontend, triggering a phishing flow that drained roughly $2.9 million from at least 11 wallets; Polymarket pledged full refunds. On October 29, 2026, a compromised monitoring script served a browser-side drainer on the genuine site, draining ~$2.64 million from 726 accounts in 52 minutes before trading was restored the same day.

What happened in December 2025?

Date	Event
Dec 24, 2025	Users report drained accounts across social media; losses reported even with 2FA enabled
Dec 24, 2025	Polymarket acknowledges a security issue tied to a third-party provider
Dec 25, 2025	Polymarket confirms accounts compromised via a vulnerability in a third-party authentication service (Magic Labs’ email login); issue contained

The attack path: the third-party email login flow — not Polymarket’s own contracts — was the entry point. Users who had signed in with email were exposed regardless of their 2FA settings, because the session originated through the auth provider.

What happened in June 2026?

Date	Event
Jun 25, 2026	Blockchain analyst Specter flags the breach: malicious frontend code injected through a compromised vendor
Jun 25, 2026	The script phished users into approving transactions; ~$2.9M drained from 11+ wallets (Bubblemaps: fewer than 15)
Jun 25, 2026	Stolen pUSD swapped to ETH, consolidated into a single wallet
Jun 25-26, 2026	Polymarket confirms on X, removes the compromised vendor, pledges full refunds

The mechanism was classic supply-chain: not a contract exploit, but a vendor with frontend access pushing a phishing flow to legitimate users on the legitimate site. On-chain analyst PeckShield traced the approvals; DefiLlama logged it as the quarter’s 89th crypto incident.

What happened on October 29, 2026?

A compromised third-party monitoring script (DebugBear RUM) served drainer code inside the genuine polymarket.com page, draining ~$2.64M from 726 accounts within about an hour; trading was paused to cancel-only mode and restored the same day, with full reimbursement pledged.

Date	Event
Oct 29, 2026	Malicious build of the vendor script timestamped ~1:59 p.m. ET
Oct 29, 2026	~$2.64M drained across 726 accounts; trading halted to cancel-only
Oct 29, 2026	Trading restored; full reimbursement pledged; case referred to UK law enforcement

This is the second frontend supply-chain incident in four months, and it repeats the June pattern exactly: contracts held, users signed what the compromised page showed.

What was the smaller May 2026 incident?

About a month before the June breach, Polymarket disclosed a separate exploit: $600,000-$700,000 tied to a six-year-old private key used for internal payment top-ups. VP of engineering Josh Stevens stated user funds and platform contracts were safe and the key’s permissions were revoked. Three incidents in six months is the pattern worth internalizing.

What do the two big hacks teach?

2FA doesn’t cover auth-provider compromises — if your login itself runs through a third party, the provider is the attack surface
Frontend trust is attack surface — a compromised vendor can phish you on the real site; verify what you’re approving, not just where you are
Small counts, real losses — 11-15 wallets lost $2.9M in June: concentrated, high-value accounts were the targets
Refunds are policy, not law — Polymarket made users whole voluntarily; self-custody means the recourse you get is the recourse someone chooses to give

What should users change after reading this?

The 10-step hardening guide on this hub covers the full checklist; the hack-specific lessons: prefer wallet connection over email login where possible, treat any unexpected transaction prompt as hostile even on the genuine site, keep large balances in wallets that don’t interact with web frontends, and bookmark official domains — every one of these attacks began with trusted-looking entry points.

FAQ

Q: When was Polymarket hacked? A: Three confirmed major incidents: December 24-25, 2025 (third-party email-auth provider compromise), June 25, 2026 (vendor compromise injecting frontend phishing code; ~$2.9M drained), and October 29, 2026 (a compromised monitoring script turned into a drainer; ~$2.64M drained from 726 accounts).

Q: How much was stolen in the June 2026 Polymarket hack? A: Approximately $2.9 million from at least 11 wallets (analyst Specter’s count; Bubblemaps estimated fewer than 15 accounts). Polymarket pledged full refunds.

Q: How much was stolen in the October 2026 Polymarket hack? A: Approximately $2.64 million across 726 accounts, traced to a single attacker wallet in 900+ transactions. Trading resumed the same day and full reimbursement was pledged.

Q: Were 2FA users affected? A: Yes — in the December 2025 incident, users with 2FA enabled were drained because the compromise ran through the email-authentication provider, not through account login.

Q: Did Polymarket refund the victims? A: Polymarket pledged full refunds after both the June 2026 and October 2026 incidents. For the October 29 drainer, the case was referred to UK law enforcement and the refund procedure runs through official in-app channels only.

Q: Is Polymarket safe now? A: The specific vendors were removed and the issues contained — but three incidents in six months (including the ~$600-700k May key compromise) are a reminder that platform-level risk exists; personal security hygiene remains the user’s job.

Sources

Disclaimer

Not financial advice. Educational purposes only. Updated November 2026.