The attackers who drained $3 million from Polymarket users on June 25 never touched a single smart contract. They compromised a third-party vendor instead, slipped altered JavaScript into the prediction market’s website, and let the platform’s own users sign away their funds.
That is the same script decentralized finance (DeFi) has watched play out since a compromised Cloudflare account cost BadgerDAO $120 million in December 2021, and it is the same script that hit Curve Finance’s website twice more since then. Only the dollar figures change.
A Compromised Vendor Beat Polymarket’s Audited Code
Polymarket’s own trading account posted a warning on X within hours of the breach.
This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend
The account added that the affected dependency had been removed and that every impacted user would be contacted and refunded in full. On-chain investigator Specter first flagged the theft publicly, tracing losses from more than 11 wallets holding pUSD, Polymarket’s USDC-backed trading token on the Polygon network.
Blockchain analytics firm Bubblemaps later put the total at fewer than 15 accounts and published the wallet addresses involved. PeckShield, a blockchain security firm, traced the stolen pUSD as it moved from Polygon to Ethereum and converted into roughly 1,893 ETH, consolidating in a single wallet that has continued to hold the funds.
- $2.94 million was the initial tally from Specter’s on-chain tracing, later rounded to about $3 million by multiple trackers
- 11 to 15 wallets were affected, according to Bubblemaps and PeckShield
- 1,893 ETH is what the stolen pUSD became after bridging from Polygon to Ethereum
- Zero smart contract functions were exploited or altered
Polymarket has not identified the compromised vendor. The company told SecurityWeek it had no further comment beyond its post on X.
The Website Nobody Put Through an Audit
Smart contract audits check the logic deployed on chain. They say nothing about the JavaScript a browser loads when a user visits the site sitting in front of that contract, and that gap is exactly where Polymarket’s attackers worked.
“The Polymarket breach exposes a contradiction in cryptocurrency architecture,” said Jason Soroko, a senior fellow at Sectigo, a digital certificate security firm, in comments to SecureWorld. Developers harden the ledger with code reviews, he said, while delivering user access through a web supply chain that gets far less scrutiny.
A CISO briefing on sustained third-party risk elevation published by application security firm Veracode grouped the Polymarket incident with a broader wave of June and July compromises, including a ShinyHunters-linked breach of Medtronic’s corporate systems and a contractor social-engineering incident disclosed by AdaptHealth in a July 2 filing with the Securities and Exchange Commission. The common thread across all of it: attackers reaching users and data through a trusted third party instead of breaking a primary system outright.
BadgerDAO Lost $120 Million to the Same Trick in 2021
Five years before Polymarket, a different DeFi project learned the same lesson at a much larger scale. In the early hours of December 2, 2021, BadgerDAO, a project built around bringing Bitcoin into DeFi, discovered its users’ wallets were being drained.
The cause was not a flaw in Badger’s smart contracts. Attackers had obtained an unauthorized API key for Badger’s Cloudflare account, the content delivery service running its website, and used it to periodically inject a malicious script into the front end. The script asked visiting wallets to grant the attacker unlimited spending approval, and hundreds of users unknowingly signed it before the drain began.
Blockchain security firm PeckShield put the total loss at $120.3 million, most of it in Bitcoin and Ethereum, with a single institutional account reportedly losing more than $50 million in one transaction. Badger’s own team, in a post-mortem reported by CoinDesk, confirmed the API key had been created without engineers’ knowledge and was used to serve the malicious code to only a subset of visitors, which is part of why it went undetected for as long as it did.
Curve Finance Fell for the Same Trap Twice
Curve Finance, one of the largest decentralized exchanges by trading volume, has now been hit by the frontend version of this attack more than once. On August 9, 2022, hackers compromised the nameservers at Curve’s domain registrar and pointed curve.fi at a cloned site that quietly asked visitors to approve a malicious contract.
“We are becoming aware of a potential front-end issue that is approving a bad contract,” Curve’s team wrote in a Telegram announcement at the time, warning users to stop signing transactions immediately. On-chain investigator ZachXBT put the losses at roughly $570,000, later frozen in part by an exchange before it could be laundered further.
Curve’s frontend was hijacked again in May 2025, this time through a separate DNS compromise that its team caught quickly enough to warn users before major losses were confirmed, according to Decrypt’s reporting on the incident. In both cases, Curve’s smart contracts stayed untouched. Only the door in front of them kept getting picked.
| Platform | Date | Attack Vector | Amount Stolen | Smart Contracts Compromised |
|---|---|---|---|---|
| Polymarket | June 25, 2026 | Compromised frontend vendor, script injection | Roughly $3 million | No |
| BadgerDAO | December 2, 2021 | Stolen Cloudflare API key, script injection | Roughly $120 million | No |
| Curve Finance | August 9, 2022 | DNS registrar hijack | Roughly $570,000 | No |
| Curve Finance | May 2025 | DNS hijack, repeat incident | Contained before major losses | No |
Why Is Polymarket Facing a Second Scare in Five Weeks?
Polymarket’s frontend breach was its second security failure in about five weeks, and the first to hit user funds directly. In May 2026, a compromised internal operations wallet drained roughly $500,000, though user funds were not touched that time, an incident separately reported by Blockonomi.
Tech Times, which has been tracking the platform’s push for Commodity Futures Trading Commission (CFTC) approval to formally re-enter the United States market, reported that the two incidents in five weeks raise questions about whether Polymarket’s vendor vetting and frontend monitoring match the scale it now operates at. The company handles billions of dollars in monthly trading volume.
The timing sits inside a rough stretch for DeFi generally. Data tracked by DefiLlama and cited by Tech Times and security firm cside showed June 2026 exploit losses reaching $74.9 million across the industry, up from $60.5 million in May, with the quarter recording the highest number of DeFi security incidents ever logged.
The Fixes Security Teams Still Aren’t Running
None of the four incidents above involved a contract bug a traditional audit would catch. Security researchers point to three changes that would have mattered.
- Watch what actually loads in the browser – static analysis and software composition analysis (SCA) scan code an organization owns, but a Content Security Policy (CSP) paired with runtime monitoring of third-party scripts can flag a vendor’s file the moment its behavior changes, not months later in a scheduled review.
- Extend attack surface mapping past your own domains – external attack surface management (EASM) tools typically map an organization’s own internet-facing assets; stretching that discovery to cover every domain serving a script into production closes a gap attackers have used repeatedly.
- Treat vendor access like it can turn hostile any day – multi-factor authentication (MFA) on every vendor and contractor access path, paired with session anomaly detection and time-limited grants, shrinks the window an attacker gets once one login is stolen.
Supply chain-related breaches nearly doubled year over year, climbing from 15 percent to 30 percent of external attacks, according to the 2025 Verizon Data Breach Investigations Report cited by Veracode. Separate threat research tracking malicious URLs and typosquatting found both tactics climbing sharply this year, evidence that attackers are shifting toward exactly the human-trust and browser-level vectors that hit Polymarket, BadgerDAO and Curve.
Veracode’s briefing projects the pressure will stay elevated for another 30 to 90 days. BadgerDAO, Curve and Polymarket span five years and three different teams, and each lost money through the identical unaudited layer.
Frequently Asked Questions
What counts as a software supply chain attack on a website frontend?
It happens when hackers compromise a vendor whose code loads on a legitimate site, rather than attacking the site’s own servers or a blockchain’s contracts directly. The malicious code runs inside a visitor’s own browser, borrowing the trust of the real domain to push fraudulent approvals or transfers past a user who has no way to tell the difference.
Did Polymarket name the vendor that was compromised?
No. Polymarket has not publicly identified the vendor, a gap that outlets including Bleeping Computer and SecurityWeek both noted given the size of the loss. BadgerDAO took the opposite approach in 2021, confirming publicly that its breach ran through a compromised Cloudflare account.
What is ice phishing in crypto?
Ice phishing tricks a user into signing a transaction that grants unlimited spending approval to an attacker’s address, rather than stealing a private key outright. Researchers coined the term to describe BadgerDAO’s 2021 loss, and the same approval-based mechanic, not key theft, shows up in both Polymarket’s June breach and Curve Finance’s DNS hijacks.
How can crypto users protect themselves from a frontend hack?
Security researchers recommend regularly checking and, where needed, using a tool to revoke token approvals before attackers use them, avoiding signature prompts that do not clearly show what a transaction authorizes, and treating an unexpected wallet pop-up with the same suspicion as an unsolicited email attachment.
Disclaimer: This article is for informational purposes only and does not constitute financial, legal or security advice. Cryptocurrency platforms carry inherent risk, and figures cited reflect publicly reported estimates as of publication.
