Polymarket — June 2026 Supply Chain Attack

2025-07-01

CFTC and DOJ drop prior inquiries into Polymarket.

2025-12-01

Polymarket launches CFTC-regulated exchange for U.S. customers.

2026-04-01

Polymarket launches pUSD, an ERC-20 stablecoin backed 1:1 by USDC, as primary collateral on Polygon.

2026-05-22

ZachXBT flags suspicious on-chain activity on Polygon linked to Polymarket. Attacker exploits a compromised private key belonging to an internal operations wallet and drains between $520,000 and $700,000. Polymarket states user funds and contracts are safe.

2026-06-20

The Wall Street Journal publishes an investigation alleging Polymarket used influencers in promotional videos depicting fake winning bets with no real money wagered; approximately 70 percent of videos reviewed contained allegedly deceptive content.

2026-06-25

Supply chain attack occurs. A compromised third-party frontend vendor injects malicious JavaScript into Polymarket's website. At least 11 user wallets are drained of approximately $2.94–$3.1 million in pUSD on Polygon. Stolen funds are bridged to Ethereum and swapped for approximately 1,893 ETH, consolidated into address 0xe65b1C586757c5510B60F998Eebb14C1eF71E1eD.

2026-06-25

Polymarket confirms the breach, removes the compromised dependency, and pledges full refunds to affected users. The compromised vendor is not named publicly.

2026-06-26

CNBC reports the CFTC has opened a new investigation into Polymarket's marketing practices, citing a source with knowledge of the inquiry. U.S. senators urge the CFTC to probe the platform's alleged deceptive advertising.