Fact-check findings
What an automated fact-checker found when it re-read Polymarket — June 2026 Supply Chain Attack against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #3[unverifiable][awaiting moderator]in section: CFTC Investigation and Deceptive Marketing Allegations
“which alleged that approximately 70 percent of promotional videos reviewed showcased fake winning bets, with influencers appearing to win on the platform without wagering real money.”
reviewerAccompanying CFTC probe is separate; ~70 percent of promotional videos showed fake wins; WSJ June 20; senators urged probeThe 70 percent figure and the June 20 WSJ date are not found in the two fetched cited sources. The bitcoinworld source was not fetched. The timeline[4] event repeats this figure and shares the issue. - #4[unverifiable][awaiting moderator]in section: Platform Response and Refund Pledge
“No law enforcement referral or public post-mortem identifying the specific vendor or attack vector details had been published as of late June 2026.”
reviewerNo law enforcement referral had been published as of late June 2026Absence claim is consistent with the sources I read but cannot be positively verified. A search summary said Polymarket had not confirmed any regulatory reporting as of late June.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Attack Mechanism and Fund Movement
“On-chain analysts identified the proceeds being consolidated into a single Ethereum address (0xe65b1C586757c5510B60F998Eebb14C1eF71E1eD) after being swapped for approximately 1,893 ETH.”
reviewerProceeds consolidated into a specific Ethereum addressThe address rests on one low-credibility outlet relaying SpecterAnalyst. BleepingComputer lists no addresses. I did not check the address on-chain.
confirmed
4 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“Attackers injected malicious JavaScript that drained approximately $3.1 million in pUSD from at least 11 user wallets on Polygon, with stolen funds bridged to Ethereum and converted to roughly 1,893 ETH.”
reviewerAttack on June 25, 2026 drained about $3.1M pUSD from at least 11 wallets, bridged to Ethereum and swapped to about 1,893 ETHCore figures match sources. Wallet count is a floor (11 to under 15) and the page's 'at least' wording is appropriate. - #5[confirmed][no action needed]in section: Platform Response and Refund Pledge
“The platform committed to making every affected user whole through full refunds and began contacting impacted users directly.”
reviewerPolymarket confirmed the breach on June 25, pledged full refunds, did not name the vendorSupported. - #6[confirmed][no action needed]in section: CFTC Investigation and Deceptive Marketing Allegations
“Notably, both the CFTC and the Department of Justice had previously dropped inquiries into Polymarket in July 2025.”
reviewerCFTC and DOJ dropped inquiries in July 2025; CFTC-regulated exchange launched December 2025Supported. - #7[confirmed][no action needed]in section: Prior Security Incident — May 2026 Private Key Compromise
“Reports placed losses at between $520,000 and $700,000.”
reviewerMay 22, 2026 private key compromise cost $520K to $700KConsistent with the range reported elsewhere. The CoinDesk and BeInCrypto pages were not fetched directly.