In a post spotted by TechCrunch, Polymarket says “a 3rd party vendor had been compromised, injecting malicious script into our frontend for some users.” The update comes just hours after blockchain security firm PeckShield notified users of a potential phishing campaign targeting Polymarket users. Around $3 million worth of Polymarket’s crypto token was drained from user wallets, PeckShield says. [Image: https://platform.theverge.com/wp-content/uploads/sites/2/2026/06/peckshield-polymarket.png?quality=90&strip=all]

Hackers drained roughly three million dollars from Polymarket users after a compromised vendor injected malicious code into the platform's website.

Hackers infiltrated Polymarket’s website via a compromised third-party vendor, the company said, swiping millions in crypto from users.