Polymarket Got Hacked 3 Times in 6 Months — Now the CFTC Is Watching

$3.1 million. 11 wallets. Zero phishing links clicked.

Polymarket users who did absolutely everything right — kept their seed phrases offline, used hardware wallets, never clicked suspicious links — still got drained this week. The attack didn’t touch private keys. It hijacked the website itself.

And while the company scrambles to cover losses, the CFTC just opened an investigation.

The Hack: A Supply Chain Attack You Can’t Defend Against

On June 25, 2026, a compromised third-party vendor injected malicious JavaScript into Polymarket’s frontend. When users visited the site and approved normal-looking transactions, the malicious code silently redirected their PUSD to attacker wallets.

The attacker converted roughly 1,893 ETH from Polygon and immediately bridged it to Ethereum — the classic obscuring move — before anyone noticed.

11 wallets. $3.1 million. Gone.

Polymarket confirmed the breach and said it had “contained it and removed the affected dependency.” The company pledged to contact impacted users and refund them in full.

That’s the good news.

The bad news: this is the third time in six months.

The Pattern Is Getting Hard to Ignore

Date	Incident	Amount
December 2025	Third-party login provider compromised; user accounts breached	Undisclosed
March 2026	Smart contract exploit	~$520,000
June 2026	Frontend supply chain attack	$3.1 million

Three security incidents. Three different attack vectors. All via third-party dependencies.

This isn’t a fluke — it’s a systemic failure in vendor security practices. Every time Polymarket outsources part of its stack, that dependency becomes an attack surface. And they keep getting hit.

Then the CFTC Showed Up

The hack landed in the middle of a separate crisis: Bloomberg and CNBC both reported on June 26 that the CFTC has opened a broad investigation into Polymarket’s operations.

The focus? Deceptive marketing.

A Wall Street Journal investigation found that 70% of over 1,100 Polymarket promotional videos showed fake bets and simulated winnings — with most creators not disclosing paid relationships. The CFTC is examining whether those practices violated consumer protection standards.

Two US senators called the findings “deeply troubling” and demanded action.

For context: the CFTC previously dropped inquiries into Polymarket in July 2025. This is a new probe under Chairman Michael Selig — who has otherwise been crypto-friendly — which signals that even friendlier regulators have limits.

Polymarket reportedly crossed $1 billion in cumulative revenue. That scale made them impossible to ignore.

Why This Matters for Crypto Jobs

The double hit on Polymarket — hack + regulatory investigation — sends signals across the entire prediction market and DeFi security space.

Where jobs are being created right now:

• Smart contract auditing firms (Trail of Bits, Spearbit, Zellic) are overwhelmed. Q2 2026 saw 89 DeFi security incidents — a new record. Every protocol that survived is now racing to add audit coverage before the next wave.
• Frontend security engineers — the Polymarket breach is a supply chain attack, which means Web2-style security skills (dependency auditing, CSP hardening, subresource integrity) are suddenly DeFi-critical. Companies are hiring for this hybrid profile aggressively.
• Compliance and regulatory affairs — with the CFTC actively probing prediction markets and a wave of enforcement across DeFi, every crypto company above a certain size is building legal/compliance teams in-house. These roles are high-paying and scarce.
• Incident response specialists — the gap between “crypto native” and “security hardened” is costing protocols hundreds of millions. Experienced Web2 incident response engineers who can work in a crypto context are essentially unicorns right now.

The Polymarket saga is a preview of where the industry is heading: more regulation, more scrutiny, and much higher standards for who you trust with user funds. The companies that survive will be the ones that hire accordingly.

---

Looking for your next role in crypto security, compliance, or Web3 infrastructure? Cryptogrind lists jobs at the companies building the next generation of secure, regulated crypto infrastructure. Skip the noise — find roles that matter.