On June 25, 2026, Polymarket frontend was compromised via third-party vendor, injecting malicious JavaScript that phished users into approving fraudulent token transfers, draining $3M from at least 11 wallets.