A third-party vendor compromise allowed attackers to inject malicious code into Polymarket’s frontend, leading to a phishing drain from user wallets, according to blockchain analyst Specter. The incident was discovered on Thursday and reportedly targeted at least 11 Polymarket users, with Specter estimating losses of $2.94 million.

Polymarket said on X that the issue has been contained, the affected dependency removed, and that users will be fully refunded. While Cointelegraph attempted to follow up for additional comment, no response was received before publication.

Key takeaways

• Specter attributed the Polymarket incident to malicious script injection following a vendor compromise, with an estimated $2.94 million drained from at least 11 wallets.
• Polymarket states the compromise has been contained and that the impacted dependency was removed, with full user refunds promised.
• DefiLlama data shows June exploit losses reached $74.9 million across 29 incidents—more than May’s $60.5 million, but far below April’s $644 million.
• Across the last 30 days, private key compromises accounted for 43% of reported exploit losses, making it the leading attack vector.
• DefiLlama’s breakdown points to other recurring methods, including “fake proof” exploits (10%) and reverse MEV honeypots (8%).

Polymarket: vendor compromise leads to frontend phishing

Specter said the malicious script appeared to be designed to facilitate phishing, ultimately draining funds from multiple Polymarket wallets. The key operational detail in the account is that the attacker did not need to compromise Polymarket’s core smart contracts directly; instead, the issue originated from a third-party vendor compromise that enabled code injection into the platform’s frontend.

That distinction matters for users because frontend-based attacks can succeed even when on-chain contracts remain intact. In practice, phishing scripts can trick users into approving malicious actions, entering credentials into spoofed interfaces, or signing transactions that benefit attackers.

Polymarket’s response emphasized containment and remediation: the platform said the compromise has been stopped, the problematic dependency removed, and affected users will receive full refunds. With those steps, the immediate risk of further wallet draining should decline, though users will still want to monitor their accounts and transaction history for any suspicious approvals.

Why this sits within a larger pattern of crypto incidents

The Polymarket event comes amid a sustained run of reported crypto security breaches. DefiLlama data lists the Polymarket incident as the 89th reported crypto security breach of the second quarter. That count extends what DefiLlama categorization describes as the most-hacked quarter on record by incident count.

Earlier in June, DefiLlama’s monthly totals already reflected elevated activity. June exploit losses climbed to $74.9 million across 29 reported incidents, surpassing May’s $60.5 million. However, April’s $644 million remains the standout outlier for magnitude, underscoring that while breach frequency remains high, individual months can vary dramatically based on whether large incidents occur.

June’s reported exploit losses: the biggest June incidents

DefiLlama’s aggregation highlights several of the largest June events. The most prominent was the $36 million Humanity Protocol exploit. Other notable losses included the $4.7 million Secret Network bridge exploit, two Aztec-related exploits worth $2.1 million each, and a $1.7 million bridge exploit tied to Taiko, according to the article’s cited figures and linked coverage.

Taken together, the list shows that bridge ecosystems and cross-chain integrations continue to attract high-impact attacks. While frontend phishing attacks like Polymarket’s are distinct from bridge exploits, both categories fall under the broader umbrella of “exploit losses”—the measurable outcomes when attackers successfully compromise systems or user interactions.

Attack vectors over the last month: key compromise still leads

DefiLlama data summarized in the piece indicates that the primary driver of reported exploit losses over the past 30 days was private key compromise, responsible for 43% of losses. Fake proof exploits accounted for 10%, while reverse MEV honeypots made up 8% of losses, based on DefiLlama’s breakdown.

The vector mix is useful because it shifts how defensive priorities are framed. Private key compromise suggests either user-side weakness (including wallet security practices) or operational weaknesses involving signing keys—issues that often persist across unrelated protocols. Meanwhile, fake proof and reverse MEV honeypots reflect more sophisticated adversarial tactics at the application and execution layers, targeting how systems validate claims or how trading bots execute orders.

The article also notes that roughly a month before Polymarket’s latest attack, the prediction market disclosed a separate $600,000 exploit traced to a six-year-old private key used for internal top-up operations. Polymarket leadership said at the time that user funds and contracts were safe and that permissions tied to the key had been revoked, emphasizing that the platform has dealt with operational key risks before.

Polymarket’s scale and what users should monitor next

DefiLlama data cited in the article places Polymarket’s total value locked at over $450 million, up 301% from $112 million a year earlier. As platforms grow, they often become more attractive targets—not only for contract-level attacks but also for the broader supply-chain and integration risks that can surface through third-party dependencies.

Going forward, readers should watch for two signals: confirmation from Polymarket and security analysts that the injected frontend dependency is fully removed and no similar vendor-based pathways remain, and whether wallet-level incidents prompt changes in how users interact with the platform (for example, renewed scrutiny of approvals and transaction prompts). With refunds promised, the immediate impact may be contained, but the recurrence of earlier key-related disclosures underscores that operational security remains a critical focus for both users and the platforms they rely on.

Key Takeaways

• Samsung Electronics shares plummeted 7.8% to ₩330,500 Friday amid a broad technology sector selloff across Korean exchanges
• Investor sentiment deteriorated after Apple revealed price hikes for MacBook and iPad products, casting doubt on AI hardware demand
• Amplified losses occurred through leveraged single-stock ETFs focused on Samsung and SK Hynix
• The KOSPI index tumbled over 8%, activating its fifth circuit breaker halt in 2026
• Reports emerged of Samsung preparing a ₩1,000 trillion ($646 billion) decade-long investment strategy covering chips, AI infrastructure, and more

Samsung Electronics shares collapsed 7.8% to close at ₩330,500 Friday, compounding a devastating week that witnessed a single-day decline exceeding 12% just two days earlier on June 23.

Samsung Electronics Co., Ltd., SMSD.L

The Monday session’s plunge activated the KOSPI’s fourth trading halt of 2026. Friday’s action brought a fifth suspension, with the Korea Exchange implementing a 20-minute freeze beginning around 12:10 p.m. Seoul time as the main index crashed through the 8% decline threshold.

The catalyst for Friday’s turmoil originated from Apple, which revealed significant price increases spanning its MacBook and iPad product portfolios, citing elevated memory and component expenses. The announcement shattered confidence among investors banking on a prolonged AI-fueled hardware expansion cycle.

Chip manufacturers worldwide absorbed heavy losses. SK Hynix, Samsung’s primary domestic competitor, suffered a parallel decline exceeding 8%, while leveraged ETFs tracking both semiconductor leaders plunged beyond 15%.

Leveraged Products Intensified Selling Pressure

Single-stock leveraged exchange-traded funds concentrated on Samsung and SK Hynix have emerged as a mounting worry for South Korean financial authorities. Friday’s session validated those concerns as these instruments amplified market movements far beyond what underlying business fundamentals would typically justify.

The outcome generated a self-reinforcing cycle of liquidation that punished Samsung more severely than headline developments alone warranted.

Japan’s Nikkei 225 index similarly declined in response, demonstrating the velocity at which the selloff propagated throughout the region.

Following a substantial rally during the previous twelve months, Friday’s decline partially reflects profit-taking behavior after an impressive advance. Market reversals can accelerate dramatically when investor psychology shifts.

Massive $646 Billion Capital Plan Sparks Investor Anxiety

The timing proved particularly unfortunate. Domestic media outlets disclosed this week that Samsung intends to unveil a ₩1,000 trillion ($646 billion) investment blueprint spanning the next ten years — potentially representing the largest corporate capital commitment in South Korean corporate history.

The initiative reportedly encompasses semiconductor manufacturing facilities, AI data infrastructure, battery production, and display technology. Approximately ₩300 trillion targets chip fabrication plants in the nation’s southwestern region, while more than ₩350 trillion focuses on AI data centre development.

South Korean President Lee Jae Myung plans to convene a national economic presentation on June 29, where Samsung Vice Chairman Jun Young-hyun and SK Hynix CEO Kwak Noh-jung will both outline their respective investment strategies.

Rather than embracing the announcement enthusiastically, certain investors interpreted the enormous spending obligation as problematic. Committing hundreds of trillions of won toward infrastructure development during uncertain chip demand conditions represents considerable risk exposure.

SK Hynix independently disclosed intentions to secure up to $29.4 billion through a Nasdaq listing of American Depositary Receipts, channeling proceeds toward expanded fabrication plants, advanced packaging operations, and manufacturing equipment.

Both declarations arrive as South Korea endeavors to maintain competitive positioning in the worldwide AI and semiconductor landscape amid escalating competition from the United States and China.

SK Hynix shares traded down 8.36% at press time, while Samsung recovered slightly to ₩339,500 after trimming earlier losses.

Sharplink (SBET) received 5,000 ether (ETH) worth about $7.85 million on Thursday, its first ether inflow in eight months, according to Arkham data showing the coins arriving from crypto brokerage FalconX.

The inflow is small against the company’s existing pile and lands at an awkward moment. Sharplink held 876,285 ether as of June 21, worth roughly $1.3 billion, making it the second-largest public ether treasury company behind Tom Lee’s Bitmine Immersion (BMNR), which held about 5.67 million ether in mid-June.

Onchain analyst EmberCN put Sharplink’s average purchase price at about $3,609 per coin, which implies an unrealized loss of around $1.79 billion with ether trading near $1,555.

Its last inflow came in October 2025, when it added 19,270 ether for $78.3 million, also now deep underwater.

The ether arrived as the token fell 5% over 24 hours in a broad crypto selloff, dropping below $1,560 as bitcoin slipped under $59,000. Tether’s USDT briefly overtook ether by market value during the rout, at about $186 billion to ether’s $185 billion.

South Korea has expanded cryptocurrency disclosure requirements for its public debt relief program by including virtual asset holdings in applicant asset reviews and linking debt forgiveness more closely to repayment capacity.

According to local media, the Financial Services Commission said after a June 25 review meeting with the Korea Asset Management Corporation (KAMCO) that it would revise the New Start Fund, a debt restructuring program for small business owners and self employed borrowers, to strengthen property assessments, debt adjustment standards, and post approval monitoring.

Authorities will now examine investment assets such as cryptocurrencies and unlisted shares that were previously difficult to verify through financial statements and government administrative records. The commission said the changes aim to distribute public support more efficiently and prevent unnecessary spending.

Applicants identified as users of South Korea’s five major won based cryptocurrency exchanges have been required to submit virtual asset balance certificates since January after the government reached agreements with the exchanges. KAMCO uses the documents during property assessments to determine eligibility for debt relief.

Officials also began requiring applicants to disclose holdings of unlisted shares in May. Shares in privately held companies operated directly by the applicant remain excluded from property reviews because authorities considered the need to preserve business income.

Debt relief tied to repayment capacity

The Financial Services Commission said debt forgiveness under the New Start Fund will depend more closely on each applicant’s repayment ability.

Current rules allow principal reductions of 60% to 80% for unsecured debt that has remained delinquent for more than 90 days, with low-income and vulnerable borrowers eligible for reductions of up to 90%. The commission said the existing minimum reduction left limited room to distinguish borrowers with stronger repayment capacity.

Borrowers whose repayment capacity exceeds 100% will now face a minimum principal reduction of 30% instead of 60%. Authorities will lower debt relief by between 5 and 30 percentage points, depending on repayment ability.

Amendments to South Korea’s Credit Information Act, which take effect on Aug. 13, will allow government debt restructuring agencies to obtain property information in bulk. The Financial Services Commission said authorities will receive cryptocurrency and unlisted share data regularly from relevant institutions to verify applicants’ asset declarations after debt restructuring approvals.

South Korea has introduced several digital asset policy measures this month beyond the New Start Fund revisions. 

The Financial Services Commission recently proposed expanding its regulatory sandbox to cover digital asset laws, while the government has also approved a licensing framework for cross-border virtual asset transfers that will take effect in December. 

Authorities have introduced these measures as digital asset activity continues to grow across South Korea’s financial sector. As previously reported by crypto.news, cryptocurrency-based overseas remittances increased 380% over the past three years as banks and fintech firms have continued to develop blockchain-based payment infrastructure.

Ripple built its identity on replacing SWIFT, the bank-messaging network that moves roughly $150 trillion a year, with XRP as the bridge that would kill slow correspondent banking. A decade on, the banks kept SWIFT, adopted Ripple as a fast lane beside it, and the disruptor is learning to integrate. What that pivot means for XRP is the real question.

For most of its existence, Ripple defined itself by a single enemy: SWIFT, the global messaging network that connects roughly 11,000 banks and underpins the movement of something like $150 trillion a year.

Ripple’s founding pitch was that SWIFT was slow, antiquated plumbing, that moving money across borders through it took days and trapped capital in pre-funded accounts around the world, and that XRP could replace all of that by acting as a neutral bridge asset that settled value in seconds.

The company’s executives spent years framing the contest in exactly those terms, as a young, fast technology coming to take the lunch of an aging incumbent.

Polymarket has confirmed that attackers compromised a third party vendor and used the access to inject malicious code into the platform’s frontend, leading to a phishing attack that drained an estimated $2.94 million from users.

Polymarket disclosed on X that it has removed the affected dependency, contained the incident, and will fully reimburse affected users. 

Blockchain analyst Specter estimated that the attack drained funds from at least 11 wallets after the malicious script appeared on the platform’s frontend.

Frontend compromise targets user wallets

Specter identified the attack as a phishing campaign rather than a protocol exploit. The analyst said the injected script enabled attackers to steal funds from connected wallets after users interacted with the compromised interface.

DefiLlama recorded the incident as the 89th reported crypto security breach of the second quarter, making it the highest quarterly total by incident count in the platform’s records.

DefiLlama also reported $74.9 million in losses across 29 crypto exploits during June. That total exceeded May’s $60.5 million but remained well below April’s $644 million.

The platform listed the $36 million Humanity Protocol exploit as June’s largest attack. Other major incidents included a $4.7 million exploit involving the Secret Network bridge, two separate $2.1 million exploits affecting Aztec, and a $1.7 million bridge exploit on Taiko.

DefiLlama reported that private key compromises accounted for 43% of exploit losses over the past 30 days. Fake proof exploits represented 10% of losses, while reverse MEV honeypots accounted for 8%.

Previous exploit traced to compromised private key

Polymarket disclosed a separate security incident about a month earlier after attackers exploited a six year old private key used for internal top up operations and stole about $600,000.

Security researchers, including ZachXBT, PeckShield, and Bubblemaps, initially flagged suspicious activity involving Polymarket’s UMA CTF Adapter contract on Polygon. Bubblemaps reported that attackers withdrew 5,000 POL every 30 seconds before estimating total losses at roughly $600,000.

Polymarket protocol contributor Shantikiran Chanal later attributed that incident to a compromised wallet used for internal operations rather than a vulnerability in the platform’s contracts or core infrastructure. 

Josh Stevens, the company’s vice president of engineering, stated at the time that user funds and smart contracts remained secure and that all permissions linked to the compromised key had been revoked.

Grant Cardone, CEO of Cardone Capital, used this week’s crypto slide to restate the case for his bitcoin-and-property model, saying the structure is designed to keep buying as prices fall.

“We work to improve the cash flow of the real estate and buy more bitcoin as it falls,” Cardone said in a post on X.

Cardone Capital, which has about $5.3 billion under management, uses the income generated from its real estate assets to buy bitcoin BTC$60,011.17 at regular intervals regardless of its price, smoothing out the expenditure in a process known as dollar-cost averaging. The largest cryptocurrency has lost 4.7% this week.

Cardone said the model was “inspired by treasury companies but with real assets and real cash flow,” and called his firm the largest real estate-bitcoin hybrid in the world, with no institutional investors shaping its strategy.

His comment draws a distinction with the corporate bitcoin treasury model popularized by Strategy (MSTR), in which companies raise money by issuing stock or debt to buy bitcoin.

That approach has come under pressure this week, with Strategy’s stock trading below the value of the bitcoin it holds and analysts at CryptoQuant arguing the firm has overextended itself.