Polygon hacks in 2026

Coinspect disclosed 'Ill Bloom,' a weak-randomness flaw in some wallets' seed-phrase generation that let attackers brute-force keys and drain over $5 million.

An attacker drained $820,000 in USDC from privacy protocol Hinkal — nearly its entire cross-chain TVL — via unverified 'proofless' deposits, then laundered it through Tornado Cash and THORChain.

A compromised third-party vendor injected a malicious script into Polymarket's frontend, phishing approvals that drained about $2.94M in PUSD from user wallets.