Polygon hacks in 2026

A server intrusion drained crypto casino Gamdom's hot wallets across several chains for roughly $4.2 million in a suspected key compromise.

An estimated $86 million was drained from Ledger users who bought devices from reseller CryptoBilis, in a suspected supply-chain attack that captured their seed phrases.

Attackers abused a flaw in Limit Break's Payment Processor NFT contract — still holding stale approvals from Magic Eden users — to drain tokens and NFTs worth at least $2.8 million across five chains.

An attacker fed Allbridge's Base router a forged Circle CCTP message and padded it with an Aave flash loan to drain about $190,000 in USDC that a real deposit had just credited.

Coinspect disclosed 'Ill Bloom,' a weak-randomness flaw in some wallets' seed-phrase generation that let attackers brute-force keys and drain over $5 million.

An attacker drained $820,000 in USDC from privacy protocol Hinkal — nearly its entire cross-chain TVL — via unverified 'proofless' deposits, then laundered it through Tornado Cash and THORChain.

A compromised third-party vendor injected a malicious script into Polymarket's frontend, phishing approvals that drained about $2.94M in PUSD from user wallets.