Polymarket and JaredFromSubway MEV bot suffer security incidents

Two separate security incidents in the crypto space: Polymarket's frontend was compromised via a third-party vendor, leading to ~$2.9M in user funds stolen. Meanwhile, the JaredFromSubway MEV bot was exploited, resulting in a loss of 4,424 ETH (~$7.5M).

Heat

116

Confidence

90%

Evidence

Updated

2026-07-09 09:51 UTC

Why It Happened

Polymarket breach originated from a compromised third-party vendor, highlighting supply chain attack risks. The JaredFromSubway exploit involved a vulnerability in the MEV bot's code, as analyzed by CertiK.

Outcome So Far

Polymarket has committed to reimbursing all affected users. The JaredFromSubway exploit details are under analysis.

Actors

PolymarketBet on the future, profit from truth.

Polymarket is the world’s largest prediction market, allowing you to stay informed and profit from your knowledge by betting on future events across various topics. Studies show prediction markets are often more accurate than pundits because they combine news, polls, and expert opinions into a single value that represents the market’s view of an event’s odds. Our markets reflect accurate, unbiased, and real-time probabilities for the events that matter most to you. Markets seek truth.

JAJaredFromSubway

Timeline order

2021-12-06
Post

Parent event 01

X conversation update

1 related posts from @ShibainuCoin

X conversation update

1 related posts from @mikebelshe

JaredFromSubway MEV bot exploited for ~$7.5M

On June 20, the JaredFromSubway MEV bot was exploited, losing 4,424 ETH (~$7.5M). CertiK published a full analysis.

Related posts@CertiKAlert@IntCyberDigest

@CertiKAlert2026-06-26 12:05 UTC

Open on X4.1K views · 22 likes · 4 reposts

@IntCyberDigest2026-06-26 23:11 UTC

Open on X1.6K views · 20 likes · 1 reposts

2026-06-26
Post

Parent event 04

X conversation update

2 related posts from @WhiteHatMage, @zippy257