Web3 security incidents: Polymarket frontend compromise and arrest of social engineer

A third-party vendor script on Polymarket led to ~$3M drained from user wallets, while Polish authorities arrested Wojtek Kulisz for social engineering and SIM swapping.

Heat

Confidence

90%

Evidence

Updated

2026-07-09 09:51 UTC

Why It Happened

The Polymarket hack exploited a frontend injection via a compromised vendor, and the arrest targets a known social engineer involved in previous crypto attacks.

Outcome So Far

Polymarket: $3M stolen, swapped to ETH and withdrawn. Wojtek Kulisz arrested with 3 others by Polish authorities in cooperation with FBI.

Actors

PolymarketBet on the future, profit from truth.

Polymarket is the world’s largest prediction market, allowing you to stay informed and profit from your knowledge by betting on future events across various topics. Studies show prediction markets are often more accurate than pundits because they combine news, polls, and expert opinions into a single value that represents the market’s view of an event’s odds. Our markets reflect accurate, unbiased, and real-time probabilities for the events that matter most to you. Markets seek truth.

WOWojtek KuliszArrested social engineer

Timeline order

2026-06-22
Post

Parent event 01

User reports $500k loss on Polymarket

User @qihu00 reported losing $500k across two Polymarket accounts, with positions sold and withdrawn to an external wallet.

X conversation update

1 related posts from @immunefi

Arrest of Wojtek Kulisz for social engineering

Polish law enforcement, in cooperation with the FBI, arrested Wojtek Kulisz (aka 'Merry') and three others for social engineering, money laundering, and SIM swapping.

X conversation update

2 related posts from @immunefi

Polymarket frontend compromise reported

A third-party vendor injected a malicious script into Polymarket's frontend, leading to ~$3M drained from user wallets and swapped to ETH.

X conversation update

1 related posts from @IntCyberDigest