protocol
A PIP posted Nov 4 would, at a fixed activation block, zero five attacker-held POL balances and credit 70.49M POL (~$6.5M) to recovery addresses controlled by Polymarket and Binance.
exploit
Polymarket placed its exchange in cancel-only mode on Oct 29 after an unnamed third-party provider was compromised and ~$2.65M in USDC.e was swapped to POL via Relay to a single attacker address.
protocol
Polymarket's V2 replaces Gnosis Conditional Tokens with a single ERC-1155 contract, pUSD-only collateral, and a pluggable oracle layer (UMA plus Chainlink).
exploit
A poisoned JS dependency on Polymarket's frontend drained ~$3.1M in PUSD from 11+ wallets on June 25, swapped into ~1,893 ETH. Contracts untouched; refunds promised.