Blockchain intelligence firm AMLBot updated on Saturday that hackers stole roughly $3.1 million in PUSD tokens from 11 user wallet accounts on Polymarket. The assets were taken from Polygon and immediately bridged to Ethereum. AMLBot said it continues to monitor Polymarket accounts.
Polymarket pledged full refunds to victims holding its native collateral and settlement token PUSD, used for all trades on the decentralized prediction platform. On Thursday, Polymarket stated on X: "This morning we discovered a third party vendor had been compromised, injecting a malicious script into our frontend for some users. We've contained it and removed the affected dependency." The company confirmed it is contacting impacted users and refunding them in full.
Blockchain security firm PeckShield reported via X that hackers deployed a phishing campaign targeting Polymarket users, initially estimating stolen funds at roughly 1,893 ETH. Another intelligence platform, Specter Analyst, noted losses of approximately $2.94 million from the attack.
One victim named Ash shared on X that his wallet was hacked and he had no idea why at the time. He also published both his and the attacker's wallet addresses.
Polymarket has suffered other security breaches recently. In March, investigator ZachXBT flagged a suspected breach where over $520,000 was reportedly drained from two smart contracts on Polygon. Polymarket then said the funds were safe. In December, the platform confirmed a security incident on its Discord channel after users reported missing funds, blaming an unidentified third-party login provider.
The phishing attack news follows reports that Polymarket is under federal investigation after a Wall Street Journal article about deceptive social media promotion by users claiming winnings.