Polymarket User Losses Rise to $3.1 Million After Phishing Attack

Blockchain intelligence firm AMLBot has raised its estimate of losses from a phishing attack targeting Polymarket users to approximately $3.1 million. The firm said hackers took PUSD from 11 wallets on Polygon and immediately bridged the assets to Ethereum.

The incident matters because it exposed users through Polymarket’s frontend rather than through a disclosed failure of the underlying prediction markets themselves. Polymarket said a compromised third-party vendor injected a malicious script for some users, highlighting the security risks created by external software dependencies.

Polymarket said it contained the incident, removed the affected dependency and began contacting victims. The platform also pledged to reimburse affected holders of PUSD, the collateral and settlement token used for trading on its decentralized prediction platform.

Initial estimates varied. Blockchain security firm PeckShield reported that stolen funds worth roughly 1,893 ETH had been bridged, while Specter Analyst estimated losses at $2.94 million. AMLBot said it continues to monitor Polymarket accounts.

The attack follows other reported security issues involving Polymarket. A suspected breach affecting two Polygon smart contracts was reported in March, while the platform attributed account breaches disclosed in December to an unidentified third-party login provider. Separately, reports say Polymarket is under federal investigation over allegedly deceptive social media promotions involving users publicizing winnings.