business
Polymarket Users Lose $3.1 Million in Phishing Attack, Platform Promises Refunds
Coindesk.com reported that hackers stole about $3.1 million in PUSD tokens from 11 user wallets on the prediction platform. The company said a compromised vendor injected malicious code and pledged full refunds to affected holders.
coindesk.comAudio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
Hackers stole about $3.1 million in Polymarket’s PUSD token from 11 user wallets, according to blockchain intelligence firm AMLBot. The funds were moved from Polygon to Ethereum, AMLBot said on X on Saturday. Polymarket stated on X on Thursday that a compromised third-party vendor had injected a malicious script into its frontend.
The platform removed the affected dependency and pledged full refunds to impacted PUSD holders. Blockchain security firm PeckShield reported on X on Thursday that hackers had deployed a phishing campaign targeting Polymarket users. It estimated the stolen funds at roughly 1,893 ETH.
Specter Analyst posted on X the same day that estimated losses reached $2.94 million. One victim posted on X that his wallet had been drained and shared the attacker’s address. Polymarket did not respond to a CoinDesk request for comment as of Saturday morning.
The platform has faced prior security issues. In March, investigator ZachXBT reported over $520,000 drained from two Polygon smart contracts. In December, Polymarket confirmed a security incident on its Discord channel and blamed an unidentified third-party login provider.
Coindesk.com reported that Polymarket is under federal investigation over allegedly deceptive social media promotions.
