Hackers stole approximately $3.1 million in Polymarket's PUSD token from 11 user wallets, with the funds moved from Polygon to Ethereum, according to blockchain intelligence firm AMLBot. The updated figure comes days after the prediction markets platform disclosed a security breach involving a compromised third-party vendor and pledged full refunds to affected users.

Market Context

The hack represents another security incident for Polymarket, one of the largest decentralized prediction markets platforms. The theft occurred as the platform faces separate federal investigation into allegedly deceptive social media promotions targeting new users. Cryptocurrency markets have seen increased scrutiny following multiple high-profile security breaches across exchanges and DeFi protocols this year.

Analysis

Polymarket attributed the attack to a compromised third-party vendor that injected a malicious script into its frontend, affecting some users. The platform moved quickly to contain the breach by removing the affected dependency and announcing compensation for victims holding PUSD—the native collateral and settlement token used for all trading on the decentralized platform. Blockchain security firm PeckShield initially reported the stolen funds at approximately 1,893 ETH, valued then at roughly $2.94 million, before AMLBot revised the estimate higher to $3.1 million.

The incident adds to a pattern of security challenges for Polymarket. In March, blockchain investigator ZachXBT highlighted a suspected breach where over $520,000 was reportedly drained from two smart contracts on the Polygon blockchain, though Polymarket later claimed those funds were safe. The platform also confirmed a Discord security incident in December, blaming an unidentified third-party login provider for account breaches and missing funds.

Federal investigators are separately examining whether Polymarket engaged in deceptive marketing practices through social media promotions featuring users boasting of winnings, according to reports citing a Wall Street Journal investigation into the prediction markets platform.

Key Numbers

- $3.1 million: Updated theft estimate from 11 user wallets in PUSD tokens

- 11: Number of user wallet accounts affected by the hack

- ~1,893 ETH: Initial estimated value of stolen funds before AMLBot revision

- $520,000+: Amount reportedly drained in March Polygon smart contract incident

What to Watch

Polymarket's refund execution timeline for affected PUSD holders will be closely monitored. Traders should track whether the platform implements enhanced third-party vendor screening protocols following multiple security incidents. The ongoing federal investigation into the platform's marketing practices could present regulatory headwinds if substantiated, potentially impacting user growth and trading volume on the decentralized prediction market.

The broader crypto security landscape remains under pressure as threat actors continue targeting both centralized exchanges and DeFi protocols with increasingly sophisticated attack vectors.