Hackers Steal $3.1 Million From 11 Polymarket Wallets as Vendor Breach Injects Phishing Script
Updated
Updated · CoinDesk · Jun 27
Hackers Steal $3.1 Million From 11 Polymarket Wallets as Vendor Breach Injects Phishing Script
3 articles · Updated · CoinDesk · Jun 27
Summary
$3.1 million in PUSD was stolen from 11 Polymarket user wallets, with the funds moved from Polygon to Ethereum, according to AMLBot's updated estimate.
Polymarket said a compromised third-party vendor injected a malicious script into its frontend for some users; the platform said it removed the dependency, contained the attack and will fully refund affected PUSD holders.
PeckShield had initially pegged losses at about 1,893 ETH, while Specter Analyst estimated roughly $2.94 million; one victim said his wallet was drained without knowing why at the time.
The phishing incident adds to Polymarket's recent security troubles, including a March smart-contract scare and a December breach tied to a third-party login provider, and comes amid reports of a federal probe over allegedly deceptive social-media promotions.