Polymarket Hack Losses Rise To $3.1 Million After Refund Promise

Blockchain intelligence firm AMLBot updated its estimate Saturday, saying hackers stole roughly $3.1 million in PUSD, Polymarket’s collateral token, from 11 user wallets. The funds were pulled from Polygon and bridged straight to Ethereum. AMLBot says it’s still monitoring affected accounts. Polymarket hadn’t responded to requests for comment as of Saturday morning.

Polymarket Promised Full Refunds

Right after the breach went public, Polymarket said a compromised third-party vendor injected a malicious script into its frontend. The platform said it contained the issue, removed the affected dependency, and is contacting and refunding victims in full. Security firm PeckShield first flagged the phishing campaign Thursday, initially estimating losses near 1,893 ETH.

Specter Analyst put early losses at $2.94 million. One victim, known as Ash, said his wallet was drained without warning and shared both wallet addresses online.

Not Polymarket’s First Security Scare

This isn’t an isolated incident. In March, ZachXBT flagged a suspected exploit draining $520,000 from Polygon smart contracts, though Polymarket said funds were safe. In December, the platform confirmed a separate breach tied to a third-party login provider. The hack also comes as Polymarket faces a federal investigation following Wall Street Journal reports on its deceptive social media marketing.