Polymarket Hack Estimated Losses Reach $3.1 Million Amid Ongoing Investigation

Polymarket reports that hackers stole around $3.1 million in its prediction market token PUSD, affecting 11 user wallets. The theft occurred after a third-party vendor injected a malicious script into Polymarket's frontend, as per findings from blockchain intelligence firm AMLBot. Following this incident, Polymarket assured full refunds for all impacted users holding PUSD.

AMLBot's monitoring indicates that the stolen funds were moved from the Polygon network to Ethereum shortly after the breach. Polymarket acknowledged the attack on June 27, 2026, stating, "This morning we discovered a third party vendor had been compromised, injecting a malicious script into our frontend for some users. We’ve contained it and removed the affected dependency. We’re contacting impacted users and refunding them in full." This commitment to user security comes in the wake of earlier incidents involving security breaches.

Previous to this hack, Polymarket had faced other security challenges, including a suspected breach in March that drained over $520,000 from two smart contracts and a Discord security incident in December linked to unauthorized access attempts. These ongoing security concerns have coincided with reports that Polymarket is under federal investigation for potentially deceptive marketing practices that misrepresented user winnings on social media.

Blockchain security platform PeckShield corroborated the findings, confirming that a phishing campaign targeted Polymarket users and highlighted the financial losses that followed. The attack resulted in an initial estimate of 1,893 ETH being stolen. One victim of this phishing attack recounted their experience on social media, detailing how their wallet was compromised.

As Polymarket navigates the implications of this security breach and the federal investigation, all eyes will be on the platform's response strategies and how it addresses both user security and regulatory scrutiny in the future.