Polymarket reported a phishing attack that resulted in approximately $3.1 million being stolen from 11 user wallets, and the platform pledged full refunds to affected PUSD holders. The stolen assets were moved from Polygon to Ethereum via a bridge, according to blockchain intelligence firm AMLBot.

Polymarket, a decentralized prediction market, has experienced several recent security incidents, including a March smart‑contract breach reported by ZachXBT and a December Discord account compromise attributed to an unidentified third‑party login provider. The company is also under a federal investigation following a Wall Street Journal report on alleged deceptive social‑media promotions.

AMLBot updated on X that the theft amounted to roughly $3.1 million in PUSD tokens, which were initially bridged to Ethereum. PeckShield and Specter Analyst indicated that a malicious script injected through a compromised third‑party vendor facilitated the phishing campaign, with estimated losses ranging from $2.94 million to $3.1 million. Polymarket said it has contained the issue, removed the affected dependency, and is contacting impacted users for refunds. The company has not responded to a CoinDesk request for comment.

The incident remains under investigation, and Polymarket has committed to refunding victims in full while addressing ongoing security and regulatory concerns.