Polymarket disclosed a security breach that resulted in about $3.1 million being taken from 11 user wallets holding PUSD. The loss occurred via a phishing attack that used malicious code injected by a compromised third‑party vendor into the platform’s website.

The prediction market platform had previously pledged to refund affected users after the same vendor issue was identified. The incident follows earlier security events in March, when $520,000 was reported missing from two smart contracts, and a December report of unauthorized account access on its Discord channel. The quarter has seen a record number of reported security incidents, according to DefiLlama.

AMLBot updated its estimate to $3.1 million, up from an earlier $2.94 million. Specter Analyst identified the attack as a phishing campaign that drained funds from at least 11 wallets. PeckShield reported that the attacker transferred the stolen PUSD to Polygon, bridged it to Ethereum, and swapped it for roughly 1,893 ETH, which were consolidated into a single Ethereum address. Polymarket said the compromised dependency was removed and that it is contacting the affected users to fulfill its full refund commitment.

U.S. Senators Adam Schiff and John Curtis wrote to the Commodity Futures Trading Commission, requesting a review of alleged deceptive advertising practices related to Polymarket’s prediction markets. The senators asked whether the platform used simulated trading websites, staged transactions, or undisclosed influencer payments, and whether the CFTC has sufficient authority to protect users. Polymarket and Kalshi are also involved in ongoing litigation concerning sports event contracts, with Kentucky alleging unlicensed sports betting and the CFTC asserting federal derivatives jurisdiction.

The incident highlights the risks associated with third‑party integrations in decentralized finance interfaces and remains under investigation by regulators.