Hackers stole roughly $3.1 million in PUSD tokens from 11 user wallets on the prediction platform. The theft followed a phishing attack that exploited a compromised third-party vendor.
Blockchain intelligence firm AMLBot reported Saturday that the funds were taken from Polygon and bridged to Ethereum. Polymarket said the attack occurred after a malicious script was injected into its frontend for some users.
The company pledged full refunds to affected PUSD holders. It stated it had contained the issue and removed the affected dependency.
Separately, Republican Senator John Curtis and Democratic Senator Adam Schiff urged the CFTC to investigate Polymarket. The call followed reports that the platform paid influencers to create videos of fake bets.
Polymarket has faced prior security incidents, including a suspected breach in March and a Discord channel compromise in December.
