Blockchain intelligence firm AMLBot has confirmed the Polymarket phishing attack cost users approximately $3.1 million in PUSD, providing the first forensically verified on-chain dollar total and tracing stolen assets from Polygon to Ethereum.
The attack occurred Thursday through a supply-chain compromise. On-chain investigator Specter helped track the theft across the two blockchains, establishing a clear path from the initial compromise to the stolen funds' current location.
The cross-chain movement
The fact that attackers moved funds from Polygon to Ethereum signals an intentional exit strategy. Ethereum's larger and more liquid stablecoin infrastructure makes it the natural choice for converting or moving compromised assets. Polygon-based tokens are harder to liquidate at scale without triggering detection, making the cross-chain bridge a logical next step for attackers seeking to obscure or cash out.
AMLBot's investigation identified 11 distinct wallets holding portions of the stolen funds, suggesting either multiple attackers or a deliberate fragmentation of the haul to complicate recovery and tracing efforts. The PUSD denomination confirms the theft targeted Polymarket's native stablecoin, not ETH or other assets held on the platform.
Next steps unclear
The newsroom has not seen public statements from Polymarket addressing reimbursement, liability, or account-recovery timelines. AMLBot's forensic work establishes what happened and where the funds went, but enforcement and asset recovery depend on cooperation between the platform, law enforcement, and blockchain analysts. Whether the 11 wallets remain static or continue moving the stolen assets will shape the difficulty of any recovery attempt.
Users who lost funds through the phishing vector face an open question about whether Polymarket will reimburse losses or classify the compromise as user-side negligence. Platforms have historically taken varying positions on stolen-credential scenarios, where attackers gain access through social engineering rather than a direct vulnerability in the platform's code.