AMLBot says the Polymarket phishing incident affected 11 user wallets and caused approximately $3.1 million in PUSD losses. According to the supplied event brief, the funds moved from Polygon to Ethereum and were converted to ETH. Polymarket has pledged full refunds, but the compromised vendor has not been named.
| Primary source | TheDefiant |
|---|---|
| Reported at | 2026-06-27T17:13:43.000Z |
| Topic | ETH |
| Evidence limit | Reported facts are separated from interpretation; current prices and platform terms require independent verification. |
Evaluate BITGET for your use case
Check regional eligibility, current fees and product availability on the official destination.
Review BITGETWhat Happened
The supplied brief describes a Polymarket supply-chain attack confirmed by blockchain intelligence firm AMLBot. The confirmed toll is approximately $3.1 million in PUSD across 11 user wallets.
The event is categorized under ETH because the funds were traced to Ethereum after moving from Polygon. The affected assets listed in the brief are ETH and MATIC.
Why Ethereum Matters
The key chain movement in this event is the bridge from Polygon to Ethereum. Once the funds reached Ethereum and were converted to ETH, investigators and users had to focus on Ethereum-side transaction paths rather than only the original Polygon activity.
This does not mean Ethereum itself failed. Based on the supplied material, the incident is a phishing and supply-chain compromise, not a claim about a base-layer Ethereum or Polygon protocol exploit.
Decision-Useful Analysis
For users, the main issue is not only the stated dollar loss. It is the combination of a supply-chain attack, multiple affected wallets, cross-chain movement, and conversion into ETH. That pattern can make response more complicated than a single-chain theft.
For platforms, the vendor question remains important. Polymarket has pledged full refunds, but the brief says it has not named the compromised vendor. Until that detail is public, outsiders cannot fully evaluate which integration, dependency, or operational control failed.
Evidence Limits
This article uses only the supplied event brief as factual source material. The brief attributes the confirmation to AMLBot and cites The Defiant as the source, with a timestamp of June 27, 2026.
The supplied material does not include transaction hashes, wallet addresses, a named vendor, a refund schedule, legal findings, or a postmortem. Those gaps limit what can be concluded about attribution, recovery probability, or broader market impact.
Practical Checks
Users who interacted with Polymarket or related signing flows should review recent wallet activity on Polygon and Ethereum, especially approvals, bridge transactions, and unexpected PUSD or ETH movements. The priority is to verify what was signed, not to assume every prompt was harmless.
A cautious response also includes revoking unnecessary token approvals, separating active trading wallets from long-term storage wallets, and checking whether a transaction request matches the intended platform action before signing. These are general security checks, not a guarantee of protection.
Risk Disclosure
Phishing and supply-chain attacks can bypass a user’s normal sense of platform trust because the malicious step may appear inside a familiar workflow. Refund pledges can help affected users, but they do not remove the operational risk revealed by the incident.
This article is for informational analysis only and is not financial advice. ETH, MATIC, and related crypto assets carry market, custody, smart-contract, bridge, and phishing risks. Users should make independent security and trading decisions.
Bitget Context
For readers comparing ETH and MATIC market exposure after this kind of incident, the useful distinction is between security analysis and trading action. The event may justify stronger wallet hygiene and monitoring, but it does not by itself provide a trading signal.
Readers who already use Bitget can review ETH and MATIC markets through the provided Bitget path using code 7nfg8123. That context is informational and does not imply any reward, ranking, return, or suitability claim.
Evaluate BITGET for your use case
Check regional eligibility, current fees and product availability on the official destination.
Review BITGETAffiliate link · Availability varies by region · No guaranteed outcomeQuestions readers ask
What did AMLBot confirm about the Polymarket incident?
AMLBot confirmed that the Polymarket phishing toll was approximately $3.1 million in PUSD across 11 user wallets, according to the supplied event brief.
Which chains were involved in the fund movement?
The supplied brief says the funds were bridged from Polygon to Ethereum and converted to ETH.
Were ETH and MATIC affected assets in this event?
Yes. The brief lists ETH and MATIC as affected assets, with the event categorized under ETH because the funds were traced to Ethereum.
Has Polymarket named the compromised vendor?
No. The supplied brief says Polymarket has pledged full refunds but has not named the compromised vendor.
Does this prove Ethereum or Polygon was exploited?
No. Based only on the supplied brief, the event is described as a phishing and supply-chain attack. It does not claim a base-layer Ethereum or Polygon protocol exploit.
What should users check after this type of attack?
Users should review wallet approvals, recent Polygon and Ethereum transactions, bridge activity, and any unexpected signing prompts. These checks can help identify exposure but cannot guarantee recovery or future protection.