Polymarket’s pUSD hits $500M, $3M phishing attack prompts refunds

Polymarket’s pUSD surpassed $500M in value, but a vendor compromise led to a $3M phishing attack. The issue is contained and affected users will be fully reimbursed.

Polymarket’s native collateral token, pUSD, has exceeded $500 million in market value, achieving this milestone about a month after its public launch on April 28. The ERC-20 token runs on the Polygon network and is fully backed by USDC held in smart contracts. Users deposit USDC to mint pUSD at a 1:1 ratio, which serves as collateral for bets on Polymarket’s prediction markets. The platform’s Total Value Locked surged to around $514 million in late April, with monthly trading volumes reaching billions and annualized revenues in the hundreds of millions. However, a recent security incident occurred when a third-party vendor was compromised, allowing malicious code to be injected into Polymarket's frontend. This led to a phishing attack that drained about $3 million in pUSD from at least 11 user wallets. The attacker swapped the stolen assets for ETH and consolidated them into specific addresses. Polymarket has since contained the issue, removed the affected dependency, and pledged to fully reimburse impacted users. The attack was limited to users who interacted with the compromised frontend, not the platform’s smart contracts.