Polymarket Users Targeted by Phishing Attack, Losses Reach ~ $2.94 Million (~Rp 46 Billion)
Polymarket has become the target of a new phishing attack that caused significant losses for its users. According to an on-chain investigation, the total funds successfully stolen amounted to approximately $2.94 million (about Rp 46 billion, at the current exchange rate).
On-chain researcher SpecterAnalyst reported that the attacker drained assets from at least 11 victims’ wallets that held PUSD tokens. The stolen funds were then converted into ETH and consolidated into several main wallet addresses.
On-chain trackers such as Arkham show that the portfolio associated with the “Polymarket drainer” has accumulated nearly 1,893K ETH, worth about $2.94 million.
Modus OperandiVictims were allegedly tricked using typical phishing techniques: clicking fake links or interacting with fake web3 sites/pages impersonating Polymarket. Once the wallet was connected, the attacker immediately drained the assets in it, especially PUSD, and then swapped them for ETH to make tracking more difficult.
As of the time this news was written, there has been no official confirmation from Polymarket regarding this latest incident.
However, the crypto community has once again been reminded to always verify URLs, never click suspicious links, and use hardware wallets or multi-signature for large amounts of funds.
This incident adds to the list of security cases involving Polymarket throughout 2026, amid the platform’s growing popularity as a place to bet on predictions for various global events.
Prevention Tips:Always access Polymarket through the official site: polymarket.com
Use browser bookmarks
Enable 2FA and review wallet permissions before connecting
Avoid logging in via Google if possible to reduce the risk of OAuth phishing
Users who suspect they may be victims are advised to immediately check their wallet transaction history and report to the on-chain community for further tracking.
(Source: SpecterAnalyst on-chain analysis and public blockchain data, June 25, 2026)
Polymarket has become the target of a new phishing attack that caused significant losses for its users. According to an on-chain investigation, the total funds successfully stolen amounted to approximately $2.94 million (about Rp 46 billion, at the current exchange rate).
On-chain researcher SpecterAnalyst reported that the attacker drained assets from at least 11 victims’ wallets that held PUSD tokens. The stolen funds were then converted into ETH and consolidated into several main wallet addresses.
On-chain trackers such as Arkham show that the portfolio associated with the “Polymarket drainer” has accumulated nearly 1,893K ETH, worth about $2.94 million.
Modus OperandiVictims were allegedly tricked using typical phishing techniques: clicking fake links or interacting with fake web3 sites/pages impersonating Polymarket. Once the wallet was connected, the attacker immediately drained the assets in it, especially PUSD, and then swapped them for ETH to make tracking more difficult.
As of the time this news was written, there has been no official confirmation from Polymarket regarding this latest incident.
However, the crypto community has once again been reminded to always verify URLs, never click suspicious links, and use hardware wallets or multi-signature for large amounts of funds.
This incident adds to the list of security cases involving Polymarket throughout 2026, amid the platform’s growing popularity as a place to bet on predictions for various global events.
Prevention Tips:Always access Polymarket through the official site: polymarket.com
Use browser bookmarks
Enable 2FA and review wallet permissions before connecting
Avoid logging in via Google if possible to reduce the risk of OAuth phishing
Users who suspect they may be victims are advised to immediately check their wallet transaction history and report to the on-chain community for further tracking.
(Source: SpecterAnalyst on-chain analysis and public blockchain data, June 25, 2026)