Blockchain intelligence firm AMLBot has pinpointed the total haul from Thursday’s Polymarket supply-chain attack at approximately $3.1 million in PUSD, marking the first forensically verified on-chain figure tied to the incident. The stolen funds were traced moving from Polygon to Ethereum, a cross-chain maneuver that complicates recovery but leaves a clear forensic trail. On-chain investigator Specter contributed to the analysis, which confirms the attack vector as a supply-chain compromise rather than a smart contract exploit. The breach raises fresh questions about infrastructure security across prediction market platforms and DeFi protocols more broadly.
What the $3.1 Million Theft Reveals About DeFi Supply-Chain Risk
Before diving into the specifics, a few strategic takeaways frame the significance of this event for executives, security teams, and regulators watching the decentralized finance space.
- AMLBot’s forensic confirmation of $3.1 million in stolen PUSD provides the first reliable dollar figure, replacing earlier speculation with verifiable on-chain data.
- The attack exploited a supply-chain vulnerability, not a flaw in Polymarket’s core smart contracts, shifting the security conversation toward third-party dependencies and build pipelines.
- Cross-chain movement of stolen assets from Polygon to Ethereum signals a deliberate laundering strategy, one that will test the coordination between chain-specific monitoring tools.
- For prediction markets seeking institutional credibility, this breach underscores that platform security extends well beyond contract audits.
- Regulatory scrutiny of DeFi platforms, already intensifying in 2025, now has a concrete incident to reference when arguing for stricter operational security standards.
How the Attack Unfolded
Supply-chain attacks in crypto differ fundamentally from the contract exploits that dominated headlines in 2022 and 2023. Instead of targeting the protocol’s own code, attackers compromise an upstream dependency, a library, a deployment script, or an integration layer, and inject malicious logic before it ever reaches the main application. That’s what happened here.
The attacker gained access through a component in Polymarket’s infrastructure stack, siphoning PUSD tokens without triggering the usual alarms associated with direct contract manipulation. AMLBot’s analysis confirmed the funds initially landed on Polygon before being bridged to Ethereum (a distinction that matters for asset tracing, since cross-chain bridges often fragment the forensic trail into separate ledger histories).
Specter, an on-chain investigator who collaborated on the analysis, helped map the transaction flow across both networks. The resulting picture is detailed enough to support potential recovery efforts, though whether those efforts succeed depends on how quickly downstream addresses can be flagged and frozen.
Why Cross-Chain Movement Complicates Recovery
Moving stolen funds from one blockchain to another isn’t just a technical step. It’s a deliberate countermeasure. By bridging PUSD from Polygon to Ethereum, the attacker fragments the asset trail across two distinct ledger environments, each with its own set of monitoring tools, node operators, and compliance infrastructure.
In practice, this means that no single analytics platform can track the full lifecycle of the stolen funds without stitching together data from multiple chains. AMLBot’s cross-chain forensic capabilities proved critical in this case, but not every incident benefits from that level of analysis. Smaller thefts often go unresolved precisely because the forensic cost exceeds the stolen amount.
Still, $3.1 million is large enough to warrant sustained attention. And the Ethereum destination chain offers more mature compliance tooling, which could work against the attacker if centralized exchange on-ramps are used to liquidate.
The Broader Security Conversation DeFi Keeps Deferring
Smart contract audits have become table stakes for any serious DeFi launch. But supply-chain security? That conversation remains underdeveloped across most of the industry. The Polymarket incident exposes a gap that audits alone cannot close.
Consider the typical DeFi security checklist: formal verification of core contracts, bug bounty programs, multi-sig governance. All necessary. None of them would have caught this attack. The vulnerability lived upstream, in the tooling and dependencies that sit between developers and deployed code. This is familiar territory for traditional software engineering, where supply-chain attacks like SolarWinds and the XZ Utils backdoor have reshaped enterprise security postures. Crypto protocols, despite handling billions in user funds, have been slower to adopt equivalent safeguards.
Polymarket’s prediction market platform had been gaining traction among institutional and retail users alike, particularly around high-profile political and economic event contracts. Whether this breach dents that momentum depends largely on how transparently the team addresses the root cause and what infrastructure changes follow.
What Should Protocols Be Doing Differently?
The short answer: treating their build and deployment pipelines with the same rigor they apply to on-chain logic. That means:
- Implementing reproducible builds so that deployed bytecode can be independently verified against source code
- Auditing CI/CD pipelines and third-party dependencies, not just smart contracts
- Adopting software bill of materials (SBOM) practices borrowed from enterprise security frameworks
- Running adversarial simulations that specifically target supply-chain vectors, rather than focusing exclusively on contract-level exploits
Regulatory and Market Implications
Timing matters. This attack lands at a moment when U.S. and European regulators are actively debating operational resilience requirements for digital asset platforms. The EU’s Digital Operational Resilience Act (DORA), which took effect in January 2025, already mandates ICT risk management frameworks for financial entities, and its principles are increasingly referenced in crypto policy discussions.
A $3.1 million theft from a high-profile prediction market gives regulators a concrete data point. Not a hypothetical risk scenario, but an actual loss with traceable on-chain evidence. Expect this incident to surface in future consultation papers and enforcement rationales.
| Detail | Information |
|---|---|
| Platform affected | Polymarket |
| Attack type | Supply-chain compromise |
| Amount stolen | ~$3.1 million in PUSD |
| Origin chain | Polygon |
| Destination chain | Ethereum |
| Forensic analysis by | AMLBot, with on-chain investigator Specter |
Frequently Asked Questions
What is a supply-chain attack in crypto?
A supply-chain attack targets upstream components, such as code libraries, deployment tools, or integration layers, rather than the protocol’s own smart contracts. The attacker injects malicious code before it reaches the final application, bypassing traditional contract-level security measures entirely.
How were the stolen funds traced?
AMLBot used cross-chain forensic analysis to follow the movement of approximately $3.1 million in PUSD from Polygon to Ethereum. On-chain investigator Specter contributed to mapping the transaction flow across both networks, producing a detailed asset trail.
Can the stolen funds be recovered?
Recovery depends on several factors: how quickly downstream addresses are flagged, whether centralized exchanges cooperate with freezing requests, and the speed of law enforcement engagement. Ethereum’s more mature compliance infrastructure could aid recovery if the attacker attempts to off-ramp through regulated platforms. But guarantees? None exist at this stage.
Does this affect Polymarket users directly?
The attack targeted infrastructure rather than individual user wallets. However, the broader implications for platform trust and security posture are significant, particularly for users holding PUSD or actively trading on the platform during the incident window.
