Polygon

Funds tied to the Polymarket pUSD drain have moved again after the attacker converted stolen assets through Relay, bridged value from Polygon to Ethereum and consolidated proceeds into ETH. The movement follows the vendor script drain that hit Polymarket users after a compromised third-party dependency injected malicious code into the platform frontend for some users. Polymarket contained the incident, removed the affected dependency and said impacted users would be refunded in full. The attacker path now centers on funds that…

A suspected phishing attack targeting Polymarket users has drained an estimated $2.94 million from at least 11 victim wallets holding pUSD. The stolen assets were swapped into ETH and consolidated through the address 0xe65b1C586757c5510B60F998Eebb14C1eF71E1eD. The incident has not been confirmed as a Polymarket protocol exploit. The available onchain trail points to a user-side phishing or wallet-drainer campaign, where victims appear to have lost funds after interacting with malicious links, signatures or approvals tied to pUSD balances. Other theft addresses identified…

Polymarket’s developer team linked the POL drain to a private-key compromise involving an internal wallet used for top-up and rewards operations, with user funds and market resolution safe. The update moves the incident away from the early fear of a platform-wide contract exploit. The current public account points to attacker control over an operational wallet, not drained user balances, failed market settlement, or compromised Polymarket trading contracts. Early onchain alerts tracked rapid withdrawals of 5,000 POL at a time from…

Polymarket became the focus of a fast-moving security scare after early onchain alerts described attackers removing 5,000 POL roughly every 30 seconds from infrastructure linked to the platform’s Polygon operations. The first public warnings framed the issue as a possible contract exploit, with Bubblemaps warning that about $600,000 had been stolen and urging users to pause Polymarket activity while the drain was active. A later Bubblemaps update placed the exploited amount near $700,000, said suspected withdrawals had stopped, and noted…

Polygon Turns On Private Stablecoin Transfers Polygon Labs has launched shielded stablecoin payments inside Polygon Wallet, giving users a new way to send USDC and USDT without broadcasting the sender, receiver and amount to the public blockchain. The feature is live through a new “Privately Send” option in the wallet. When users select that route, the transfer goes through Hinkal’s shielded pool instead of a standard transparent on-chain transfer. Zero-knowledge proofs verify that the transaction is valid while keeping the…

BNB Chain is leading a fresh stablecoin activity snapshot, with monthly usage around 16 million as other major chains also show rising user traction. A BitImmortal update placed BNB Chain at the top with 16 million users, followed by Polygon at 7 million, Base at 3.3 million, Celo at 2 million, and Arbitrum at 1.9 million. BNB Chain’s own site currently lists stablecoin MAU at about 16.8 million, reinforcing the view that the network has become one of the most…

Visa has added Polygon as a settlement chain in its stablecoin program, giving fintech issuers a new way to settle card payment flows beyond standard banking hours. While card payments feel instant to users, settlement for issuers still depends on bank calendars, cut-off times, weekends, and holidays. This creates a working-capital cost for fintechs, especially program managers and sponsor-bank-backed issuers with large card volumes. Polygon’s addition gives those firms access to stablecoin settlement on a chain already used for high-volume…

A single forged signature drained $292M from KelpDAO on Saturday and triggered a $6.6 billion run on Aave. The bridges that kept running all had one thing in common. By John Egan, Head of Product, Polygon Labs Between Saturday evening and Sunday morning, a single forged message on a single cross-chain bridge turned into DeFi’s worst week since FTX. An attacker drained $292 million of rsETH from KelpDAO’s LayerZero bridge, used it as collateral to borrow real ether on Aave,…

A wave of protocol-level security responses followed the $292 million KelpDAO rsETH exploit on April 19, with BitGo, Polygon, and Katana moving swiftly to isolate potential contagion. The attack drained 116,500 rsETH from Kelp DAO’s LayerZero-powered cross-chain bridge through a forged message that bypassed its Decentralized Verifier Network (DVN) configuration. Protocols Move to Contain Fallout BitGo, alongside BiT Global Trust, took down the LayerZero OFT DVNs for Wrapped Bitcoin (WBTC) as a precaution. The firm confirmed that user funds remain…