Polymarket faces new breach reports as users describe stolen funds
The decentralized prediction platform Polymarket has confirmed that several user accounts were hacked due to a security issue linked to a third-party service provider.
Reports of compromised accounts began appearing this week on X and Reddit, where affected users described their losses on Polymarket.
“Today I woke up to 3 login attempts to Polymarket — my device isn’t compromised, Google found nothing suspicious, all other services are fine… I logged into Polymarket and found all my trades closed and my balance at just $0.01,” one user wrote on Reddit.
Another user in the comments reported a similar breach, receiving three login attempt notifications before funds were drained from their Polymarket account, despite not clicking any links and having two-factor authentication enabled on their email.
Affected users concluded that the issue appears to have impacted those who signed up for Polymarket through Magic Labs, which allows email logins and creates non-custodial Ethereum wallets. Magic Labs onboarding is widely used by beginner crypto users who do not yet have digital wallets.
Platform promises to contact affected users
Polymarket eventually confirmed the security issue in its official Discord channel, though it did not name the exact source of the breach.
“We recently identified and mitigated a security issue that affected a small number of users,” Polymarket wrote. “The issue was caused by a vulnerability created by a third-party authentication provider.”
Polymarket did not disclose how many users were affected or how much was stolen but promised to reach out to victims.
According to The Block, the latest breach echoes earlier incidents reported on the platform. In September 2024, several users who logged in via Google accounts reported having their wallets drained when attackers exploited “proxy” function calls to move their USDC to phishing addresses.
In addition, a phishing campaign last month using the platform’s comment sections led to more than $500,000 in user losses, as scammers posted disguised links to fake websites encouraging email authorization.
As we wrote, Polymarket in clear: What DOJ case closure means for prediction markets
Latest Crypto News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
