Polymarket rejects claims of major user data leak

Polymarket rejects claims of major user data leak
Polymarket rejects alleged data leak

​Polymarket has rejected claims of a major customer data breach after a hacker on the dark web advertised what he said was personal information belonging to hundreds of thousands of users. The company stated that the data being offered for sale is already publicly accessible through its open APIs and on-chain information.

Highlights

  • A hacker claimed to have stolen over 300,000 Polymarket user records.
  • Polymarket denies any breach, stating the data is publicly available.
  • The hacker also claims to have breached other prediction markets.

Hacker’s claims

On Tuesday, several X accounts monitoring dark web activity shared screenshots from the DarkForums forum. A hacker using the pseudonym “xorcat” claimed to have breached Polymarket and stolen more than 300,000 records, including 10,000 unique user profiles containing full names, profile pictures, proxy wallets, and addresses.

The hacker said the data was obtained through undocumented API endpoints by bypassing pagination and exploiting misconfigured CORS settings in Polymarket’s Gamma and CLOB APIs. He also claimed to have hacked other prediction markets and plans to release more data in the coming days.

Polymarket’s response

Polymarket dismissed the allegations as “complete and utter nonsense.” The company emphasized that all the information the hacker is trying to sell is already freely available to developers through public endpoints and blockchain data.

“No data was "leaked" — it's accessible via our public endpoints & on-chain data.” — the company stated. 

Broader industry context

The incident comes amid a wave of hacks and security incidents across the crypto industry in April 2026. According to blockchain security firm Hacken, Web3 projects lost $482 million due to hacks and fraud in the first quarter alone.

The Polymarket case highlights ongoing concerns about data privacy and security, even for platforms operating with transparent, on-chain information.

We have previously highlighted that the U.S. Department of Justice has arrested active-duty Army soldier Gannon Ken Van Dyke. He is accused of using classified information about a military operation targeting Nicolás Maduro to profit from bets on Polymarket.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.
Weekly Top Bonuses
up to $2,500
deposit bonus for all clients
CLAIM BONUS
Your capital is at risk.