The tweet was deleted by the author.
But we saved everything 🙂.
Polymarket has rejected claims of a major customer data breach after a hacker on the dark web advertised what he said was personal information belonging to hundreds of thousands of users. The company stated that the data being offered for sale is already publicly accessible through its open APIs and on-chain information.
On Tuesday, several X accounts monitoring dark web activity shared screenshots from the DarkForums forum. A hacker using the pseudonym “xorcat” claimed to have breached Polymarket and stolen more than 300,000 records, including 10,000 unique user profiles containing full names, profile pictures, proxy wallets, and addresses.
The hacker said the data was obtained through undocumented API endpoints by bypassing pagination and exploiting misconfigured CORS settings in Polymarket’s Gamma and CLOB APIs. He also claimed to have hacked other prediction markets and plans to release more data in the coming days.
Polymarket dismissed the allegations as “complete and utter nonsense.” The company emphasized that all the information the hacker is trying to sell is already freely available to developers through public endpoints and blockchain data.
“No data was "leaked" — it's accessible via our public endpoints & on-chain data.” — the company stated.
The incident comes amid a wave of hacks and security incidents across the crypto industry in April 2026. According to blockchain security firm Hacken, Web3 projects lost $482 million due to hacks and fraud in the first quarter alone.
The Polymarket case highlights ongoing concerns about data privacy and security, even for platforms operating with transparent, on-chain information.
We have previously highlighted that the U.S. Department of Justice has arrested active-duty Army soldier Gannon Ken Van Dyke. He is accused of using classified information about a military operation targeting Nicolás Maduro to profit from bets on Polymarket.