Polymarket Hack: User Funds Compromised Due to Third-Party Vulnerability

Polymarket has confirmed that a recent incident involving wallet drains from user accounts was due to a security flaw linked to a third-party authentication provider. This news follows numerous user complaints about sudden balance reductions after unexpected login attempts.

Key Takeaways

Polymarket's recent wallet drain incident was due to a vulnerability in a third-party authentication provider.
Users reported unexpected login emails and subsequent fund losses.
The issue has been resolved, but details regarding the number of affected users and total losses remain undisclosed.
The incident underscores ongoing security challenges tied to third-party services within the cryptocurrency space.

Polymarket Wallets Drained: Third-Party Vulnerability Confirmed in Latest Hack

The decentralized prediction market platform has stated that the issue has now been resolved and there is no ongoing risk, although it has not revealed the number of users affected or the total amount of funds lost.

User Experiences: Sudden Losses Reported

Reports regarding unusual activity emerged earlier this week on X and Reddit, with various users recounting their experience of receiving multiple login notification emails despite not actively trying to access their accounts.

In several instances, users reported that when they logged in later, their accounts were nearly empty with their positions closed.

One Reddit user shared their experience of having three login attempts flagged while their email and other accounts appeared secure. They mentioned that their Polymarket funds were drained simultaneously with the login emails.

Another user provided a detailed account hinting that the breach might have exploited weaknesses in the platform’s one-time password (OTP) system during the incident. They claimed that the OTPs were only three digits long, making them susceptible to brute-force attacks. Shortly after the incident, Polymarket allegedly increased the OTP length to six digits, though the company hasn't officially commented on this change.

User feedback indicates a shared vulnerability among affected accounts. Several users mentioned they registered via Magic Labs, a popular onboarding tool that enables users to log in using email addresses while creating non-custodial Ethereum wallets.

While Polymarket did not specify the authentication provider involved, it acknowledged on its official Discord channel that the vulnerability came from a third-party service.

The platform assured it would reach out to affected users directly but did not provide specifics on reimbursement or recovery options.

Ongoing Issues with Third-Party Breaches

This incident is not the first instance where Polymarket has confronted security challenges related to external services.

In September 2024, users logging in through Google accounts experienced wallet drains involving unauthorized proxy transactions, leading to USDC being redirected to phishing addresses. At that time, Polymarket was scrutinizing the events as potential targeted exploits associated with third-party authentication tools.

Additionally, a phishing campaign recently exploited the platform’s comment sections, resulting in losses exceeding $500,000 after users were misled to fake login pages.

This breach highlights a wider trend of third-party security flaws that have been impacting the crypto and tech industries. Recently, crypto tax software firm Koinly warned its users that email addresses might have been exposed due to a breach at Mixpanel, an analytics service previously utilized by the firm. Koinly confirmed that no financial or tax information had been compromised and that they have since stopped using the service.

Similarly, Swiss-based crypto platform SwissBorg reported losses of $41 million earlier this year due to an API provider breach, while Discord and various DeFi protocols have also faced attacks linked to external vendors.

Security researchers consistently warn that relying on third-party infrastructure can exacerbate vulnerabilities, especially as crypto platforms continue to expand.