Polymarket breached

[Oshosondy]

It was reported by Polymarket that small number of their users were affected and that it has been resolved. The users reported  suspicious activity on their accounts.

The breach was caused by a vulnerability introduced by a third-party authentication provider.

Some users reported seeing three login attempts by attackers before their funds were ultimately drained. 

“Today I woke up and see 3 attempts to login to Polymarket. My device isn’t compromised, Google found nothing suspicious, all other services are fine.” said one Reddit user. “So I went to Polymarket and realised that all my deals were closed and balance is 0.01$.”

Other users have claimed that the security issue may have stemmed from Magic Labs, a popular wallet service integrated with Polymarket.

“My Polymarket wallet also got drained yesterday,” noted one X user. “Wallet was [Magic Labs] created. I never actually signed up for email with them so never got phishing links.”

This is not the first time users of the major prediction market have faced security issues, with some Polymarket users being drained in late 2024 after logging into the platform via their Google accounts.

Not good to leave money on a gambling site or a prediction market.

[SatoPrincess]

I’m certain the hack affected more users than it is being reported by the casino. At this point, scammers  will be on the lookout for polymarket victims to offer them promises of getting their money back. People often fall victim to these “recovery scammers” who are just as bad as the original scammers.

[Upgrade00]

A system is only as strong as its weakest link. When we add "third parties" and other wallet integrations in we are opening up more possible weak links that can lead to a breach. Rather than saying they will reach out to users, better to say all funds lost will be fully compensated for. Would not be a good look to want to reach an agreement if the breach was due to a fault on their system.

Not good to leave money on a gambling site or a prediction market.

Not good to leave your money outside cold storage.
Only have spare amounts in your hot wallets and send even less for gambling and other like activities. Important to gamble responsibly too.

[Fiatless]

It was reported by Polymarket that small number of their users were affected and that it has been resolved. The users reported  suspicious activity on their accounts.

The breach was caused by a vulnerability introduced by a third-party authentication provider.

The blame is often attributed to third-party service providers. I hope those affected will be duly compensated by Polymarket.

Not good to leave money on a gambling site or a prediction market.

High rollers usually have substantial amounts in gambling platforms since they bet large amounts. However, gambling sites are not banks or safe wallets. Keeping big amounts there is risky because issues like this are common.

[TastyChillySauce00]

Polymarket is aware about that. It seems they're getting in touch with all affected users. However, it's not yet clear whether they will reimburse the victims of the hack caused by it's their third vendor fault. It's kinda weird magic labs doesn't even mention anything related to this hack in their official account.
Is it maybe an insider who did it? who knows.

[VashaUdacha777]

Hi !

I woke up this morning and saw that someone had also tried to hack my X account. Looks like scammers get more active around Christmas, probably thinking players have a lot of money in their accounts. I feel really sorry for the Polymarket users who were affected and hope the company fully compensates them for the losses. 

[Outhue]

It's not good to leave money on prediction platforms and crypto exchanges but how will people open orders? They have to trade right? And trading takes hours and days, you create an order hoping to get filled and this takes time, there is no way traders won't leave money on these platforms .

I have battled with thoughts but I can't come up with solutions, all I have on exchange now is $100 for shorting the market and whenever I make gains I move that out, but that $100 always remains there in case a sudden opportunity arises, and also half of the money is on shorting ZEC since yesterday. There is someone out there who can risk more than a $100 to open long or shorts, they can't do it if they move their funds out of the exchange. As a matter of fact no trader is going to escape this, all they can hope for is not to be a victim of breach and if that happens hopefully the exchange will be able to reimburse them, it's why many choose Binance exchange for trading rather than others.

[Charles-Tim]

I woke up this morning and saw that someone had also tried to hack my X account. Looks like scammers get more active around Christmas, probably thinking players have a lot of money in their accounts. I feel really sorry for the Polymarket users who were affected and hope the company fully compensates them for the losses. 

You can use 2FA or hardware 2FA to secure your X account, this will make it harder to hackers to hack.

About the affected Polymarket users which their account were compromised and their money stolen, so far Polymarket know that it is their fault, the users need to be paid back their money.

[iv4n]

Polymarket confirms a limited user breach caused by a third-party authentication vulnerability that bypassed two-factor security. Here’s what happened

https://www.hokanews.com/2025/12/polymarket-confirms-limited-security.html?utm_source=chatgpt.com

So even 2FA can't help here...

Alert !! Security Breach at Stake.com. Personal data of players got leaked. https://bitcointalk.org/index.php?topic=5568910.0

Polymarket gets breached, Stake user data leaks... scammers never sleep.

I’m certain the hack affected more users than it is being reported by the casino. At this point, scammers  will be on the lookout for polymarket victims to offer them promises of getting their money back. People often fall victim to these “recovery scammers” who are just as bad as the original scammers.

Well, it's like a chain reaction... first, they steal what they can! And then use all that info for the next round of scams. As you wrote, they probably offer "recovery help" as well... Scammers never sleep, and they adapt fast.

[acroman08]

I wonder if the people who were affected by this hack got compensated.

Not good to leave money on a gambling site or a prediction market.

It was never good to leave money in any wallet owned by a centralised platform. But then again, some of them probably leave their money there because they use the website on a daily basis, and it is a hassle to deposit and withdraw every time they use the website.

[Natalim]

I wonder if the people who were affected by this hack got compensated.

I don’t think they’ll get refunded. Based on what Polymarket said, the breach came from a third-party authentication service. So it’s basically them saying, our system is secure, if your account got hacked then that’s on you, and we’re not responsible for refunds.

[davis196]

I’m certain the hack affected more users than it is being reported by the casino. At this point, scammers  will be on the lookout for polymarket victims to offer them promises of getting their money back. People often fall victim to these “recovery scammers” who are just as bad as the original scammers.

1.Polymarket is not a casino.
2.The problem isn't with Polymarket. The problem is inside this Magic Labs Wallet(I've never heard anything about this wallet until now). This is the price users have to pay for convenience. That is why I don't use wallets like Metamask, which have to be "connected" to certain crypto services. Centralized crypto platforms will always be vulnerable to such hacks. Polymarket should be held accountable for allowing its users to connect their accounts via such questionable crypto wallets.
3.Someone has to be really dumb in order to believe that "crypto recovery services" actually work. If you get scammed, there's no way that some "crypto recovery service" would find the scammer and force him to refund all stolen funds.

[FinneysTrueVision]

To be precise, it was a few user accounts that were breached because of a vulnerability in a third party service. Polymarket appears to be safe to use if you aren’t using Magic Labs as your login method. These embedded web wallets might seem really convenient, but I’ve always felt uneasy about the idea of a wallet that can be unlocked by having access to someone’s email or social media account. If 2FA was being bypassed, that would mean somebody wouldn’t even need to hack your email account. Just knowing your email address would be enough information for somebody to get into your Polymarket account and drain your funds.

[Kasabus]

If 2FA was being bypassed, that would mean somebody wouldn’t even need to hack your email account. Just knowing your email address would be enough information for somebody to get into your Polymarket account and drain your funds.

That’s the scary part. We all thought 2FA would somehow improve account security, but clearly it’s still not safe from getting hacked. I think platforms really need to add another layer of security, because next time the damage could be even bigger. There’s still no official figure on how much users actually lost, but this should already be a warning. Don’t keep large balances on any online platform, no matter how secure they claim to be.

[GreatArkansas]

Polymarket seems riskier compared to common traditional gambling websites because in Polymarket you can directly use your cryptocurrency wallet, so your wallet and balance may be exposed directly, compared to these gambling sites where you just log in with your email address and deposit to fund your account.
Well, so maybe using a different wallet for these kinds of platforms maybe good move instead of using your main wallet directly.

[_act_]

Polymarket seems riskier compared to common traditional gambling websites because in Polymarket you can directly use your cryptocurrency wallet, so your wallet and balance may be exposed directly, compared to these gambling sites where you just log in with your email address and deposit to fund your account.

Stake was breached and tens of millions of dollars was stolen by hackers but Stake is not a web3 gambling site. Although, Metawin was breached and millions of dollars was also stolen by the hackers or hackers that breached it but it is web3 like Polymarket, but that does not mean those gambling sites that are not web3 can not be breached. It is just like crypto exchanges that no web3 like Hyperliquid, Asterdex and others has not or less frequently been breached by hackers before but the web2 part of the exchange like Binance, Kucoin, Bybit and many others were breached.

[Hardyrobust]

This is really funny,  I wonder why some gambler will take the risk of leaving money in a gambling platform especially reasonable amount of money. The user that was affected according to then aren't much but this doesn't change the fact that money was lost by those user regardless of how small the people that lost money maybe. I don't see the need for laying the blame on a third party, the platform never prioritised user security and privacy. I would never keep money especially reasonable amount in a gambling platform for a long time.

[michellee]

Not good to leave money on a gambling site or a prediction market.

Security issues need to be a concern for the platforms and ensure they are secure from hackers. But we know that no 100% safety so all gambling platforms and other websites must pay attention to their security levels. They also need to remind their members to activate all recommended security settings in their dashboard to better secure it.

You should not leave money on an online site to avoid losing big money from hacking. We don't know how secure their site so we must be careful. You should also activate the security features that the sites have so you will not worry about a hack.

[purple_sparkles]

In my opinion, it’s not worth trusting large amounts of money to casinos, exchanges, or any other organizations. Whenever possible, it’s better to withdraw your funds to wallets that no third parties can access. Otherwise, you can always face a situation where a hacker breaks into the system and steals your money, or the organization itself may seize the funds by introducing new withdrawal rules or similar conditions. If your money isn’t in your own custody, it doesn’t truly belong to you.

[Russlenat]

In my opinion, it’s not worth trusting large amounts of money to casinos, exchanges, or any other organizations. Whenever possible, it’s better to withdraw your funds to wallets that no third parties can access. Otherwise, you can always face a situation where a hacker breaks into the system and steals your money, or the organization itself may seize the funds by introducing new withdrawal rules or similar conditions. If your money isn’t in your own custody, it doesn’t truly belong to you.

Sometimes users don’t withdraw their funds right away. In my case, I’m pretty active with deposits and withdrawals once the result is out. So with this hack, I don’t think the impact on me would be that huge. What they really need to fix is the third-party app that got compromised, especially the 2FA, since that’s what was reported as the weak point.