Polymarket breached

[cryptoaddictchie]

This incident highlights how a third party authentication tools can introduce serious security risks, even if the core platform isn’t directly breached. Convenience focused features like social logins and embedded wallets often create hidden vulnerabilities that attackers can exploit.

Although Polymarket attributed the issue to a third party provider, users still suffered the losses, raising concerns about accountability and platform trust. I don't know if we have polymarket users got affected by this. But hopefully the project turns this into their accountability for the users who will be affected and refund all money losses.

[Ziskinberg]

Although Polymarket attributed the issue to a third party provider, users still suffered the losses, raising concerns about accountability and platform trust. I don't know if we have polymarket users got affected by this. But hopefully the project turns this into their accountability for the users who will be affected and refund all money losses.

I’m wondering if this is really just a third-party issue or if Polymarket also shares some blame. I know how 2FA works, you link your email and it syncs when you log in. But for hackers to pull this off, it feels like they had access to some user info, possibly coming from Polymarket’s side too, not just the third-party service.

Before jumping to conclusions though, we should look at the actual damage.
Is there already any report on how much was lost, or are we still waiting on the numbers?

[bitbollo]

bad incident. but doens't mean too much. this can always happen with any centralized service or in general any service ... including third part service.
for sure this is sounds as a news because it is involved a big player of gambling industry... however if you know industries this can always be possible.

[Porfirii]

Thank you for the early heads-up Oshosondy, this is the first place I've read the news.

Even if it is inconvenient to go depositing and withdrawing your coins from this kind of platforms, every so often an incident of this nature reminds us how dangerous it is to entrust large amounts in the hands of third parties, no matter how big or secure they seem.

Fortunately it seems that this incident does not affect most of us, but be careful out there.

[bitLeap]

Not good to leave money on a gambling site or a prediction market.

I agree, and that's what I always do when gambling to deplete my balance. My principle is that when I deposit a certain amount, I either play until it's gone or withdraw all my winnings. I never want to keep any balance, and cases like Polymarket are a lesson learned. Even though user assets are guaranteed, as a gambler I still prefer not to keep my balance unused.

[mrust_mobile]

With the rise of ai we need to be more careful than ever. I can imagine more people having access to automation tools to steal accounts/passwords nowadays and that means we need to be extra careful.

Getting your money stolen is bad but there is a bigger potential threat and that is called “identity theft”. Check out GazetaBitcoin’s topic to see what can possibly happen when the hackers steal your private information.

What happens when your identity is stolen -- real story || Avoid CEXs!

This shit is no joke. You can make money back but if your private information gets stolen, that’s an irreversible path.

[Slow death]

I’m certain the hack affected more users than it is being reported by the casino. At this point, scammers  will be on the lookout for polymarket victims to offer them promises of getting their money back. People often fall victim to these “recovery scammers” who are just as bad as the original scammers.

Unfortunately, this has been the way in recent years that companies that make a lot of money and have a lot of fame have dealt with cases that could harm them. In their press releases, they treat the problem as if it weren't serious, minimizing the impact so that their customers don't panic and stop using the website or company. And the most unbelievable thing is that they copied this behavior from governments. Since I don't have an account on that site, I don't need to worry.

[Maslate]

bad incident. but doens't mean too much. this can always happen with any centralized service or in general any service ... including third part service.
for sure this is sounds as a news because it is involved a big player of gambling industry... however if you know industries this can always be possible.

This isn’t really new in the crypto space. Stuff like this has been happening for a long time( not exactly 2FA issue). What really helps is learning how to manage risk properly. The best move is not to store funds on a casino at all, or at least withdraw immediately once the game is over. That way, even if your account gets accessed, there’s nothing left for the hacker to take.

From time to time we keep hearing news like this, so it’s clearly not going away.
Even with better security and improvements over the years, breaches still happen. That’s just the reality in crypto.

[mirakal]

Getting your money stolen is bad but there is a bigger potential threat and that is called “identity theft”. Check out GazetaBitcoin’s topic to see what can possibly happen when the hackers steal your private information.

What happens when your identity is stolen -- real story || Avoid CEXs!

This shit is no joke. You can make money back but if your private information gets stolen, that’s an irreversible path.

I think I can deal with stolen coins more than having my identity stolen. We never really know what criminals might do with someone’s identity. One day you might be surprised to find your name somehow linked to a crime you had nothing to do with.

Polymarket isn’t a regulated prediction market anyway, right? So I don’t think identity theft is the main risk here. What was reported is that some user accounts got compromised and their balances were drained. That’s bad, but it would be way worse if this kind of hack happened in a casino where they actually store KYC data.

[CryptoYar]

News about Polymarket hack is serious warning that even current platforms have flaws, especially when they use simple ways of logging in through other companies like Magic Labs. Since these login services only need you to use email or Google account, single weakness in their system can let hackers get your password to empty your wallet even when your phone or laptop is safe.

Youu are right that we should not leave money on such sites because way site connects to our wallet can be used to trick us into losing our money. To stay safe, it is better to keep social media logins away from crypto and use normal private keys and hardware wallets. These prediction sites are like casino we should only keep what we can afford to lose there and move our money to safe place immediately.

[rdluffy]

I wonder if the people who were affected by this hack got compensated.

Not good to leave money on a gambling site or a prediction market.

It was never good to leave money in any wallet owned by a centralised platform. But then again, some of them probably leave their money there because they use the website on a daily basis, and it is a hassle to deposit and withdraw every time they use the website.

Worse still, it's not just in these situations that you need to leave money on the site
Just look at what the OP himself said: “So I went to Polymarket and realized that all my deals were closed and my balance was $0.01.”

The hackers managed to sell the user's position and completely wipe out the account 
Even without money in your account, you may have some predictions in progress and there's no way to escape that

This “hack” is very curious, I'll follow up to see exactly what the reach was
I have an account and money on Polymarket 

[freedomgo]

Youu are right that we should not leave money on such sites because way site connects to our wallet can be used to trick us into losing our money. To stay safe, it is better to keep social media logins away from crypto and use normal private keys and hardware wallets. These prediction sites are like casino we should only keep what we can afford to lose there and move our money to safe place immediately.

I was wondering about this too. What if there were users who had millions sitting there? I remember reading before that during the US election, some bettors placed millions on the platform. Imagine if some of them were still using Polymarket, just letting their funds sit while waiting for action, and then got hacked.

We’ll have to wait for updates on how much was actually lost. But if Polymarket plans to avoid responsibility by pointing everything to a third-party app, then they really need to prove that clearly. Otherwise, that alone could seriously hurt their reputation.

[Kelward]

In my opinion, it’s not worth trusting large amounts of money to casinos, exchanges, or any other organizations. Whenever possible, it’s better to withdraw your funds to wallets that no third parties can access. Otherwise, you can always face a situation where a hacker breaks into the system and steals your money, or the organization itself may seize the funds by introducing new withdrawal rules or similar conditions. If your money isn’t in your own custody, it doesn’t truly belong to you.

Totally agree with you, like it's said on this forum that if it's not your keys it's not your coins so leaving your funds on an exchange, on a gambling platform or like in this case a prediction platform is not advisable. Whatever affects these platforms negatively will also affect your funds with them whether it's bankruptcy or hack so your best option is self custody of your coins in a none custodial wallet. This is the second time that I'm hearing about breach from a third party in this week, the first was Stake now Polymarket, but I'm glad that they were able contain it.

[ultrloa]

Youu are right that we should not leave money on such sites because way site connects to our wallet can be used to trick us into losing our money. To stay safe, it is better to keep social media logins away from crypto and use normal private keys and hardware wallets. These prediction sites are like casino we should only keep what we can afford to lose there and move our money to safe place immediately.

I was wondering about this too. What if there were users who had millions sitting there? I remember reading before that during the US election, some bettors placed millions on the platform. Imagine if some of them were still using Polymarket, just letting their funds sit while waiting for action, and then got hacked.

We’ll have to wait for updates on how much was actually lost. But if Polymarket plans to avoid responsibility by pointing everything to a third-party app, then they really need to prove that clearly. Otherwise, that alone could seriously hurt their reputation.

This is really concerning part there since if whales have millions sitting idle in that site a hacking issue is truly devastating on their reputation also for whales suffers from that incident.

Transparency is really importance here if Polymarket claims the breach is due to their third party provider, they should provide proof for transparency and also to clarify these issue.

For sure this incident already hurt their reputation since there's provably lots of user will try to avoid their site.

[Haunebu]

I have been using polymarket quite a lot recently and I can confirm that they have been total crap recently due to polygon issues which is why I am not surprised at all to hear about these hacks. Saw some users complaining about them in their discord too.

This is one area where centralized sites are usually better than decentralised sites in my opinion. Careful people!

[freedomgo]

Youu are right that we should not leave money on such sites because way site connects to our wallet can be used to trick us into losing our money. To stay safe, it is better to keep social media logins away from crypto and use normal private keys and hardware wallets. These prediction sites are like casino we should only keep what we can afford to lose there and move our money to safe place immediately.

I was wondering about this too. What if there were users who had millions sitting there? I remember reading before that during the US election, some bettors placed millions on the platform. Imagine if some of them were still using Polymarket, just letting their funds sit while waiting for action, and then got hacked.

We’ll have to wait for updates on how much was actually lost. But if Polymarket plans to avoid responsibility by pointing everything to a third-party app, then they really need to prove that clearly. Otherwise, that alone could seriously hurt their reputation.

This is really concerning part there since if whales have millions sitting idle in that site a hacking issue is truly devastating on their reputation also for whales suffers from that incident.

Transparency is really importance here if Polymarket claims the breach is due to their third party provider, they should provide proof for transparency and also to clarify these issue.

For sure this incident already hurt their reputation since there's provably lots of user will try to avoid their site.

I got that wrong earlier. I was thinking in millions, my brain just wasn’t working properly, but it was actually billions. I’m talking about the news I mentioned below.

Polymarket users have wagered $3.2 billion on the outcome of the election—and the majority of bets are on Trump winning

[Charles-Tim]

This is one area where centralized sites are usually better than decentralised sites in my opinion. Careful people!

It is worth knowing that Polymarket is not decentralized. Do not believe people, news and online places that deemed them as decentralized, they know nothing of what decentralized platform is. Only few platforms or things like Bitcoin network, Tor and Bisq are decentralized. Polymarket has web3 support but it is completely centralized.

[Dr.Bitcoin_Strange]

I have learned from the experience of others and mine that keeping money on casino account is not safe, the warning of "not your key, not you coin" does not only apply to keeping money on the exchange, it also apply to every centralized system where you can not have access to your money except with the involvement of a third party but on a decentralized system, you can access your funds anytime. If they have resolved it, then it's fast and that's good of them, just hope that they didn't also lose customers personal information to the scammers too.

[ozgr]

It's good that only a small number of users were affected, but that doesn’t reduce the seriousness of the incident. A similar issue caused by a third-party authentication provider had previously occurred on stake.com as well. Recently, these kinds of problems seem to be happening more frequently with third-party service providers. The recent outage of cloudflare is another good example of this.

[FirmWars]

I saw this coming but I was skeptical about it, I thought polymarket won't allow this to happen since they will be very conscious of their security following what has happened to other casinos in the past. Why I'm not surprised is because, starting from when polymarket became popular and has become very rich, they automatically become a target for the hackers that has been stealing from different company. Our people should also learn from this one, keeping money on betting site is not good.