Polymarket breached

[Dr.Bitcoin_Strange]

The blame is often attributed to third-party service providers. I hope those affected will be duly compensated by Polymarket.

What compensation are you talking about? Polymarket is a trusted third-party platform. Irrespective of that, no one should leave their money in such platforms, or else they should expect something of this nature to happen. You and I know about this.

I dont think Polymarket should be pressured to compensate victims. What they can only do now, is to trace the scammers.

Well, I don't think anyone is pressuring them but for the sake of credibility, they should also do well to settle affected customers, it was not the fault of any customers that polymarket got compromised. If it was just a hack of a customer's account due to the person's carelessness, polymarket won't do anything about it but since the problem is from their end, they will take care of it.

[promise444c5]

.. maybe they are trying to fix this issue as quietly as possible. as for it being their fault, I think magic labs has it's faults too, and I think Polymarket will be the ones that will deal with them.

Hopefully they are trying to address it, but from what I read, affected users might still need to create a support ticket.. saw that briefly somewhere but I can’t find the source at the moment, could  be from the same url .

The issue seems to be coming from Magic Labs, yes! … but users trusted and used it through Polymarket, so Polymarket still has to deal with it one way or another.
I also noticed some comments questioning why users kept money on Polymarket, which doesn’t really make sense(imo). How else are they supposed to place bets? Besides that, reports show that in some cases, active positions were closed..what else??

[wozzek23]

To be precise, it was a few user accounts that were breached because of a vulnerability in a third party service. Polymarket appears to be safe to use if you aren’t using Magic Labs as your login method. These embedded web wallets might seem really convenient, but I’ve always felt uneasy about the idea of a wallet that can be unlocked by having access to someone’s email or social media account. If 2FA was being bypassed, that would mean somebody wouldn’t even need to hack your email account. Just knowing your email address would be enough information for somebody to get into your Polymarket account and drain your funds.

Magic labs? Hhmm.. never heard of it but this is why I only stick to those that is trusted and are already long in the game. Web wallets have evolved through time. Before, they are being unlocked by a private key and then only password is needed. The latest would be is like that you said that they can now be unlocked through social media and email. Even though it can provide an ease of access but it is just the exchange of it is our safety, that we can now be hacked easily.

[Agbamoni]

Well, I don't think anyone is pressuring them but for the sake of credibility, they should also do well to settle affected customers, it was not the fault of any customers that polymarket got compromised. If it was just a hack of a customer's account due to the person's carelessness, polymarket won't do anything about it but since the problem is from their end, they will take care of it.

It is not necessary, my friend. It should be a thing of choice, not by force.

If it were to be a crypto wallet or exchange that was breached, it would be a criterion for them to restore users' funds that were affected because they were made to store money. Unlike polymarket that was meant for gambling, not for the sake of money. I still dont know why people will leave money in a gambling platform all the time, and they expect nothing to happen to their money.

[Natalim]

Here’s a small update on the hack. There’s an estimated figure floating around that the total loss could be around $10 million across different users.

This isn’t official though, since Polymarket still hasn’t made any announcement confirming the exact amount.

https://www.onesafe.io/blog/understanding-third-party-risks-crypto-policymarket-breach

The recent Polymarket hack has gotten everybody's attention, huh? A cryptic warning, a rogue key, and a whole lot of money disappearing into the ether. The loss? About $10 million across 1,200 wallets.

And as of the latest update also, according to them the problem has already been resolved.

[OgNasty]

This seems like peanuts to them. They’re worth billions. Unfortunate for sure, but polymarket will survive this and be stronger as a result. Better to learn this lesson now as opposed to later when they’re holding a lot more user funds.

[Russlenat]

This seems like peanuts to them. They’re worth billions. Unfortunate for sure, but polymarket will survive this and be stronger as a result. Better to learn this lesson now as opposed to later when they’re holding a lot more user funds.

But the thing is, it doesn’t really affect them monetarily since they’re not admitting it was their fault. They’re pushing the blame to a third-party app, so technically the users who lost their balances are being treated as something out of their control. If they do end up refunding, that would honestly be good to hear. But based on what I’ve read so far, once they point the finger at a third party, it looks like they won’t take full responsibility for what happened. That’s what worries me.

[alani123]

As web3 gambling becomes more popular there will be an ever increasing amount of exploits hackers will try to use tongrsb funds right off the wallets of users. People entrusting their authentication on such sites to centralised tools should really consider their options. And likewise sites admins should do more to increase security. Good old 2fa is never a bad option even for a web3 site. If funds can be handled on-site after web3 authentication then yes centralised authentication solutions are a big failure point.n

[stadus]

... it looks like they won’t take full responsibility for what happened. That’s what worries me.

They said they’ll contact the affected users, but honestly we still don’t know what the actual plan is. If they decide to refund, then that’s obviously the best outcome. But if they don’t, and it turns out they won’t take responsibility, then users really have no choice but to accept what happened.

https://cryptorank.io/news/feed/2d5e8-polymarket-security-breach-details

Is Polymarket compensating affected users?
The platform stated it would contact affected users directly but hasn’t publicly detailed compensation plans for losses from the security breach.

[tread93]

It was reported by Polymarket that small number of their users were affected and that it has been resolved. The users reported  suspicious activity on their accounts.

The breach was caused by a vulnerability introduced by a third-party authentication provider.

Some users reported seeing three login attempts by attackers before their funds were ultimately drained. 

“Today I woke up and see 3 attempts to login to Polymarket. My device isn’t compromised, Google found nothing suspicious, all other services are fine.” said one Reddit user. “So I went to Polymarket and realised that all my deals were closed and balance is 0.01$.”

Other users have claimed that the security issue may have stemmed from Magic Labs, a popular wallet service integrated with Polymarket.

“My Polymarket wallet also got drained yesterday,” noted one X user. “Wallet was [Magic Labs] created. I never actually signed up for email with them so never got phishing links.”

This is not the first time users of the major prediction market have faced security issues, with some Polymarket users being drained in late 2024 after logging into the platform via their Google accounts.

Not good to leave money on a gambling site or a prediction market.

You could say that leaving money on a gambling site or prediction market is a gamble in and of itself lol. Any company is subject to being hacked if their security isn't top notch. Even if it is top notch there is always a chance that they could be hacked somehow.

[NotATether]

I also noticed some comments questioning why users kept money on Polymarket, which doesn’t really make sense(imo). How else are they supposed to place bets? Besides that, reports show that in some cases, active positions were closed..what else??

Yeah limit buy orders will not work if you're not holding a cash balance.

Also it's cheaper to just keep the funds there than to shuttle them between your Ethereum wallet and the platform and pay fees on that.