Polymarket breached

[Dr.Bitcoin_Strange]

The blame is often attributed to third-party service providers. I hope those affected will be duly compensated by Polymarket.

What compensation are you talking about? Polymarket is a trusted third-party platform. Irrespective of that, no one should leave their money in such platforms, or else they should expect something of this nature to happen. You and I know about this.

I dont think Polymarket should be pressured to compensate victims. What they can only do now, is to trace the scammers.

Well, I don't think anyone is pressuring them but for the sake of credibility, they should also do well to settle affected customers, it was not the fault of any customers that polymarket got compromised. If it was just a hack of a customer's account due to the person's carelessness, polymarket won't do anything about it but since the problem is from their end, they will take care of it.

[promise444c5]

.. maybe they are trying to fix this issue as quietly as possible. as for it being their fault, I think magic labs has it's faults too, and I think Polymarket will be the ones that will deal with them.

Hopefully they are trying to address it, but from what I read, affected users might still need to create a support ticket.. saw that briefly somewhere but I can’t find the source at the moment, could  be from the same url .

The issue seems to be coming from Magic Labs, yes! … but users trusted and used it through Polymarket, so Polymarket still has to deal with it one way or another.
I also noticed some comments questioning why users kept money on Polymarket, which doesn’t really make sense(imo). How else are they supposed to place bets? Besides that, reports show that in some cases, active positions were closed..what else??

[wozzek23]

To be precise, it was a few user accounts that were breached because of a vulnerability in a third party service. Polymarket appears to be safe to use if you aren’t using Magic Labs as your login method. These embedded web wallets might seem really convenient, but I’ve always felt uneasy about the idea of a wallet that can be unlocked by having access to someone’s email or social media account. If 2FA was being bypassed, that would mean somebody wouldn’t even need to hack your email account. Just knowing your email address would be enough information for somebody to get into your Polymarket account and drain your funds.

Magic labs? Hhmm.. never heard of it but this is why I only stick to those that is trusted and are already long in the game. Web wallets have evolved through time. Before, they are being unlocked by a private key and then only password is needed. The latest would be is like that you said that they can now be unlocked through social media and email. Even though it can provide an ease of access but it is just the exchange of it is our safety, that we can now be hacked easily.

[Agbamoni]

Well, I don't think anyone is pressuring them but for the sake of credibility, they should also do well to settle affected customers, it was not the fault of any customers that polymarket got compromised. If it was just a hack of a customer's account due to the person's carelessness, polymarket won't do anything about it but since the problem is from their end, they will take care of it.

It is not necessary, my friend. It should be a thing of choice, not by force.

If it were to be a crypto wallet or exchange that was breached, it would be a criterion for them to restore users' funds that were affected because they were made to store money. Unlike polymarket that was meant for gambling, not for the sake of money. I still dont know why people will leave money in a gambling platform all the time, and they expect nothing to happen to their money.

[Natalim]

Here’s a small update on the hack. There’s an estimated figure floating around that the total loss could be around $10 million across different users.

This isn’t official though, since Polymarket still hasn’t made any announcement confirming the exact amount.

https://www.onesafe.io/blog/understanding-third-party-risks-crypto-policymarket-breach

The recent Polymarket hack has gotten everybody's attention, huh? A cryptic warning, a rogue key, and a whole lot of money disappearing into the ether. The loss? About $10 million across 1,200 wallets.

And as of the latest update also, according to them the problem has already been resolved.

[OgNasty]

This seems like peanuts to them. They’re worth billions. Unfortunate for sure, but polymarket will survive this and be stronger as a result. Better to learn this lesson now as opposed to later when they’re holding a lot more user funds.

[Russlenat]

This seems like peanuts to them. They’re worth billions. Unfortunate for sure, but polymarket will survive this and be stronger as a result. Better to learn this lesson now as opposed to later when they’re holding a lot more user funds.

But the thing is, it doesn’t really affect them monetarily since they’re not admitting it was their fault. They’re pushing the blame to a third-party app, so technically the users who lost their balances are being treated as something out of their control. If they do end up refunding, that would honestly be good to hear. But based on what I’ve read so far, once they point the finger at a third party, it looks like they won’t take full responsibility for what happened. That’s what worries me.

[alani123]

As web3 gambling becomes more popular there will be an ever increasing amount of exploits hackers will try to use tongrsb funds right off the wallets of users. People entrusting their authentication on such sites to centralised tools should really consider their options. And likewise sites admins should do more to increase security. Good old 2fa is never a bad option even for a web3 site. If funds can be handled on-site after web3 authentication then yes centralised authentication solutions are a big failure point.n

[stadus]

... it looks like they won’t take full responsibility for what happened. That’s what worries me.

They said they’ll contact the affected users, but honestly we still don’t know what the actual plan is. If they decide to refund, then that’s obviously the best outcome. But if they don’t, and it turns out they won’t take responsibility, then users really have no choice but to accept what happened.

https://cryptorank.io/news/feed/2d5e8-polymarket-security-breach-details

Is Polymarket compensating affected users?
The platform stated it would contact affected users directly but hasn’t publicly detailed compensation plans for losses from the security breach.

[tread93]

It was reported by Polymarket that small number of their users were affected and that it has been resolved. The users reported  suspicious activity on their accounts.

The breach was caused by a vulnerability introduced by a third-party authentication provider.

Some users reported seeing three login attempts by attackers before their funds were ultimately drained. 

“Today I woke up and see 3 attempts to login to Polymarket. My device isn’t compromised, Google found nothing suspicious, all other services are fine.” said one Reddit user. “So I went to Polymarket and realised that all my deals were closed and balance is 0.01$.”

Other users have claimed that the security issue may have stemmed from Magic Labs, a popular wallet service integrated with Polymarket.

“My Polymarket wallet also got drained yesterday,” noted one X user. “Wallet was [Magic Labs] created. I never actually signed up for email with them so never got phishing links.”

This is not the first time users of the major prediction market have faced security issues, with some Polymarket users being drained in late 2024 after logging into the platform via their Google accounts.

Not good to leave money on a gambling site or a prediction market.

You could say that leaving money on a gambling site or prediction market is a gamble in and of itself lol. Any company is subject to being hacked if their security isn't top notch. Even if it is top notch there is always a chance that they could be hacked somehow.

[NotATether]

I also noticed some comments questioning why users kept money on Polymarket, which doesn’t really make sense(imo). How else are they supposed to place bets? Besides that, reports show that in some cases, active positions were closed..what else??

Yeah limit buy orders will not work if you're not holding a cash balance.

Also it's cheaper to just keep the funds there than to shuttle them between your Ethereum wallet and the platform and pay fees on that.

[Satofan44]

Well, I don't think anyone is pressuring them but for the sake of credibility, they should also do well to settle affected customers, it was not the fault of any customers that polymarket got compromised. If it was just a hack of a customer's account due to the person's carelessness, polymarket won't do anything about it but since the problem is from their end, they will take care of it.

I would not say that this is correct. If you have any kind of considerable reputation at all, you are implicitly being pressured to do the right thing even if there is no external or formal pressure on it. However, in this case there are also plenty of voices that are demanding for compensation -- sometimes even retribution. It sounds to me like you've never even opened X? People are sometimes pressuring platforms for compensation even if they get hacked in ways that are entirely their own fault, they are that dumb these days.

Magic labs? Hhmm.. never heard of it but this is why I only stick to those that is trusted and are already long in the game. Web wallets have evolved through time. Before, they are being unlocked by a private key and then only password is needed. The latest would be is like that you said that they can now be unlocked through social media and email. Even though it can provide an ease of access but it is just the exchange of it is our safety, that we can now be hacked easily.

The method that you have described is not that much safer than the method that you are criticizing. Most attack vectors that work against one of those methods, work also against the other one. Only with security that comes with basic hardware wallets or higher could you reasonably, fairly argue against this social media login (and extension wallets, or password only protected wallets).

This seems like peanuts to them. They’re worth billions. Unfortunate for sure, but polymarket will survive this and be stronger as a result. Better to learn this lesson now as opposed to later when they’re holding a lot more user funds.

Exactly, it is nothing really. If this was a centralized platform of similar size, the hack would not even be reported unless it was necessary. This is a tiny loss.

But the thing is, it doesn’t really affect them monetarily since they’re not admitting it was their fault. They’re pushing the blame to a third-party app, so technically the users who lost their balances are being treated as something out of their control. If they do end up refunding, that would honestly be good to hear. But based on what I’ve read so far, once they point the finger at a third party, it looks like they won’t take full responsibility for what happened. That’s what worries me.

That is not what "pushing the blame" is. With IT systems it is most often clear who or what is objectively at fault for something like this. There is no room for subjective interpretation as can be seen in many other industries. Therefore, if it was a third-party app that was compromised and led to some losses on Polymarket then it is the fault of that app. There is no reason for them to take full responsibility, when they are not fully responsible for this. They can't make a native re-implementation of every service and thing that they need, this is not how IT is done. All of these wallets and platforms depend on countless other packages, services and providers to operate. Even if it is objectively true that the 3rd party is at fault, that does not mean that it will be that party who will do the refunding. Things don't work simply as that, they are much more complicated. Sometimes the provider has no legal obligation to do it based on contracts, other times they would not have the capital to do the refund anyway and so forth.

With such a small amount of money involved, I see no reason why Polymarket would not do the refund and save themselves the headache.

[stompix]

What the fuck are you talking about? I didn't expect you to write something retarded like most users.   The claim that if something is decentralized then it has to be immune to hacks is obviously a deep misunderstanding of what decentralization stands for.

And what do you call it when a platform uses this misunderstanding to promote itself? If I remember correctly, there are few rules about and some legal consequences

The user is absolutely responsible for the loss in a breach, because ultimately they have decided to use the smart contract or deposit money into it. Nobody forced them, they could have not done that -- like I don't do it.

So me getting on an airplane that is going to crash down because of the company's failure to do maintenance is my fault, nobody forced me to do this, I did it myself!
Same for everything possible in this world, from food poisoning to faulty condoms, it's my fault for using it, lol!

Nope, fortunately enough, the laws are a bit different, you as a company, in this case  Polymarket, offered a service to customers, no matter how you try to label it, no matter how you try to avoid accountability, you're still liable for damages, crypto, smart contracts, bus tickets, falafel or kidner surprises the laws don't change just becuase some fancy words and some badly written ToS!

[SmartGold01]

This seems like peanuts to them. They’re worth billions. Unfortunate for sure, but polymarket will survive this and be stronger as a result. Better to learn this lesson now as opposed to later when they’re holding a lot more user funds.

Sorry to say, If I am not mistakenly they are number one rated prediction market that has gain much popularity and worthy enough than any other predictions, even though there are new ones trying to come out Polymarket have gain ground over all the prediction market and shouldn't be affected for any reason and they can actually refunds those who they found affected without even announcing it to the general public, but I know it could be announced as a marketing strategies to boost their growth and trust upon users and gamblers who are gambling on that site.

[Ziskinberg]

This is one area where centralized sites are usually better than decentralised sites in my opinion. Careful people!

It is worth knowing that Polymarket is not decentralized. Do not believe people, news and online places that deemed them as decentralized, they know nothing of what decentralized platform is. Only few platforms or things like Bitcoin network, Tor and Bisq are decentralized. Polymarket has web3 support but it is completely centralized.

They’re only partially decentralized. The decentralized part is really just the smart contracts and the blockchain side. Everything else isn’t. Account creation, platform controls, and the corporate side are still centralized, and there’s even governance involved.

That’s why they’re not fully decentralized. They just market it that way because it sounds more attractive.

Web3 sells well, people like the idea, even if in reality it’s not completely decentralized.

[Satofan44]

What the fuck are you talking about? I didn't expect you to write something retarded like most users.   The claim that if something is decentralized then it has to be immune to hacks is obviously a deep misunderstanding of what decentralization stands for.

And what do you call it when a platform uses this misunderstanding to promote itself? If I remember correctly, there are few rules about and some legal consequences

That would be fraudulent advertising, but in the case of Polymarket or any real DeFi platform this is not the case. As I have explained in my post, you do not know what it means to be decentralized. Similarly, you could make the same dumb claim that Bitcoin is not decentralized because someone can steal your money from your wallet.   The only difference is that we are talking about a protocol instead of a platform, everything else is the same in the thought comparison. That is ridiculous and outright stupid. Money can and is lost regularly, it does not matter whether something is "centralized" or "decentralized". In fact, that people are able to lose money on Polymarket is actually proof that it is decentralized. If it was centralized or built on more centralized foundations, the platform or protocol could recover the money from the thieves. You've got everything backwards.  

The user is absolutely responsible for the loss in a breach, because ultimately they have decided to use the smart contract or deposit money into it. Nobody forced them, they could have not done that -- like I don't do it.

So me getting on an airplane that is going to crash down because of the company's failure to do maintenance is my fault, nobody forced me to do this, I did it myself!
Same for everything possible in this world, from food poisoning to faulty condoms, it's my fault for using it, lol!

You can't compare software to something like an airplane. It is clear that you have zero education in this area and should refrain from making further comments that contain only lies regarding software engineering and any definitions of relevant concepts. Whenever you do something, you are accepting all risks that come with the action. When you enter that plane, there is a chance that you will die. When you buy that takeout food, there is a chance that you will get food poisoning. Simple as that, grow up.

Nope, fortunately enough, the laws are a bit different, you as a company, in this case  Polymarket, offered a service to customers, no matter how you try to label it, no matter how you try to avoid accountability, you're still liable for damages, crypto, smart contracts, bus tickets, falafel or kidner surprises the laws don't change just becuase some fancy words and some badly written ToS!

That is why, regardless of your actual age, you are still a nanny-state obsessed kid. You want others to fix the consequences of your actions. Once you start taking responsibility for your own actions, you may start growing up. In the end, you demonstrate like most users that you don't actually want decentralization regardless of what you say. This is why there will be a future with complete decentralization, and the builders will not be accountable to idiots like you for anything. If you lose money in something, it will only be your own fault. There will be nobody to cry to. You can try making some TikTok videos about you crying though, I've heard that helps.  

They’re only partially decentralized. The decentralized part is really just the smart contracts and the blockchain side. Everything else isn’t. Account creation, platform controls, and the corporate side are still centralized, and there’s even governance involved.

That’s why they’re not fully decentralized. They just market it that way because it sounds more attractive.

Web3 sells well, people like the idea, even if in reality it’s not completely decentralized.

True, but completely nonsensical point. If governance was decentralized then Polymarket would be completely shit. Most of the users here are dumb as rocks, most of gamblers are dumb too. Should they have a voice in how business operations are run? Polymarket is successful because governance is centralized and because those powers are centralized in a few owners. The part that should be decentralized is decentralized.

[Smartprofit]

This is all very sad! Polymarket is a recognized leader among online forecasting platforms. Many players really liked the idea of ​​such a decentralized platform where they can earn money by betting on various events.💁

I still hope that Polymarket will compensate all its clients for their losses. Justifying their inaction by blaming solely a third-party service (the Magic Labs wallet) for this situation won't work, in my opinion. Polymarket interacts with its clients as a holistic system. And all elements of this system must ensure the safety of players. Polymarket had a choice. They could either create their own secure connection mechanisms to their platform or use third-party solutions (however, in this case, they would be fully responsible for all financial losses of their clients due to the fault of this third party). This is a mature position.

As for players not being allowed to store large sums of money on the platform, how can this be implemented in practice? If a player actively bets on the Polymarket platform, then, in my opinion, this is inevitable.