Polymarket compromised through a third party provider

[ZeroVinsonN]

Don't listen to biased people anyway, a lot of them talk against polymarket for two reasons. One is a primary and that is envy. Average people can't stand it that other people are making big money, so they invent arguments against them and label it all evil. Polymarket is evil and I could do it better! That kind of nonsense.  The only fair recommendation would be to stay away from all gambling, and I am pretty sure regular casinos are much more addictive than prediction markets anyway.

Yeah, although some people will prefer regular casinos and even sports betting to prediction markets, I for one am mostly a sports bettor because it's more my speed but that doesn't mean I wouldn't use prediction markets one day, it's not like anyone is going to force me on what to place my trade on, if I don't like it then I don't pick it and life goes on.
I'm just not super excited about people who would probably wear a prediction market signature if they were running a campaign here condemning it like it's the worst thing in the world, i dont like prediction markets (yet) but that doesn't mean I have to hate them.

[BitBakerr1]

The spike in security breaches is becoming alarming with some people attributing that to AI while others remain at a loss as to what might be the cause. Just this year we have seen several exchanges,  casinos, crypto wallets and now prediction sites.  If Polymarket is not even spared, that means Web3 as a whole may be up for a huge surprise in the near future. How these hackers manages to evade being caught is another thing that surprises me despite moving large somes of money.

If where all the fingers are pointing are actually true that they are the ones responsible for all the hacking happening, then we can all tell why those hackers have the boldness in doing what they are doing: they are living in a restricted country and won’t even bother trying to leave the country for anything because they know outside their walls they can be apprehended anytime.

There should be a way to punish them, it's like North Korea has the best hacking tools in the world, because tell me why haven't a country infected the North Korea server with a very bad virus? Are we just watching those James Bond movies for nothing?

Something inside of me still tells me that North Korea isn't behind this attack, they did it to themselves, Binance I meant and blaming North Korea is the easiest way out, if someone like ZachXBT can expose Chinese launderers for washing stolen crypto and send to North Korea then that money can be traced, we would have gotten more than North Korea is behind It.

It looks as if North Korea government have a special organization they train to hack, those people are actually very good in hacking and all the hacking that has been happening. It’s always associated to them after some investigation.
It looks like this North Korea people are actually untouchable because the United States is not even saying anything concerning this hack that they have been always involved in maybe because there is no concrete evidence to determine or say that they are actually the ones behind all this hacks happening.

Every company should learn to protect themselves very well because this hack is not stopping any time soon.

[Emjay24]

The polymarkets responded quickly and fixed all the scripts that were replaced by the hackers. They set up all the configurations and have now refunded almost everyone whose wallets were affected by the attack. Polymarket needs to be more serious about third party interactions, this was not the first time they faced such issues. They have incurred some losses from third parties, which promotes a negative image and affects their credibility in the market..

Any organization that deals with tired parties faces these risks, you can set the standard but cannot directly guarantee that the third parties are complying with standards. Example are the data leaks from Trezor and Ledger and Ledger implants. Third parties are always a weak point. It's important they put stricter checks on how funds pass through the third parties so that their compromise wouldn't mean loss of funds.

[PVequalNRT]

Yeah, although some people will prefer regular casinos and even sports betting to prediction markets, I for one am mostly a sports bettor because it's more my speed but that doesn't mean I wouldn't use prediction markets one day, it's not like anyone is going to force me on what to place my trade on, if I don't like it then I don't pick it and life goes on.
I'm just not super excited about people who would probably wear a prediction market signature if they were running a campaign here condemning it like it's the worst thing in the world, i dont like prediction markets (yet) but that doesn't mean I have to hate them.

The way prediction market is used in different platforms is worrying. I got a notification from kucoin to bet on Real Madrid and I thought it was a mistake until they took me to their events prediction market, that was how I knew the exchange now have a similar market like Polymarket. It seems that the competition is tough in this prediction markets and for centralized exchanges to want to start doing this service, that means the market is making money from people.

The disadvantage of this from the original prediction market is the hack. Kucoin has not been hack recently but I'm sure the hackers will be trying the exchange to steal money from them. I will prefer to use a decentralized prediction market but it will not be Polymarket.

[sompitonov]

Any organization that deals with tired parties faces these risks, you can set the standard but cannot directly guarantee that the third parties are complying with standards. Example are the data leaks from Trezor and Ledger and Ledger implants. Third parties are always a weak point. It's important they put stricter checks on how funds pass through the third parties so that their compromise wouldn't mean loss of funds.

Naturally, many users have relied on service providers like Ledger and Trezor, entrusting them with their funds. I’ve always wondered if a data breach might occur at some point one that could cause financial loss to many users. That’s why I’ve always harbored a certain level of distrust toward such services. In general, one should always think critically about any service that handles one’s digital wallets or significant sums of money. It’s even possible that many casinos have begun to view their own security in an entirely different light, given recent attacks and the ongoing evolution of AI.

[Hazink]

Any organization that deals with tired parties faces these risks, you can set the standard but cannot directly guarantee that the third parties are complying with standards. Example are the data leaks from Trezor and Ledger and Ledger implants. Third parties are always a weak point. It's important they put stricter checks on how funds pass through the third parties so that their compromise wouldn't mean loss of funds.

A lot happening in space right now is enough to send a good message to all service providers to limit how many third-party plug-ins they are using. Well, even if they operate independently, hackers will still figure out a way to exploit a loophole. The standards should be increased all round and security should be taken very seriously more than they used to.

[Churchillvv]

A lot happening in space right now is enough to send a good message to all service providers to limit how many third-party plug-ins they are using. Well, even if they operate independently, hackers will still figure out a way to exploit a loophole. The standards should be increased all round and security should be taken very seriously more than they used to.

Hacking or hacks is the new pandemic we are facing and even the most serious security systems still face threats from hackers which shows how much ground this hackers have gotten over the years and with more helps in facilitating the hacks it’s now very easy unlike before. So independently or dependently a company can still be compromised with the slightest thing. But third party is a major thing that should be on check every time.

Fun: curiosity made me ask, what if someone predicted this hack on polymarket, will they still get the win? (Payout)

[nelson4lov]

I am just reading this too on X and am asking myself what's really happening in 2026, the attacks are  getting scaring by the day and the most scary part is we just don't know what would be next after another.
[...]

You shouldn't be surprised. A lot of these platforms have been flawed from day 1. The only reason a lot for them have stayed free from hacks for so long was because some of these bugs/flaws were hidden in thousands of lines of code so nobody bothered to find them. However, with the level of AI tooling we have now, it can read and understand huge codebases with thousands of lines of codes and identify the flaws in it.

More attacks like this would continue in the future as the tools get better and better. 

[Dogedegen]

Don't listen to biased people anyway, a lot of them talk against polymarket for two reasons. One is a primary and that is envy. Average people can't stand it that other people are making big money, so they invent arguments against them and label it all evil. Polymarket is evil and I could do it better! That kind of nonsense.  The only fair recommendation would be to stay away from all gambling, and I am pretty sure regular casinos are much more addictive than prediction markets anyway.

Yeah, although some people will prefer regular casinos and even sports betting to prediction markets, I for one am mostly a sports bettor because it's more my speed but that doesn't mean I wouldn't use prediction markets one day, it's not like anyone is going to force me on what to place my trade on, if I don't like it then I don't pick it and life goes on.
I'm just not super excited about people who would probably wear a prediction market signature if they were running a campaign here condemning it like it's the worst thing in the world, i dont like prediction markets (yet) but that doesn't mean I have to hate them.

Thanks for the reasonable response, sadly we see such responses rarely in these parents. I could guarantee you that 90% or more users would turn around with their opinion of a prediction market like polymarket came here with a lucrative signature campaign. And this shows the kind of biased and bad approach that many users have. I am like this with you, I am not a big fan of the prediction markets and I have never used one actually. I have studied it a few times, looked at the platforms many times to see what the current opinion is on some situations like if the FED will raise interest rates or not. I can see their negatives and their positives at the same time. Also many people have this thing of always being against the new thing once they pass certain ages. But this is also wrong, we must be able to analyze each thing on its own and then decide a detailed opinion about it. We should not hate things simply because they are new or because the media or someone else told us to. I don't like many things in the world but not all of them are bad.

Any organization that deals with tired parties faces these risks, you can set the standard but cannot directly guarantee that the third parties are complying with standards. Example are the data leaks from Trezor and Ledger and Ledger implants. Third parties are always a weak point. It's important they put stricter checks on how funds pass through the third parties so that their compromise wouldn't mean loss of funds.

Naturally, many users have relied on service providers like Ledger and Trezor, entrusting them with their funds. I’ve always wondered if a data breach might occur at some point one that could cause financial loss to many users. That’s why I’ve always harbored a certain level of distrust toward such services. In general, one should always think critically about any service that handles one’s digital wallets or significant sums of money. It’s even possible that many casinos have begun to view their own security in an entirely different light, given recent attacks and the ongoing evolution of AI.

I disagree with the claim at the end because there is no proof for that at all. Possible like many things, but without proof it makes no sense to bring it up. Most things are possible, and most things do not happen or are not happening.

[Powerjumboo]

Does this mean that with all the hacking news that are has been happening lately, these platforms are not taking any precautionary measures to protect themselves against potential hackers? It’s so disappointing to hear that polymarket has been hacked, when predict.fun was just hacked few days ago. It could be that these hackers has already gained access into most of these websites, but they are just waiting for the right time to strike.

In recent months, we have been hearing about so many hacking incidents which makes us even more scared. We saw Binance exchange hacked two or three days ago and everyone is scared from there. This also raises a question in my mind why after so many hacking incidents, why are they not taking steps for strict security? Are they failing again and again even after taking strict steps? But of course every website and platform has to ensure maximum security. If they can ensure maximum security, then maybe the hackers will fail, otherwise the hackers will keep hacking one after the other.

[Hispo]

...

More attacks like this would continue in the future as the tools get better and better. 

It depends.
Companies, exchanges and decentralized protocols won't start still and wait for hackers to use IA in order to continue to steal as much money as possible though. They are also going to use AI in order to review their own code and cyber security, so they can patch those bugs and possible exploits before hackers have a chance to take advantage of them.

However, we are indeed in an era in which hackers and thieves sadly have gotten their hands on AI tools and use them to commit serious crimes.

[Julien_Olynpic]

I think Polymarket got off easy. The platform's losses could have been greater, but their vigilance worked, and in the end, they only lost $3 million. I get the impression that in all these AI-assisted hacks, the weak link is human error, and often a third party. Vulnerabilities are varied and often combined with human error. Code can be patched, but human behavior is difficult to correct. People are often careless because they don't risk their own money, but are simply doing hired work, often irresponsibly.

[cryptomaniac_xxx]

I think Polymarket got off easy. The platform's losses could have been greater, but their vigilance worked, and in the end, they only lost $3 million. I get the impression that in all these AI-assisted hacks, the weak link is human error, and often a third party. Vulnerabilities are varied and often combined with human error. Code can be patched, but human behavior is difficult to correct. People are often careless because they don't risk their own money, but are simply doing hired work, often irresponsibly.

Every services has it's weak leak, but the most dangerous should be human error just like what we have seen in Binance attack. Still though we can say that $3 million is not that big. But still for some criminal groups that is already easy money for them. And all they have to do is to try to hide their track from blockchain investigators.

And this could be the first one for prediction market as there could be many vulnerabilities that the hackers can find with the help of AI. And we didn't see it coming that AI could be one of our bane as far as crypto hacks and related attacks on services.

[Kelward]

Does this mean that with all the hacking news that are has been happening lately, these platforms are not taking any precautionary measures to protect themselves against potential hackers? It’s so disappointing to hear that polymarket has been hacked, when predict.fun was just hacked few days ago. It could be that these hackers has already gained access into most of these websites, but they are just waiting for the right time to strike.

In recent months, we have been hearing about so many hacking incidents which makes us even more scared. We saw Binance exchange hacked two or three days ago and everyone is scared from there. This also raises a question in my mind why after so many hacking incidents, why are they not taking steps for strict security? Are they failing again and again even after taking strict steps? But of course every website and platform has to ensure maximum security. If they can ensure maximum security, then maybe the hackers will fail, otherwise the hackers will keep hacking one after the other.

Due to the increasing numbers of hacked platforms I think that the breaches are something new, perhaps the hackers found vulnerable loopholes that all the platforms didn't know that they exist, if that is the case until they know how to completely protect their securities we will be seeing more hacks. Maybe if the hackers cannot penetrate directly they will utilize vulnerabilities through third party providers like what happened to Polymarket, but since these platforms are able to beef their security after the hacks it shows that they have solutions unless their solutions are temporary. I believe that this hacking phase will pass if the platforms gets better precautionary measures but they shouldn't relax because hackers will always upgrade their hacking skills.

[danherbias07]

Any organization that deals with tired parties faces these risks, you can set the standard but cannot directly guarantee that the third parties are complying with standards. Example are the data leaks from Trezor and Ledger and Ledger implants. Third parties are always a weak point. It's important they put stricter checks on how funds pass through the third parties so that their compromise wouldn't mean loss of funds.

A lot happening in space right now is enough to send a good message to all service providers to limit how many third-party plug-ins they are using. Well, even if they operate independently, hackers will still figure out a way to exploit a loophole. The standards should be increased all round and security should be taken very seriously more than they used to.

I agree with that. Oh, and it should not only be with the prediction markets, but gambling sites should also be thinking about how they can upgrade their security because these hackers will not stop if they know they can get away with it.
It's not just the money. The accounts of the people who signed up and did KYC will also be compromised, and if it's only due to a third-party application or provider, they have to come up with an idea on how they can filter them, or might as well do it directly.

[Antotena]

In recent months, we have been hearing about so many hacking incidents which makes us even more scared. We saw Binance exchange hacked two or three days ago and everyone is scared from there. This also raises a question in my mind why after so many hacking incidents, why are they not taking steps for strict security? Are they failing again and again even after taking strict steps? But of course every website and platform has to ensure maximum security. If they can ensure maximum security, then maybe the hackers will fail, otherwise the hackers will keep hacking one after the other.

If not that money are lost in the process of these hacks, I believed it's better that the vulnerability alert is on the increase and everywhere is alerted. The Polymarket incident could have been worse than the way it was found now, assuming they waited for the third party platform to be big before they attack, maybe all the users funds will be no where to be found. The rest of the platform that are doing the same service or external service will be checking for the same bug if there is any.

I think anything that will not be of service between your wallet and the platform, one should avoid it as possible. We can't be risking money and be losing money. If you even visit Polymarket now, you wouldn't know if there is any problem within last week. The volume is there, people are making predictions like nothing was wrong last week here, people have forgotten that some lose money recently unless if they compensate them enough.