Polymarket links account hack to third-party service vulnerability

The platform stated that the vulnerability has been fixed and there are no longer any risks to users

Polymarket acknowledges user account hack due to third-party service

24.12.2025 - 09:45

408

2 min

Key points:

Polymarket confirmed that the account hack occurred due to a vulnerability at a third-party authentication provider.
Users reported funds being debited after receiving notifications of login attempts without clicking on the links.
The company did not disclose the number of victims or the extent of the damage, but stated that the problem had been fixed.

Decentralized prediction platform Polymarket confirmed that recent hacks of user accounts were related to a security issue with a third-party authentication provider. Reports of unauthorized access began to appear en masse earlier this week on X and Reddit.

Affected users reported multiple login attempts, after which their positions were closed, and their balances were virtually wiped out, despite the absence of phishing links and the presence of basic security measures.

What is known about the vulnerability

According to users, the incident mainly affected those who registered with Polymarket through the Magic Labs service. This provider allows users to log in via email and automatically create non-custodial Ethereum wallets, which are particularly popular among new users.

On Tuesday, Polymarket acknowledged the problem on its official Discord channel, stating that the vulnerability originated with a third-party authentication service and had already been fixed.

The company did not disclose the name of the provider, the number of affected accounts, or the amount of funds stolen, but emphasized that no residual risks had been identified and that affected users would be contacted directly.

This is not the first time Polymarket has encountered problems related to third-party authentication. In September 2024, users who logged in via Google accounts reported unauthorized withdrawals when attackers used proxy function calls to transfer USDC to phishing addresses.

Author: