Polymarket: Third-party authentication tool vulnerability exploited… some users report funds lost

On the prediction market platform Polymarket, reports that some users' accounts were breached and funds were leaked have been mounting, and the company said a security vulnerability in a third-party authentication tool was the cause. Polymarket said it has already fixed the issue and that there is no additional risk.

On the 25th (local time), Cointelegraph reported that Polymarket announced on its official Discord the previous day that it had "identified and addressed a security issue affecting a small number of user accounts." Polymarket said the incident was caused by a vulnerability in a third-party authentication provider, not by its internal systems.

Polymarket said, "The security issue has already been remedied and there is no ongoing threat," and "we will contact affected users individually." However, it did not disclose specific numbers of affected users or the amount of funds leaked.

This explanation came after reports of incidents spread on social media such as Reddit and X. Some users claimed that after multiple login attempts on their accounts, all of their funds were withdrawn.

One Reddit user said, "There were three login attempts in one day and then all transactions were settled and the balance was nearly zero," adding, "No security anomalies were found on personal devices or other services."

Some users suspected that Magic Labs, an external wallet service linked to Polymarket, might have been the cause of the incident. A user on X claimed, "Funds were drained from a Polymarket wallet created via Magic Labs," and "I did not click any phishing emails or links."

This is not the first time Polymarket user accounts have had security issues. At the end of last year, there were reports of some user accounts being compromised during login via Google accounts. The industry says that as the number of users and the transaction volume of prediction market platforms rapidly expand, the need to review authentication and wallet integration security is being highlighted again.