Уязвимость стороннего провайдера: Polymarket снова страдает от хакерских атак Translation: Vulnerability of a third-party provider: Polymarket falls victim to hacker attacks again

The prediction platform Polymarket has confirmed that several users have been affected by a breach linked to a vulnerability from a third-party provider.

This week, social media began to flood with reports in which users expressed concerns over unauthorized login attempts into their accounts and depleted balances.

“I woke up today to find that there had been three attempts to access my profile on Polymarket. My device is secure, Google found nothing suspicious, and all other services are fine. When I logged into the platform, I noticed all my trades were closed, and my balance showed $0.01,” wrote a user on Reddit.

Another affected individual reported receiving a series of login attempt notifications, followed by the discovery of missing funds. They emphasized that they had not clicked on any suspicious links and had enabled two-factor authentication.

Comments indicate that the issue primarily affected Polymarket clients who utilized the Magic Labs service, which allows users to log in using email and creates non-custodial Ethereum wallets. This method is quite popular among novice crypto investors.

“We recently identified and resolved a security issue that impacted a small number of users. The problem stemmed from a vulnerability introduced by a third-party authentication provider,” Polymarket stated.

The platform did not disclose the exact number of affected users, the total financial impact, or the name of the provider responsible for the issue.

This isn’t the first incident of this nature at Polymarket. In September 2024, several users who logged in via Google fell victim to complete wallet draining.

Malicious actors exploited proxy manipulations to automatically withdraw USDC to their own addresses. An investigation by the platform revealed that the vulnerability was also linked to third-party authentication providers.

In November 2025, fraudsters launched a widespread phishing campaign in Polymarket’s comment section. They distributed phishing links masquerading as official resources to trick victims into giving up their credentials. The financial loss from this scheme exceeded $500,000.

It’s worth noting that Polymarket resumed operations in the US after settling a dispute with local regulators.