Back Panewslab

Polymarket has been reportedly compromised, with over 300000 records leaked.

Panewslab • April 29, 2026

PANews reported on April 29th that, according to a disclosure by Dark Web Informer on the X platform, the decentralized prediction market platform Polymarket has been suspected of being compromised, with over 300,000 records and an exploit kit leaked to a cybercrime forum. The attackers claim the data was obtained through undocumented API endpoints, pagination bypasses, and CORS misconfigurations, with the extraction date being April 27, 2026. The leaked data includes approximately 10,000 user personal identification information entries, 41,000 , 485,000 market metadata entries, 250,000 active CLOB markets, and 292 event submitter/resolver addresses. The attackers also provided proof-of-concept code for several vulnerabilities, including CVE-2025-62718 (CVSS 9.9), CORS misconfiguration, and CVE-2024-51479 (CVSS 7.5). The attackers claim that Polymarket does not have a bug bounty program and did not notify the platform beforehand.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Polymarket Denies Data Breach Claims Amid Dark Web Allegations Polymarket, a decentralized prediction market platform, faced allegations of a data breach after a hacker known as xorcat claimed to have extracted over 300,000 records, including personal user data and exploit code, from its systems. The hacker's post on a cybercrime forum suggested that the data was obtained through undocumented API endpoints and various vulnerabilities, including CORS misconfigurations and pagination bypass techniques. Polymarket refuted these claims, stating that the data was publicly accessible via its APIs and on-chain records, characterizing the hacker's actions as mere scraping rather than a breach. The platform also highlighted its active bug bounty program, launched on April 16, 2026, contradicting the hacker's assertion that it lacked such a program. Security experts expressed skepticism about the breach, noting that the information cited by the hacker was already available to developers. The situation reflects ongoing tensions in the crypto space regarding data transparency and security. As of now, Polymarket maintains that no unauthorized access occurred. 9 sources 55

Extracted Entities

Polymarket has been reportedly compromised, with over 300000 records leaked.

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)