Polymarket Security Bug Reportedly Exposed Users to Account Takeover and Identity Theft

A Polymarket security bug reportedly allowed identity thieves to access existing user accounts without knowing victims' usernames or passwords. The incident occurred in late July and affected nearly 500 Polymarket users, according to reporting from The Wall Street Journal.

Attackers allegedly used stolen personal information, including Social Security numbers, when attempting to create new accounts. Instead, the flaw could reportedly direct them into existing customer profiles.

The reported account takeover could also expose linked financial information. According to the reports, attackers were able to access bank accounts and debit cards connected to some affected Polymarket profiles.

Account Hack Did Not Require a Password

The reported vulnerability differed from a typical account hack involving stolen passwords or phishing credentials. Instead, the attackers allegedly exploited an issue in Polymarket's account-registration process.

The Wall Street Journal reported that some victims discovered unauthorized activity after their positions had been sold and funds were transferred to payment methods they did not recognize. One user cited in the report said $5,783.51 in gains were sent to an unfamiliar debit card.

Polymarket reportedly told the Journal that it would cover losses resulting from the incident. The company has not published a detailed public postmortem explaining the technical cause of the registration flaw.

Data Breach and Identity Theft Questions

The incident has also raised questions whether it should be described as a data breach. Available reporting describes an engineering vulnerability that could provide unauthorized access to existing accounts using stolen personal information. It does not establish that attackers obtained Polymarket's entire user database.

That distinction separates the reported account takeover from a conventional database breach, where attackers gain unauthorized access to stored customer information and extract it.

The use of stolen identity information nevertheless creates additional risks. If criminals already possess someone's personal details from another source, weaknesses in account-verification systems can potentially give those details greater value.

Read Also: Elon Musk Is Seeking Customer Data From Defunct AI Startups, Says Report—Is This For Grok AGI Plans?

Polymarket Faced a Separate Hack in June

The July security bug followed another Polymarket security incident in June. Polymarket said a compromised third-party vendor had allowed hackers to inject malicious code into its website frontend for some users. TechCrunch said it contained the incident and would refund affected users.

Blockchain security researchers estimated that $3 million in cryptocurrency was stolen from affected wallets during that incident. The attack involved compromised third-party infrastructure rather than the account-registration flaw reported in July.

Polymarket Responds to Reported Security Incidents

The reported account takeover came amid other fraud concerns involving Polymarket's U.S. platform. The Wall Street Journal reported that fraudsters attempted to use stolen debit cards to fund thousands of accounts in February, with attempted fraudulent transactions reaching at least $10 million.

The company subsequently introduced additional fraud controls, including restrictions on linked debit cards and other risk-management measures, according to the reporting.

The July incident remains distinct from those earlier events, involving an apparent account-registration flaw that reportedly exposed existing users to unauthorized access and identity theft.

NASA Adds 3 ISS Missions to SpaceX Crew Dragon Contract in $946 Million Deal

NASA Adds 3 ISS Missions to SpaceX Crew Dragon Contract in $946 Million Deal

Aston Martin Valhalla Spider Release Date Nears as New Convertible Hybrid Supercar Takes Shape

Aston Martin Valhalla Spider Release Date Nears as New Convertible Hybrid Supercar Takes Shape

Google Gemini Went Rogue in a Shocking AI Hack and Cybersecurity Incident

Google Gemini Went Rogue in a Shocking AI Hack and Cybersecurity Incident

Vocci's AI Note-Taking Ring Adds a New Wearable Twist to Smarter Meeting Notes

Vocci's AI Note-Taking Ring Adds a New Wearable Twist to Smarter Meeting Notes