Polymarket Denies Hacker Data Breach Claim

Polymarket, a leading decentralized prediction market platform, has denied allegations of a major data breach after a hacker using the pseudonym xorcat claimed on a cybercrime forum to have extracted and leaked over 300,000 records of user and market data.

The incident surfaced this week when xorcat posted details of a roughly 1GB data package for sale, asserting it included 10,000 unique user profiles with names, pseudonyms, bios, profile images, proxy wallets and base addresses; over 4,100 comments with attached profiles; 48,000 gamma markets with metadata; more than 250,000 active CLOB markets; 292 events with submitter addresses; 100 reward configurations; and 9,000 follower profiles. The actor attributed the extraction to undocumented API endpoints, a pagination bypass allowing unlimited queries, and CORS misconfigurations in Polymarket's Gamma and CLOB APIs, along with proof-of-concept exploits for vulnerabilities including an Axios proxy bypass and Next.js middleware flaw. Xorcat also claimed no prior notification due to the absence of a bug bounty program and hinted at upcoming releases from other prediction markets.

Polymarket swiftly rebutted the claims on X, calling...