cryptosecurity

Decentralized prediction market platform Polymarket confirmed that multiple user accounts experienced losses due to a security vulnerability involving a third-party authentication provider. Social media reports suggest some users lost their funds even though their devices were secure and two-factor authentication was enabled.
Incident Details:
The affected users primarily signed up via Magic Labs, a service that allows email-based login and automatically creates non-custodial Ethereum wallets.
Users reported attempted logins to their accounts and eventual draining of funds, with some balances reduced to as low as $0.01.
Polymarket acknowledged the issue publicly on its Discord channel, stating the vulnerability has been resolved and no lingering risks remain.
User Reports:
On Reddit, one user stated: “I woke up to 3 login attempts to Polymarket. My device wasn’t compromised, and all other services were fine. I logged in and saw all my deals were closed, balance $0.01.”
Another reported similar activity, confirming multiple attempted logins before funds were drained.
Recurring Security Issues:
Polymarket has faced prior security incidents. In September 2024, several users who logged in via Google accounts had USDC drained using proxy function calls.
In November 2025, a phishing campaign in Polymarket’s comment sections caused more than $500,000 in losses, as scammers posted disguised links to fraudulent websites, tricking users into giving up credentials.
Official Statement:
Polymarket stated:
"We recently identified and resolved a security issue affecting a small number of users. The issue was caused by a vulnerability introduced by a third-party authentication provider. We will be in contact with impacted users."
Implications for Users:
Users should be cautious when using third-party login services, even with non-custodial wallets.
The incident highlights that wallet security is only as strong as its authentication provider.
Platforms must audit and monitor third-party integrations to prevent similar breaches in the future.
Security Takeaways:
Enable two-factor authentication wherever possible.
Avoid using unknown third-party login services.
Regularly monitor wallet balances for unusual activity.
Platforms must ensure transparent communication and timely patches when vulnerabilities occur.
Conclusion:
This incident reiterates that DeFi platforms and non-custodial wallets are still vulnerable to external dependencies, and users should remain vigilant. While Polymarket resolved the issue quickly, the frequency of such incidents signals a need for stronger ecosystem-wide security standards.
Tags: #CryptoSecurity #Hacks #Polymarket #Ethereum #DeFi $NIGHT