Polymarket denies data breach, says hacker is selling public data
In a brazen attempt to sow discord, a mysterious hacker known as "xorcat" surfaced on the dark web, touting a supposed treasure trove of sensitive user information pilfered from Polymarket, a prominent prediction markets platform. However, Polymarket swiftly dismissed these allegations as baseless, asserting that the data in question is freely available online. The purported breach, which allegedly involved the theft of over 300,000 records, including 10,000 unique user profiles replete with personal details and wallet information, was met with skepticism by the company.
According to cybersecurity experts, including Vecert Analyzer, the dark web has been abuzz with activity, with several sources sharing screenshots of xorcat's claims on DarkForums. The hacker purportedly boasted of exploiting vulnerabilities in Polymarket's Gamma and CLOB APIs, leveraging undocumented endpoints, pagination bypass, and CORS misconfiguration to access the data. Nevertheless, Polymarket remains adamant that no breach occurred, instead suggesting that the hacker merely accessed publicly available information through its APIs and on-chain data.
The incident unfolds against a backdrop of heightened concern within the crypto industry, which has witnessed a rash of hacks and exploits in recent weeks. As noted by blockchain security firm Hacken, Web3 projects have lost a staggering $482 million to malicious activities in the first quarter of 2026, with 44 incidents reported. Polymarket, however, appears unfazed by xorcat's claims, pointing out that its data is intentionally publicly accessible, allowing for transparency and auditability. The company also highlighted its existing bug bounty program, which has been active since April 16 and has received 446 reports to date.
Security experts, including Vladimir S, a threat researcher and chief security officer at Legalblock, have expressed doubts about the validity of xorcat's claims, suggesting that the hacker may have simply parsed publicly available data and attempted to pass it off as a breach. As the situation continues to unfold, it remains to be seen whether xorcat's claims will be substantiated or dismissed as a clever ruse. In the meantime, Polymarket remains confident in the security of its platform, emphasizing the importance of transparency and public access to its data.