A signup flaw at Polymarket reportedly let attackers using stolen personal data seize nearly 500 existing U.S. accounts in late July, along with linked payment methods.
Key Points:
- A registration bug reportedly let anyone with a trader's personal data enter that trader's live account without a username or password
- Linked bank accounts and debit cards were exposed, and some users say they lost thousands of dollars while support went silent
- The incident follows a February fraud wave in which thieves tried to move at least $10 million through stolen debit cards
Polymarket Signup Bug Exposed Traders
Anyone who opened a new account with an existing trader's personal details, such as a stolen Social Security number, was reportedly dropped straight into that trader's live profile, a newspaper investigation published Saturday found.
The intruders needed no username, no password and no compromised phone, and the bank accounts and debit cards attached to those profiles also became reachable.
A person familiar with the matter called the total amount stolen small but gave no figure, and a company spokeswoman said Polymarket would cover money lost in the incident. Users told a different story. They described losses in the thousands of dollars and weeks of unanswered support messages.
One trader said he logged in during July to find his positions sold and $5,783.51 in gains routed to a debit card he did not own. He said the company credited his account $25, offered no explanation and later froze the account after he twice submitted verification details.
Also Read: Nvidia 2030 Forecasts Reveal $727 To $28,560 Gap
Checkout.com Warning Preceded Coplan Response
The account flaw followed a broader fraud wave in February, when thieves tied stolen debit cards to thousands of new U.S. accounts and tried to move at least $10 million. Payment processor Checkout.com at one point rejected more than 80% of deposits as fraudulent, against an industry norm of roughly 1%. Fraud rates fell back to normal by May, after the company capped debit cards per account and hired antifraud contractor Riskified.
Compliance staff took the problem to CEO Shayne Coplan, who told them to keep growing and pay a fine if regulators ever found out, current and former employees recalled. The team was surprised by the answer, according to the recollections of people consulted for the report.
Polymarket Security Record Under Scrutiny
Analysts have questioned whether growth outran compliance at a company now seeking funding at a valuation of about $21 billion. They also note that the $10 million figure covers attempted theft rather than confirmed losses. Polymarket says it has strengthened its systems, and an internal review by law firm Sullivan & Cromwell found the firm had complied with regulations.
The July flaw capped a rough stretch for the platform, which has not published a public postmortem on the signup bug. In June the company confirmed that a compromised vendor had injected a malicious script into its website, and attackers drained about $3.1 million from 11 user wallets before refunds were pledged.
Read Next: Google Gemini Hacks 3 Companies In First Known Autonomous Breaches
