Polymarket Faces Data Leak Controversy, Platform Responds Calmly

April 29 News, according to Dark Web Informer’s disclosure on X platform, the prediction market Polymarket is suspected of being hacked, with over 300k records and a vulnerability exploitation toolkit leaked to cybercrime forums.

The post claims that on April 27, attackers exploited undocumented API endpoints, pagination bypasses, and CORS misconfigurations, successfully obtaining user data.

The leaked data includes approximately 10k users’ personal identification information, 41k comments, 485k market metadata entries, 250k active CLOB markets, and addresses of 292 event submitters and resolvers.

Additionally, the attacker provided proof-of-concept code for vulnerabilities CVE-2025-62718 (9.9 score), CVE-2024-51479 (7.5 score), and others, claiming that Polymarket has no bug bounty program, and therefore did not notify the platform before releasing the vulnerability information.

Polymarket later issued a response in the comments, stating that all on-chain data on their platform is publicly auditable and accessible via open API for free, which is a platform feature, not a vulnerability, and denying any data breach, aiming to dispel external concerns about platform security.

In summary, although Polymarket emphasizes that data transparency is a platform feature, the attackers’ bulk acquisition of sensitive information through technical means still raises user privacy concerns.

If this data leak gains market attention, it could prompt the industry to reevaluate the boundaries of data transparency and establish more comprehensive vulnerability disclosure mechanisms.

#PolymarketDataLeak