Polymarket suspected of data breach, over 300k records and vulnerability exploitation toolkit leaked

April 29 News, the decentralized prediction market platform Polymarket is suspected to have been hacked, with the malicious actor xorcat posting over 300k data records and a corresponding vulnerability exploitation toolkit on a well-known cybercrime forum.
It is claimed that the attacker extracted data through undisclosed API endpoints, pagination bypasses, and CORS misconfigurations in Polymarket Gamma and CLOB APIs.
The leaked content includes: 10k users’ complete personal information (including names, proxy wallets, and basic addresses), 4,111 comments, 1,000 report records (including 58 ETH addresses and admin authentication addresses), 48,536 Gamma market metadata entries, over 250k active CLOB market fixed-product market maker addresses, and social graph data of 9,000 followers.
The toolkit contains proof-of-concept code for multiple vulnerabilities, including CVE-2025-62718 (AxiosNO_PROXY bypass, CVSS 9.9, capable of triggering server-side request forgery), CVE-2024-51479 (Next.js middleware authentication bypass, CVSS 7.5), and CORS misconfigurations.
Additionally, the toolkit includes automated continuous pull scripts and a complete red team report.

ETH2.36%
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments