Polymarket Suspected Data Breach: Over 300,000 Records and Exploit Toolkit Leaked

On April 29, it was reported that the decentralized prediction market platform Polymarket may have been hacked, with the threat actor xorcat posting over 300,000 data records and an accompanying exploit toolkit on a well-known cybercrime forum. The attackers allegedly extracted data through undisclosed API endpoints, pagination bypass, and CORS misconfigurations in Polymarket Gamma and CLOB API. The leaked content includes: complete personal information of 10,000 users (including names, proxy wallets, and base addresses), 4,111 comments, 1,000 reports (including 58 ETH addresses and administrator certification address identifiers), 48,536 pieces of Gamma market metadata, over 250,000 active CLOB market fixed product market maker addresses, and data on 9,000 follower social graphs. The toolkit contains proof-of-concept code for multiple vulnerabilities, including CVE-2025-62718 (Axios NO_PROXY bypass, CVSS 9.9, which can trigger server-side request forgery), CVE-2024-51479 (authentication bypass in Next.js middleware, CVSS 7.5), and CORS misconfigurations. Additionally, the toolkit includes automated continuous pull scripts and a complete red team report.