Polymarket Attributes Hack to Third-Party Authentication Flaw

Polymarket, a decentralized prediction market platform, has confirmed that a recent security breach stemmed from a vulnerability in a third-party authentication service rather than its Core systems. The exploit affected users who signed up via Magic Labs, a non-custodial wallet provider, with attackers draining funds from a limited number of accounts.

Users reported unauthorized login attempts and depleted balances earlier this week, prompting investigations. One victim described waking to find their Polymarket balance reduced to $0.01 after suspicious activity. The platform has since resolved the issue and plans to contact affected users, though the total financial impact remains undisclosed.

Security concerns center on external login mechanisms, particularly email-based authentication through Magic Labs. The incident highlights ongoing challenges in Web3 infrastructure security, where third-party integrations can create unforeseen vulnerabilities even when CORE protocols remain intact.