Users of the Polymarket prediction market app are experiencing unauthorised draining of their wallets after logging in through their Google accounts.
Following deposits, these users found their wallets emptied, with balances reduced to zero.
It is important to note that this issue has not affected users who use wallet browser extensions like MetaMask or TrustWallet.
The first identified victim, known by the Discord username "HHeego," reported issues with his Polymarket account linked to an address ending in C3d4.
On 5 August, HHeego deposited $1,085.80 in USD Coin (USDC) from Binance into Polymarket but noticed hours later that the deposit had not appeared in his account.
Seeking assistance, he joined the Polymarket Discord and discovered that other users were experiencing similar delays, which alleviated his initial concerns.
Eventually, the deposit was reflected in the interface, but it "vanished almost as quickly as it had come," leading to a total loss of his USDC balance, which amounted to $1,188.72, including a prior balance of $102.92.
Interestingly, his $2,000 in open trades remained intact.
Screenshot of conversation with customer service agent by HHeego
Investigating further, HHeego used the Polygonscan block explorer and found that his drained USDC had been sent to an account named "Fake_Phishing399064.”
When he contacted customer support, an agent inquired whether his private key had been compromised.
As a newcomer to the crypto space, HHeego initially did not understand the term "PK leak.”
He confirmed he had never used a browser extension wallet, only logging into Polymarket via Google.
The agent assured him that the team was looking into the situation and would follow up with more information.
Despite his initial belief that the issue was a temporary glitch, HHeego deposited an additional $4,111.31 on 11 August, only to have those funds drained as well, totaling his losses to $5,197.11.
Realising his account had likely been hacked, he closed all trades, successfully withdrew nearly $1,000, and transferred the funds to his Binance account.
Upon contacting customer service again, HHeego was informed that his account had indeed been compromised.
The agent indicated they were close to understanding the situation and promised to keep him updated.
However, the last communication he received was on 15 August, where the agent described the attack as "a complex situation" and referred him to another team member.
Since then, HHeego has received no further updates.
HHeego's reported last customer service message from Polymarket
Blockchain data corroborates his account: $1,188.72 in USDC was drained via a "proxy" function on 5 August, and an additional $4,111.31 was taken on 11 August, both transfers executed by an externally owned account ending in b3E5, which is known for phishing.
HHeego confirmed he does not own or control that account.
On 12 August, approximately $1,000 was transferred to a Binance deposit address through legitimate transactions using the "Relay Call" function instead of the proxy.
The second victim, identified by the Discord username "Cryptomaniac," reported a troubling incident involving a $745 deposit made on 9 August.
Just hours after the deposit, his funds were swiftly drained and transferred to an account labeled Fake_Phishing399064.
Seeking assistance, Cryptomaniac reached out to customer service, who initially engaged with him but eventually ceased communication without resolving the issue.
He stated:
“At first, they helped me. They tried to check for some errors and stuff, but after weeks and months passed [...] it's been one month already, they stopped looking into it. Then when I messaged them, they didn't reply.”
He shared a screenshot of a statement from the customer service team, which indicated that they had identified the exploit in at least five cases, suggesting the presence of other victims.
The agent informed him that the attacker was utilising "email OTP" to gain access to victims' accounts and provided the IP address linked to the attack.
They also requested Cryptomaniac to retrieve his browser history from 2 to 4 August; however, he was unable to do so as he had previously cleared his history, following advice from another Polymarket representative.
Message to Cryptomaniac from Polymarket representative.
Blockchain evidence corroborates that Cryptomaniac's account was indeed drained of $745 USDC via a proxy function call, with the funds sent to the same phishing account as the first victim.
Notably, none of the victims accessed the platform through wallet extensions, raising concerns that this exploit specifically targets newer login methods like OAuth or email OTP.
Despite these incidents, Polymarket has maintained that the attacks are limited to a few users and not widespread.
Over $20 million in cryptocurrency, linked to the 2016 Bitfinex hack and stored in a US government wallet, has been suspiciously transferred, raising concerns of a potential theft. Blockchain analysts are investigating the sudden movement, which includes funds like Ethereum and stablecoins, possibly tied to a hacker.
JoyRadiant Capital, a DeFi lending platform, was hit by a cyberattack, losing over $50 million in USDC, WBNB, and ETH on BSC and Arbitrum. Hackers took control of its Pool Provider contract, redirecting ownership to a malicious contract. Radiant has halted lending and urged users to revoke smart contract permissions.
KikyoStripe's Pay with Crypto is the first to use Paxos' new stablecoin payments platform, enabling instant conversions between various stablecoins. Will this launch boost stablecoin adoption in the payments industry?
CatherineTrueX, a new cryptocurrency exchange will launch, using PayPal's stablecoin as its form of settlement. The crypto platform was unveiled yesterday.
XingChiCircle and Sony Block Solutions Labs are partnering to make USDC the primary transaction token on the new Soneium blockchain. This collaboration aims to enhance digital transactions and create innovative opportunities in the Web3 space, with Soneium set to launch its mainnet in 2025.
WeatherlyCircle CEO Jeremy Allaire announced that tap-and-go USDC payments on iPhones will soon be possible, following Apple's decision to open its secure payment chips to third-party developers, a move that could significantly enhance the use of blockchain technology on Apple devices.
Cheng YuanOver a million viewers joined Donald Trump and Elon Musk’s delayed X Spaces interview, which Musk attributed to a “massive DDoS attack.” Was the delay genuinely due to a DDoS attack, or did Musk fabricate the reason?
KikyoCircle’s EURC stablecoin is now live on Base, an Ethereum Layer 2 network, offering faster and cheaper euro transactions. With support from major industry players and a proven track record of USDC’s success on Base, EURC is set to enhance liquidity and global financial accessibility.
Anais
WenJun尽早建立对世界的认知、好奇心、自学能力、独立思考，造就了今天的Shayne Coplan和 Polymarket。
JinseFinanceGrayscale Research believes that Polymarket has the potential to become a “source of truth” by leveraging the transparency and record-keeping of blockchain technology, market incentives, and the collective wisdom of users.
JinseFinanceDonald Trump's odds of winning the November election have surged to 53% on Polymarket, reversing a previous dip. His recent support for cryptocurrencies is resonating with crypto investors, giving him a lead over Kamala Harris among this demographic.
HafizAs the crypto industry moves into the consumer application phase, Polymarket’s success in temporarily replacing existing prediction markets is significant.
JinseFinanceLast week, popular Solana decentralized exchange Drift announced the launch of BET, or “Bullish on Everything,” a capital-efficient prediction market built on the Drift protocol.
JinseFinancePolymarket shows a near tie between Trump and Harris for the 2024 election, with crypto stances influencing the race. Trump holds a slight edge as debates approach.
EdmundPolymarket’s recent success is almost entirely a result of the election.
JinseFinanceParaFi Capital, the largest investor in prediction markets, said first-time users are mostly participating in markets not related to the election.
JinseFinancePresident Biden tested positive for Covid while traveling in Las Vegas soon after he said a “medical condition” could prompt him to withdraw.
WenJunAs the expectations of $ETH ETF passing heat up, the market’s attention is gradually returning to the EVM ecosystem. As the largest prediction market on the chain, Polymarket has attracted much attention because of whether $ETH ETF can pass smoothly.
JinseFinance