Robinhood

Gamma

Polymarket

Prediction markets platform Polymarket has denied recent reports that its customer data was breached after a hacker on the dark web posted what the person claimed was a trove of private user details.
Cybersecurity company Vecert Analyzer and several other X accounts that track dark web activity <a href="https://x.com/VECERTRadar/status/2048892549473943738" rel="noopener noreferrer nofollow">shared</a> screenshots from DarkForums on Tuesday showing a hacker using the pseudonym “xorcat” claiming to have breached Polymarket.
In the post, xorcat said they had stolen over 300,000 records, including 10,000 unique user profiles with full names, profile images, proxy wallets and base addresses.&nbsp;
Polymarket <a href="https://x.com/PolymarketDevs/status/2049253128092950970" rel="noopener noreferrer nofollow">called</a> the claims of a data breach “complete and utter nonsense” and said the information the hacker posted is already available online.
The crypto industry saw a sudden surge in crypto-related hacks and exploits in April, putting many in the space on high alert. Blockchain security company Hacken <a href="https://cointelegraph.com/news/web3-hacks-cost-464-million-in-q1-hacken" rel="noopener noreferrer nofollow">reported earlier this month</a> that Web3 projects lost $482 million to hacks and scams in the first quarter of 2026 across 44 incidents.
“You compromised our platform by accessing publicly accessible API endpoints &amp; on-chain data and *checks notes* are trying to sell the data we offer developers for free? Which VC paid you to post this?” Polymarket <a href="https://x.com/polymarketdevs/status/2049205160421863468?s=46&amp;t=MuRujqZUAz3TQE1vmr3c6A" rel="noopener noreferrer nofollow">said</a>.
In another post, the prediction market <a href="https://x.com/Polymarket/status/2049204076777234600" rel="noopener noreferrer nofollow">said</a>: “Part of the beauty of being on chain is all our data is publicly auditable, this is a feature, not a bug. No data was leaked, it's accessible via our public endpoints &amp; on-chain data. Instead of paying for the data, you can access it for free via our APIs.”
<img alt="Polymarket denies data breach, says hacker is selling public data" height="373" src="https://payload.lum-tri.org/api/media/file/pasted-image-125.png?prefix=media%2Fcontent" width="865">
Source: <a href="https://x.com/Polymarket/status/2049204076777234600" rel="noopener noreferrer nofollow">Polymarket&nbsp;</a>
<h2 id="hacker-claims-over-300-000-records-stolen">Hacker claims over 300,000 records stolen&nbsp;</h2>
The so-called hacker said the data was being posted because Polymarket didn’t have a bug bounty program.&nbsp;
Related: <a href="https://cointelegraph.com/news/hackers-use-gmails-dot-alias-trick-to-impersonate-robinhood-for-phishing-attack" rel="noopener noreferrer nofollow">Scammers use Gmail dot alias trick to spoof Robinhood in phishing scam</a>
However, Polymarket has a live bug bounty program that <a href="https://cantina.xyz/bounties/ff945ca2-2a6e-4b83-b1b6-7a0cd3b94bea" rel="noopener noreferrer nofollow">started</a> April 16 and has received 446 reports as of Wednesday.&nbsp;&nbsp;
<img alt="Polymarket denies data breach, says hacker is selling public data" height="700" src="https://payload.lum-tri.org/api/media/file/pasted-image-126.png?prefix=media%2Fcontent" width="1528">
Source: <a href="https://x.com/DarkWebInformer/status/2049163029430870034" rel="noopener noreferrer nofollow">Dark Web Informer&nbsp;</a>
Xorcat also said data was pulled via undocumented API endpoints, pagination bypass and CORS misconfiguration on Polymarket's Gamma and CLOB APIs. The hacker claimed to have breached other prediction markets and planned to release the data over the next few days.
Several security experts have expressed doubt. Vladimir S, a threat researcher and chief security officer at Legalblock, <a href="https://x.com/officer_secret/status/2049192002382659667" rel="noopener noreferrer nofollow">said</a> it appears “someone parsed data and is trying to present it as a [DB] leak. It does not seem probable to me.”
Magazine: <a href="https://cointelegraph-magazine.com/clarity-act-define-path-non-custodial-defi-us/" rel="noopener noreferrer nofollow">Forget stablecoin yield, how does the CLARITY Act treat DeFi?</a>&nbsp;&nbsp;&nbsp;

Polymarket denies data breach, says hacker is selling public data

Table of Contents

Cointelegraph

Other articles published on Apr 29, 2026

Join our free newsletter for daily crypto updates!