Polymarket halts trading after vendor breach as $2.65 million drains from wallets
Polymarket 1h halt after vendor compromise; affected users will be 'made whole'
Polymarket shut down its international platform for nearly an hour Thursday after a third-party provider was compromised, with blockchain analysts estimating about $2.65 million in crypto siphoned from the site. Users on Discord reported drained wallets. The company said it fixed the issue, referred it to law enforcement, and promised to fully reimburse affected traders. The U.S. platform appeared unaffected; trading resumed around 3 p.m. ET.
One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.
- sroerick
About a month and a half I made a Polymarket account with my Google login. I never traded anything. My account got hacked and they started draining my bank account. Polymarket support was completely non responsive. My bank reversed the charges. About 5 days later I got a text from Polymarket support telling me that it looked like I was having trouble making a deposit and they could help me out. I sent them screenshots of them not responding to my support requests and then never heard back.
My Google account was not compromised. I wouldn't touch Polymarket ever again. There is some kind of massive scam happening here.
- dumberquestions
Friend of mine, who's been treated as the unlucky one as an inside joke, made a binance account - after avoiding crypto for years - just hours before the hack happened, it's now official lore that this whole chain of security incidents is entirely his fault.
- trio8453
Kind of insane how much of the front page is about security compromises today.
- rhodey
This is the same style of attack that took 1.5B from Bybit ~1yr ago.
Fundamentally: There is no way to lock webapps to reproducible builds.
Except: IPFS could do it but IPFS has been very very poorly maintained.
I published IPFS-boot ~1yr ago and its a simple idea:
1. deploy a webapp bootloader using something immutable like IPFS
2. bootloader is basically react hot reloading except user agrees what to load
3. bootloader polls a mutable list of app updates and user agree or disagree each update
Now the bootloader has a static content addressable URI but it can also do updates. TBH I think IPFS may be a lost cause but something needs to take its place and this idea is transferable to whatever that is. https://github.com/rhodey/IPFS-boot
- gnabgib
Discussion yesterday (46 points, 13 comments) https://news.ycombinator.com/item?id=50295883
Wired's coverage (25 points) https://news.ycombinator.com/item?id=50296328
WSJ's coverage (20 points) https://news.ycombinator.com/item?id=50294287