Polymarket Hacked for $2.9 Million, Pledges Full User Reimbursements

Polymarket’s five-minute Bitcoin up-or-down contracts relied on Chainlink oracle data tied to Binance spot prices to determine payouts. That design left settlement vulnerable to brief, relatively inexpensive price moves at the end of each contract. The episode highlights a broader weakness in ultra-short prediction markets: even when an oracle reports genuine market data, traders may still influence the underlying venue at the precise moment that decides the outcome.

Academic researchers found that more than 800 accounts traded Bitcoin on Binance during the final 10 seconds before Polymarket settlements, influencing oracle prices and generating about $8.2 million in profit. Retail traders absorbed 93% of the resulting losses, according to the study. Polymarket responded by introducing a 30-second time-weighted average price, or TWAP, for settlement and adding liquidity incentives, sharply reducing the scope for last-second price manipulation.

Polymarket allows users to trade crypto-based contracts tied to real-world outcomes, but markets involving military operations and defense decisions risk turning classified information into profit. A research report found that a group of wallets repeatedly made highly accurate military wagers, raising suspicions that some traders may have had access to nonpublic information and exposing a regulatory gap around national security and insider activity in decentralized prediction markets.

More than 150 crypto wallets recorded a 97.2% win rate on military-related bets, according to the report. Their unusual performance reportedly drew automated trading bots and large holders seeking to copy the positions, potentially amplifying the consequences of any intelligence leak. The researchers recommended mandatory know-your-customer checks and urged regulators to consider banning markets tied to sensitive secrets. The available report did not identify the research institution, disclose the amount wagered or provide a publication date.

Polymarket allows traders to use crypto assets to wager on outcomes ranging from elections to economic events, with contract prices often treated as real-time measures of collective expectations. The decentralized prediction market relies heavily on transparent blockchain records and wallet activity to establish credibility, making signs of trading on nonpublic information or coordinated bets a significant test of market integrity and a potential focus for regulators.

A Bloomberg Businessweek analysis flagged about $200 million of Polymarket trading during the first half as potentially linked to insider activity. The top 1% of profitable accounts captured more than half of all gains, while over 50% of winning wallets were created within 24 hours before placing their bets. Some traders also appeared to split positions across multiple related wallets before withdrawing proceeds through Coinbase, intensifying scrutiny of the platform’s fairness.

Polymarket is a prediction market where users trade crypto assets based on the outcomes of events, attracting customers with contracts tied to politics, sports and other topics. A Wall Street Journal investigation said the platform appeared to have paid college content creators to execute sham trades on highly realistic simulation sites, presenting fabricated profits as genuine betting experiences. The allegations raise questions about advertising disclosures and consumer trust.

The investigation found more than 1,000 promotional videos showing fake bets and profits, even though the creators had not assumed the risks claimed in the footage. Polymarket said it would conduct a comprehensive review of the content. During the 2026 World Cup, a “mystery wallet” was also said to have placed highly accurate bets and made NT$24 million in arbitrage profits, renewing scrutiny of whether the platform uses misleading promotions to attract users.

Polymarket is a decentralized prediction market built on Polygon that uses the UMA oracle and CTF Adapter to determine event outcomes and settle contracts. The attack targeted an UMA CTF Adapter wallet used internally by the team to replenish settlement funds. Because the wallet is part of the platform’s operational process, the incident raised concerns about the reliability of its settlement mechanism.

In July 2026, onchain investigator ZachXBT flagged a suspected exploit of the wallet, with the attacker draining 5,000 POL roughly every 30 seconds. Losses were initially estimated at $520,000 before exceeding $600,000. Polymarket said the vulnerability had been contained and that the affected wallet was used only for internal funding. User funds, positions and market settlements were not affected.

Prediction market Polymarket uses an offchain matching and onchain settlement model that speeds up trading but creates a state-synchronization gap. For less than NT$0.10, attackers could move assets, revoke approvals or cancel orders before settlement, rendering tens of thousands of dollars in market-making liquidity unavailable and leaving market makers with involuntary losses. Research published in June 2026 estimated that the tactics generated at least $1.49 million in profit.

Polymarket completed a core V2 fix on May 4, 2026, rewriting its underlying trading architecture, with the results becoming apparent a week after launch. The rate of anomalous “ghost fills” fell from a peak of 30% to 0.17%. Researchers also tracked 1.95 million failed settlement transactions, about 980,000 of which were attributed to 35 attack variants. The attacks had exposed $1.78 billion in trading volume to risk, with the failure rate reaching 24.3% during peak periods.

Polymarket is a prediction-market platform that provides trading data through blockchain networks and APIs, with much of its user activity accessible through public interfaces. The dispute is not only about whether a breach occurred. It also raises questions about whether the platform can clearly define the boundaries between public data, personal privacy and API security, potentially affecting trust among market participants and regulators.

Hacker xorcat claimed to have breached Polymarket by exploiting an API vulnerability and posted more than 300,000 user records and an exploitation tool on a forum. Polymarket subsequently denied that any data had been leaked, saying the material consisted of publicly accessible on-chain and API information. As of July 19, 2026, a significant discrepancy remained between the two accounts.

Crypto prediction market Polymarket allows users to bet on events including wars, with outcomes determined using official records and reporting from credible media outlets. More than $17 million was wagered on whether Iran would attack Israel on March 10, underscoring how large financial stakes could distort sensitive information from conflict zones.

Times of Israel military correspondent Emanuel Fabian reported on March 10, 2026, that a missile had landed near Beit Shemesh. Users who had bet “no” then demanded that he change the report; one said he stood to lose $900,000 and issued a death threat. After the incident came to light on March 17, Polymarket said it had blocked and reported the accounts involved.