- Polymarket user account hack traced to third-party authentication, not protocol flaws.
- Email-based wallet onboarding enabled account drains without smart contract exploits.
- Incident highlights systemic Web3 risk as third-party login services become failure points.
Polymarket said attackers drained a limited number of user accounts after exploiting a flaw in a third-party login service. Users described sudden balance losses and closed positions after multiple login s. Polymarket confirmed the incident on Dec. 24, 2025, and said it fixed the issue.
Reports surfaced on Dec. 22 and Dec. 23, 2025, across X, Reddit, and Discord. One Reddit user reported three login attempts, followed by a $0.01 balance. Another user reported similar s and said email two-factor authentication did not stop the drain.
Third-party authentication makes onboarding a shared weak point
Polymarket said a third-party authentication provider introduced the vulnerability. The company posted in its official Discord channel that it identified the issue and resolved it. Polymarket described the incident as affecting a small number of users.
Polymarket did not name the third-party provider and did not disclose stolen totals. However, the platform said its core protocol remained secure, and the issue stayed limited to authentication. It also said the fix removed the ongoing risk, and it would contact impacted users.
This framing shifts attention away from market mechanics and toward the crypto onboarding stack. Many platforms depend on external identity, wallet, and login services for faster signups. Consequently, a weakness in one provider can expose users across multiple apps.
Email wallet logins raise risks around embedded wallet access
User posts suggested that many affected accounts used email-based “magic link” access instead of direct wallet connections. Several reports pointed to Magic Labs as a common signup route, although Polymarket has not confirmed that link. Users also said they did not click on suspicious links before the drains.
Email-based wallet providers often create non-custodial Ethereum wallets during signup. That setup attracts first-time crypto users who do not manage extensions or seed phrases. However, the provider still controls key parts of the login and recovery flow.
Polymarket users described USDC balances draining without clear approval signals. The reports also described positions closing quickly after the unauthorized access. As a result, the incident highlights how account security can fail above the smart contract layer.
Related: Polymarket Leads Crypto Protocols in User Retention Rate
Past Polymarket incidents show stress on the access layer
This breach echoes earlier user reports from September 2024 involving Google-based logins. Users described wallet drains where attackers used “proxy” function calls. Those calls moved USDC funds to phishing addresses, according to user accounts.
Polymarket, at the time, treated the events as potentially targeted exploits tied to third-party authentication. That history matters because it points to the same structural risk. Authentication and session systems can become high-impact targets.
A separate threat surfaced in November 2025, when scammers exploited Polymarket’s comment sections. Users reported losses exceeding $500,000 after attackers posted disguised links. Those links pushed victims toward fraudulent pages that captured email logins.
The December 2025 incident again centers on integration risk, not settlement failures. Polymarket has not released a technical post-mortem or a full incident timeline. It also has not said whether it will reimburse users for losses.
Meanwhile, users have compared sign-in methods and shared wallet addresses in public threads. Some users have shifted toward direct wallet connections for higher balances. The episode reinforces a broader conclusion for crypto onboarding: third-party identity and wallet rails now sit on the critical path, so they can become the ecosystem’s most fragile point.
