Nearly 500 Users Targeted Without Passwords: How the Polymarket Attack Happened?

According to a report by The Wall Street Journal, approximately 500 users on Polymarket were targeted without their passwords being known.

In the attack reported to have occurred on Polymarket’s U.S. platform at the end of July, it was stated that fraudsters attempted to open new accounts using personal information such as Social Security numbers belonging to existing customers. It was noted that through this method, some customers’ accounts, linked bank accounts, and debit cards were accessed without knowing their usernames or passwords.

It was recorded that some users lost thousands of dollars, although the total damages were not disclosed. A Polymarket spokesperson stated that the funds lost in the attack would be covered by the company.

It was also reported that messages sent by some users to the Polymarket support team remained unanswered for weeks.

It was reported that as of May, Polymarket limited the number of debit cards users could link to their accounts and that fraud rates had returned to industry levels. It was stated that since May, the company has strengthened its risk management staff, compliance procedures, and product testing.

In February, attackers attempted to deposit money into Polymarket with stolen debit cards, place bets, and transfer the winnings to other cards. It was noted that the payment processor Checkout.com rejected more than 80 percent of the Polymarket deposit transactions it processed during one period due to suspicion of fraud.

During this process, it was reported that company management removed the rule requiring deposited money to be withdrawn to the same payment source. Some employees warned that this change could increase the risk of money laundering and new attacks. It was also reported that Polymarket’s U.S. CEO and executives responsible for compliance and anti-money laundering either left or were removed from their positions in the following period.