Polymarket Blames a Third-Party Service Provider for Account Hack

Polymarket has just confirmed that a security flaw affected certain user accounts. It indicates that a vulnerability related to a third-party authentication provider allowed unauthorized access and resulted in losses for several victims. The platform states it has fixed the problem and indicates there is no longer any persistent risk.

What Polymarket admits and what it keeps silent about

Polymarket confirmed on Discord that it identified and resolved a security incident. This incident reportedly affected a small number of users and was linked to a flaw at a third-party authentication provider. This situation comes as the platform seemed to regain momentum despite some market concerns.

The Polymarket platform does not provide the number of impacted accounts, the total amount of losses, or the name of the provider involved. This omission is not a detail. But in security, what is not said quickly becomes playground for speculation.

And then there is the phrase “no persistent risk.” It reassures, obviously. But it does not answer the simplest question. Indeed, how can an authentication flaw lead to funds being emptied so quickly? As long as the precise mechanism is not explained, doubt sets in and the “Polymarket security flaw” becomes an unfortunately alive keyword.

Magic Labs: the ideal suspect

On social networks, many point the finger at Magic Labs because testimonies seem to focus on accounts created via this type of “email-to-automatic-wallet” connection.

This suspicion did not come out of nowhere. Polymarket has long documented a registration via Magic Labs (email login without password) to simplify onboarding. Magic, on its side, clearly explains that its embedded wallets create non-custodial wallets at login through different authentication methods.

But beware! At this stage, Polymarket has not publicly confirmed which provider is involved. Moreover, it has not published any complete technical analysis. In short, Magic Labs is a name that “fits” the scenario, but the public investigation has not delivered its final word.

The most ironic thing is that Polymarket has already been caught up by this theme. In September 2024, users complained about fund drains after logging in via Google. This was followed by USDC transfers to phishing addresses, while wallet extension users seemed less exposed. And as if that was not enough, a phishing campaign was reported via comments in November 2025, with over $500,000 in reported losses.