Polymarket Refutes Data Breach Claims, Cites Public API Access

Polymarket has strongly denied claims from a dark web actor who alleged a massive breach of user data. The individual, using the pseudonym “xorcat,” claimed to have stolen over 300,000 records, including 10,000 unique user profiles containing full names, profile images, proxy wallets, and base addresses. The incident occurs amid a broader trend of heightened security risks in the Web3 sector. Industry reports indicate that blockchain projects lost approximately $482 million to scams and hacks during the first quarter of 2026, spanning 44 separate incidents. Polymarket characterized the hacker's claims as "complete and utter nonsense," explaining that the data in question is accessible via public API endpoints and on-chain records. The platform emphasized that the transparency of on-chain data is a core feature of its architecture rather than a security flaw, noting that developers can access this information for free. While the attacker claimed the data was leaked due to the absence of a bug bounty program, Polymarket clarified that it launched a live bounty program on April 16, which has already received 446 reports as of Wednesday. Security researchers, including Vladimir S of Legalblock, have expressed skepticism regarding the breach. Analysis suggests the actor likely parsed existing public data to create the appearance of a database leak, making a genuine breach improbable.