What drained Polymarket user accounts?

TLDR

Polymarket user accounts were drained after attackers exploited a vulnerability in a third?party login/authentication tool used for email?based wallets; the company says it is fixed and core markets were unaffected.

1. Root cause was a flaw in a third?party login provider for email sign?ins, with users pointing to Magic Labs, though Polymarket did not name it publicly report.
2. Polymarket said only a small number of accounts were impacted, the issue is remediated, and there is no ongoing risk company statement reported.
3. Reports described multiple unsolicited login emails followed by USDC balances being emptied; the protocol itself remained secure coverage.

Deep Dive

1. Root Cause

The incident stemmed from a vulnerability in a third?party authentication provider used for email?based wallet logins, enabling unauthorized access to some user accounts. Users and media attributed it to Magic Labs email login service, but Polymarket did not officially name the provider in public comments, according to a detailed report.

• The company framed it as an external auth flaw rather than a protocol breach, aligning with reports that the core system stayed intact analysis.
• Some user anecdotes speculated the one?time password flow was too short and brute?forceable, though this was not officially confirmed user reports roundup.

2. Scope and Status

Polymarket said only a small number of users were affected, the third?party vulnerability was remediated, and it plans to contact impacted users directly company statement reported.

• Multiple outlets noted the platform reiterated that its smart contracts and prediction market protocol were not compromised, isolating the issue to account authentication coverage.

3. How Accounts Were Drained

Victims described receiving unexpected login notification emails, then finding positions closed and USDC balances nearly zero when they later logged in. In several reports, this activity coincided with the unsolicited login alerts incident accounts.

• Users highlighted USDC losses and suspected the exploit targeted the authentication step rather than requiring device or wallet compromise incident accounts.

Conclusion

A third?party authentication flaw, not a protocol breach, enabled unauthorized access to some Polymarket accounts, mainly impacting email?based logins. The company says the issue is fixed and limited in scope, but it highlights the trade?off between easy onboarding and security. If you used convenience logins, review your account history and harden your setup, and watch for an official post or direct outreach from the team for next steps.

Confidence: moderate because multiple reputable reports converge on the third?party auth cause, while the exact provider and technical details were not named by Polymarket in public statements.