Polymarket account theft controversy: Magic Labs vulnerability exposed, official information vague

【Blockchain Rhythm】In recent days, Polymarket users have experienced a collective account theft incident, causing a stir on X and Reddit. Victims have posted detailed accounts of their losses on social media, sparking widespread discussion.

The root cause has been uncovered— the issue stems from Magic Labs, a third-party identity verification provider. Magic Labs’ service allows users to log in directly with their email to create Ethereum wallets, which sounds very convenient and has indeed attracted many Web3 newcomers. However, this vulnerability was exploited.

On December 24, Polymarket officially acknowledged the incident on Discord, stating that they discovered and fixed a security issue affecting some users, originating from a vulnerability in the third-party identity verification provider.

However, what’s interesting is that Polymarket’s official response is somewhat vague. They did not specify exactly how many users were affected or how much funds were stolen, nor did they name the third-party service provider involved. They simply said, “The issue has been resolved, with no potential risks,” trying to brush it off. Such an attitude indeed raises concerns. For users, this lack of information can increase anxiety—only detailed figures and transparent explanations can truly instill confidence.