A hacker using the name “xorcat” claimed that more than 300,000 records had been taken from Polymarket and posted/sold, allegedly including user profile information, wallet links, comments, and market data. Polymarket publicly rejected the claim and said the information was not from an internal breach, arguing that much of it was already available through public APIs and on-chain blockchain data. The company described the “breach” claim as essentially scraped public information rather than stolen private data.
The dispute seems to center on whether bulk aggregation of public data counts as a breach:
Polymarket’s position: data was public and auditable already.
Critics/security observers: even public data, when aggregated at scale, can create privacy risks and feel like a leak to users. Some community discussions highlighted that distinction.
One thing to keep separate: there was also an earlier, different incident involving a third-party authentication issue that reportedly affected some accounts. That is unrelated to the later “300k records” allegation.
If by “Date bre article” you meant a specific article or source, send the headline/link text and I can break it down.