Product1 publisher3 min readPublished
Polymarket's signup flow treated a stolen SSN as a password
According to the Wall Street Journal, nearly 500 Polymarket US accounts were entered by people who typed in someone else's Social Security number. The flow's duplicate-identity check opened the account it matched instead of blocking the attempt.
The Product Desk · Product desk
What happened
- The Wall Street Journal reported that nearly 500 Polymarket US users were hit in late July by a fraud attack that needed no password and no access to the victim's phone.
- Someone who tried to open a new account using an existing trader's stolen Social Security number was dropped straight into that trader's live profile, according to the report.
- One user who had joined to bet on the World Cup logged in in July to find his positions sold and $5,783.51 in gains sent to a debit card he did not own.
- A Polymarket spokeswoman told the Journal the company would cover money lost in the incident.
- In February, processor Checkout.com had already warned Polymarket that thieves were attaching stolen debit cards to thousands of new US accounts, with attempted theft of at least $10 million.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- exposure Anyone whose Social Security number sits in a breached file was reachable through this flow without their device or their password. Other companies' breaches set the size of the exposure, including the sale of 153 million driver's licenses after an identity verification firm was hit.
- decision Any team that matches new signups against a government ID now has to write down what the code does on a hit: refuse and send the person to account recovery, or hand over the account it found.
- contradiction A person familiar with the matter told the Journal this was an engineering problem with a small total stolen, while users described thousands of dollars gone and weeks of unanswered support.
- precedent The remedy on the record so far is a $25 credit worth about 0.43% of one user's loss. That $25 is the anchor other affected users can expect until the pledge to cover losses turns into payments.
A signup form that collects a Social Security number has to compare it against something. Deduplication is the ordinary reason to run the lookup, and the design decision is the branch that fires on a hit. On a hit, per the Journal's account, the applicant also got the linked bank accounts and debit cards sitting on that profile [3]. Gizmodo described the result as access to someone else's account by effectively using personal data as a password [4].
That branch encodes a guess about who is typing: a returning customer who verified once, forgot, and started over. Plenty of real users do exactly that, and so does anyone working from a breach file.
The support path is the second half of the defect. The user who lost his World Cup gains said he filed reports with local police, the FBI and the Commodity Futures Trading Commission [10]. "Polymarket US was silent for weeks and weeks," he told the Journal [11]. Support later put his account on hold after he submitted verification information twice, and still did not address the missing funds [12]. Polymarket has not published a postmortem on the signup flaw [14].
The pattern predates July. At one point Checkout.com was rejecting more than 80% of the Polymarket deposits it handled as fraudulent, against an industry benchmark of roughly 1%, at least eighty times the norm [16][22]. Employees took the problem to CEO Shayne Coplan, and the compliance team's recollection, as the Journal reported it, was that he told them to keep growing and pay a fine if regulators ever found out [17].
Remediation has tended to arrive as a refund. In June a compromised third-party vendor injected a malicious script into the site frontend for some users, and blockchain monitors put the drain at about $3.1 million in PUSD across at least 11 wallets [19]. Polymarket said it removed the dependency and would refund affected users in full, and head of experience William LeGate wrote on X that there were "no user 'losses'" [20].
If you own a verification flow, the table has four cells. One axis is whether the submitted identity matches a record you already hold. The other is whether the session has proved control of that record, by password, passkey, or a code to the contact details already on file. No match and no proof is a normal signup. A match with proof is a login. A match without proof is the cell the July traffic used, and the defensible handling is to refuse the signup and route the person into account recovery. That choice has a price, and it is paid by real returning users who lost access, get friction instead of a profile, and abandon the flow.
After February, Polymarket limited debit cards per account and brought on the antifraud contractor Riskified, and by May its fraud rates were back to industry norms [18].
What to watch
- Whether Polymarket publishes a postmortem describing how the identity-match branch was changed.
- Whether the users who described losses in the thousands are paid under the spokeswoman's commitment to cover the money.
- Whether the CFTC, the FBI or local police act on the reports the affected user said he filed.