CryptoJack

Recently, Polymarket was accused of being “hacked” after a threat actor claimed to have obtained 300K+ records from the platform. But based on the available information, this looks less like a classic crypto exploit and more like something deeper: the privacy problem of public on-chain markets👇 ~~ Analysis by @MaxArt_eth ~~ Polymarket’s response was direct: it denied that a breach happened and argued that the data was already accessible through public APIs and on-chain records. The alleged dataset reportedly included user profiles, names/images, proxy wallets, base addresses and market-related data, but Polymarket’s position is that this was not stolen private data: it was scraped public data. That distinction matters. A smart contract exploit means funds were drained. A database breach means private internal data was accessed. But this incident appears closer to the third category: public infrastructure being aggregated, packaged, and sold as if it were a private leak. And honestly, this is where Web3 gets uncomfortable. Crypto users are used to the idea that transactions are public. That is part of the pitch: transparency, auditability, open settlement, no hidden books. But there is a difference between “technically public” and “socially understood as exposed.” Most users know their wallet can be viewed onchain. Fewer users fully internalize that their market activity, linked addresses, profiles, comments, timing, trading behavior, and positions can be reconstructed into a readable identity graph. This is especially sensitive for Polymarket because prediction markets are not just DeFi trades. People are not only buying BTC or swapping tokens. They are expressing views on politics, elections, war, regulation, court cases, celebrities, companies, macro events, and sometimes deeply controversial topics. That makes the data more personal. A wallet’s trading history on a prediction market can reveal what someone believes, what they know, what they are exposed to, and sometimes what they may be incentivized to influence. So even if Polymarket is correct that no private system was breached, the incident still highlights a real issue: public data can become dangerous when it is indexed well. This is the same pattern we’ve seen across crypto for years. One isolated wallet address does not always tell you much. But combine it with an API, a profile, timing patterns, known deposits, social handles, comments, and counterparty behavior, and suddenly “public transparency” turns into surveillance. That does not mean Polymarket is uniquely broken. It means prediction markets sit at the intersection of three hard problems: financial privacy, information markets, and human identity. The bull case for Polymarket is that markets can produce better real-time probabilities than media narratives or expert commentary. The bear case is that once those markets become large enough, they create incentives for scraping, manipulation, insider activity, doxxing, and targeted pressure. This incident is not proof that Polymarket failed at custody or settlement. But it is a reminder that “on-chain by design” does not automatically mean “safe for users by design.” The next phase for prediction markets probably needs more than liquidity and better UX. It needs better privacy assumptions. Clearer user expectations. Better separation between public market data and user identity. Better rate limits and API design. And probably a stronger cultural understanding that “public” does not mean “harmless.” Polymarket may be right that this was not a hack in the traditional sense. But the market should not dismiss it completely. Because the more valuable prediction markets become, the more valuable their data exhaust becomes too. And if prediction markets are going to become serious financial and information infrastructure, this is the kind of edge case they need to solve before it becomes a larger one. Based on the available information, this was not a confirmed fund-draining exploit. But it was a useful stress test. Not of Polymarket’s contracts. Of Web3’s privacy model.