Polymarket Rejects Data Breach Claims as Hacker Alleges 300K Records Stolen

A hacker named Xorcat posted claims of stealing ~300,000 Polymarket records—asserting use of undocumented API endpoints, a pagination/CLOB bypass, CORS misconfiguration, and exploitation of CVE-2025-62718 and CVE-2024-51479—to publish ~2.24 GB of data including user profiles, wallet addresses, and market data; Polymarket denies a breach, arguing the material appears to be public blockchain data likely obtained by scraping rather than an internal compromise, though user deanonymization risk remains.