Share
Polymarket rejected claims of a large-scale data breach after a dark web post alleged that hundreds of thousands of user records had been exposed, as US regulators simultaneously escalated their legal push against prediction markets.
The response comes as the Commodity Futures Trading Commission (CFTC) expands its effort to assert federal control over prediction markets, while multiple US states attempt to classify them as illegal betting platforms.
Screenshots circulating on dark web monitoring forums showed a user operating under the alias “xorcat” claiming to have extracted more than 300,000 Polymarket records, including user profiles, wallet addresses, and account metadata.
🚨 INTELLIGENCE ALERT: EXPLOIT KIT AND DATASET SALE – POLYMARKET 🌐📈🔓
Threat actor xorcat has put up for sale a package containing a "Red Team" exploit kit and a structured dataset exfiltrated from Polymarket (https://t.co/Cxg2Y8jFCE)—the world's largest decentralized… pic.twitter.com/PjsAEbziGq
— VECERT Analyzer (@VECERTRadar) April 27, 2026
Polymarket said the dataset doesn’t reflect any unauthorized access. The company stated that the information being offered is already available through its public APIs and blockchain records, which developers routinely access.
You "compromised" our platform by accessing publicly accessible API endpoints & on-chain data and… *checks notes* are trying to sell the data we offer developers for free?
Which VC paid you to post this? https://t.co/fdvD68Xr4A
— Polymarket Developers (@PolymarketDevs) April 28, 2026
Security researchers raised similar doubts. Vladimir S., chief security officer at Legalblock, said the incident appears to involve scraped public data rather than a database compromise, questioning the credibility of the breach narrative.
Looks like someone parsed data and tries to present it as a BD leak. Seems not probable to me.
— Vladimir S. | Officer's Notes (@officer_secret) April 28, 2026
The broader context adds pressure. Blockchain security firm Hacken reported that Web3 projects lost $482 million across 44 incidents in the first quarter of 2026, increasing scrutiny around platform security claims.
While Polymarket addressed the breach claims, regulatory pressure is building in parallel.
The CFTC filed a lawsuit against the state of Wisconsin this week, responding to state-level actions targeting prediction market platforms including Polymarket, Kalshi, Crypto.com, Robinhood, and Coinbase.
JUST IN: 🇺🇸 CFTC sues the state of Wisconsin for "encroaching" on its authority over crypto prediction markets.
— Watcher.Guru (@WatcherGuru) April 28, 2026
CFTC Chair Michael Selig said states can’t override federal authority in regulating event-based contracts, arguing that these markets fall under exclusive federal jurisdiction. The agency has now launched similar legal actions against New York, Arizona, Connecticut, and Illinois during April 2026.
Wisconsin and other states maintain that contracts tied to sports or real-world events resemble gambling products and require local licensing. The CFTC disputes that view, framing prediction markets as regulated financial instruments.
The clash reflects a deeper divide over whether prediction markets should be treated as financial instruments or betting products, a distinction that remains unresolved across US jurisdictions.
The legal escalation comes as Polymarket is already in discussions with the CFTC about re-entering the US market. The platform has been restricted since its 2022 settlement with the regulator, where it agreed to pay a $1.4 million fine over unregistered contracts.
Recent talks have focused on integrating its offshore exchange with a licensed US entity following its acquisition of a regulated derivatives platform in November 2025, according to Bloomberg.
The developments place Polymarket at the center of a broader shift in how prediction markets are regulated and scaled. Prediction markets are gaining traction, with US bank Citizens estimating annualized sector revenue above $3 billion, with a potential path toward $10 billion by 2030.
At the same time, regulatory clarity remains unresolved. States continue to challenge the model, while the CFTC moves to consolidate oversight under federal law.
The dispute is moving beyond compliance and into control, as regulators and states compete to define how a fast-growing market tied to finance, data, and event-based trading will operate.
Share
preferred on
