Polymarket Suspected Data Breach Exposes Over 300,000 Records and Exploit Toolkit

According to Dark Web Informer, the decentralized prediction market platform Polymarket is suspected of being compromised, with the threat actor xorcat posting over 300,000 data records and an accompanying exploit kit on a prominent cybercrime forum. The data extraction occurred on April 27, 2026. The attackers allegedly extracted data through undisclosed API endpoints, pagination bypasses, and CORS misconfigurations in Polymarket Gamma and CLOB APIs. The leaked data includes: 10,000 complete user profiles (containing names, proxy wallets, and base addresses), 4,111 comments, 1,000 reported records (including 58 ETH addresses and administrator authentication identifiers), 48,536 Gamma market metadata entries, over 250,000 fixed-product market maker addresses for active CLOB markets, and 9,000 social graph follower records. The exploit kit contains proof-of-concept code for multiple vulnerabilities, including CVE-2025-62718 (Axios NO_PROXY bypass, CVSS 9.9, enabling server-side request forgery), CVE-2024-51479 (Next.js middleware authentication bypass, CVSS 7.5), and CORS misconfigurations. Additionally, the kit includes automated continuous data scraping scripts and a complete red team report (containing M