Polymarket bị nghi ngờ bị xâm phạm dữ liệu, phơi bày hơn 300.000 bản ghi và bộ công cụ khai thác

The Dark Web Informer revealed that the decentralized prediction market platform Polymarket is suspected of being hacked, with the threat actor xorcat posting over 300,000 data records and an accompanying exploit kit on a well-known cybercrime forum. The data extraction date was April 27, 2026. The attackers allegedly extracted data through undisclosed API endpoints, pagination bypasses, and CORS misconfigurations in Polymarket Gamma and CLOB APIs. The leaked data includes: 10,000 complete user profiles (including names, proxy wallets, and base addresses), 4,111 comments, 1,000 reports (containing 58 ETH addresses and administrator authentication address identifiers), 48,536 Gamma market metadata entries, over 250,000 fixed-product market maker addresses for active CLOB markets, and 9,000 social graph follower records. The exploit kit contains proof-of-concept code for multiple vulnerabilities, including CVE-2025-62718 (Axios NO_PROXY bypass, CVSS 9.9, enabling server-side request forgery), CVE-2024-51479 (Next.js middleware authentication bypass, CVSS 7.5), and CORS misconfigurations. Additionally, the kit includes automated continuous pull scripts and a complete red team report (containing M