My Polymarket Account Was Hacked — What Do I Do? Step-by-Step (October 2026)
Answer: Revoke approvals, move remaining funds to a fresh wallet, lock the email — in that order, in the first hour. Report only through help.polymarket.com.
Your Polymarket account is hacked. The first hour decides how much survives: revoke outstanding approvals, move remaining funds to a fresh wallet, and lock down the email behind the account. The first day decides how much you can prove: document everything, report through official channels, and ignore the “recovery agents” who will contact you — they are the second wave of the same attack.
What do I do in the first hour after my Polymarket account is hacked?
1. Revoke all token approvals. Use a revoke tool on Polygonscan — clear every allowance, especially unlimited ones. This stops drainers with standing permission.
2. Move remaining funds to a fresh wallet. New key, generated on a clean device. Send directly to the new address — not through any intermediary service.
3. Secure the email behind the account. Change the mailbox password from a clean device, enable hardware-key 2FA on the mailbox, and check mailbox rules/ filters (attackers add auto-forwarding rules).
4. Kill active sessions. Log out everywhere the platform allows; change the account password if one exists.
5. Check connected devices and API keys. Revoke anything you don’t recognize — the December 2025 incident class (auth-provider compromise) lives exactly here.
How do I document and report a hacked Polymarket account?
6. Record everything. Wallet addresses, transaction hashes, timestamps, screenshots of messages, the addresses that drained you. This is your evidence for reports, refund claims, and tax records.
7. Report to Polymarket officially. help.polymarket.com — initiated by you. Include the documentation. For incident-scale events (like June 2026), watch the platform’s official X account for refund programs.
8. Trace the funds. Polygonscan the drain path. Polymarket incidents have shown stolen funds sitting in traceable consolidation wallets (June 2026: pUSD swapped to ETH in a single wallet). Documentation strengthens any future recovery program claim.
9. Report to the wider ecosystem. Scam databases, the Discord’s security channel, relevant analysts. On-chain analysts (Specter, PeckShield-class) have credited community reports in past incidents.
10. File your taxes properly. Stolen crypto is a loss event depending on your jurisdiction and classification; the documentation from step 6 feeds the tax records guide’s approach.
What should you never do after a Polymarket hack?
- Don’t pay anyone who contacts you. “Recovery services” arrive on schedule after every incident — they are the second scam (see the dedicated guide)
- Don’t post your address publicly while funds remain — you become a live target
- Don’t re-enter your seed anywhere to “verify ownership” — that’s the harvest
- Don’t reuse the compromised key for the new wallet — generate fresh
How do I know which incident class I’m in?
| Symptom | Likely class | Focus |
|---|---|---|
| 2FA was on, funds gone anyway | Auth-provider compromise (Dec 2025 pattern) | Sessions, API keys, email |
| Signed something odd on the real site | Frontend phishing (Jun 2026 pattern) | Approvals, allowances |
| Visited a lookalike site | Classic phishing | Seed rotation, fresh wallet |
| Drained with no interaction | Standing approval from earlier | Revoke first, fast |
FAQ
Q: My Polymarket account was hacked — what’s the first thing to do? A: Revoke token approvals and move remaining funds to a fresh wallet. Both, in that order, within the hour. Every minute of delay is assets within standing allowances.
Q: Can Polymarket recover my stolen funds? A: The platform can’t reverse on-chain transfers, but it has voluntarily refunded incident victims (the June 2026 pledge: full refunds). Report officially — refund programs address documented victims.
Q: Someone DM’d offering to recover my funds — legit? A: No. Recovery agents who contact you first are the second scam. Real recourse comes through the platform’s own channels.
Q: Should I reuse my wallet after a hack? A: No. Generate a fresh key on a clean device. The old key’s every associated surface (email, OAuth, approvals) is presumed compromised.
Q: How do I prove what I lost? A: Transaction hashes from Polygonscan plus your trade history export. Document before you clean up — evidence first, hygiene second.
Sources
Disclaimer
Not financial advice. Educational purposes only. Updated October 2026.