30 万条用户数据被打包外泄，Polymarket 困在“公开数据”的辩护里

marsbitPublicado a 2026-04-29Actualizado a 2026-04-29

作者:克洛德,深潮 TechFlow

深潮导读:化名「xorcat」的黑客于 4 月 27 日在网络犯罪论坛上传压缩包,内含从 Polymarket 提取的逾 30 万条记录、5 个可运行的漏洞利用脚本以及 2 个 CVE 级漏洞,原始数据约 750MB。

区块链威胁情报账号 Dark Web Informer 次日在 X 披露此事。Polymarket 当天作出回应,称所涉数据「本就可通过公开 API 访问」,将事件定性为「功能」而非泄露。但官方声明未直接处理黑客所列的 API 错误配置和漏洞利用细节。

4 月 27 日,化名「xorcat」的攻击者在某网络犯罪论坛上传了一份压缩包:8.3MB 的 JSON 文件,解压后达到约 750MB,内含逾 30 万条从 Polymarket 提取的记录、5 个工作中的漏洞利用脚本(PoC)以及一份技术报告。

Polymarket 当日回应。但回应不是常见的危机公关式致歉与排查,而是一段近乎挑衅的反驳。该平台官方账号在 X 发文调侃,所有相关内容都可通过公开端点和链上数据访问,定性为「这是功能,不是漏洞」。

事件由此演变为罗生门:黑客方坚称这是一次未通报即公开发布的数据攻击,并具体指向几处 API 错误配置;平台方坚称所有内容均为公开数据,没有任何私密信息被泄露。

攻击路径:「一连串没上锁的门」

按 xorcat 在论坛贴文中的描述,攻击没有依赖任何单一的复杂漏洞,而更像穿过了一连串没上锁的门。据网络安全媒体 The CyberSec Guru 复盘,攻击主要利用了三类问题:未公开的 API 端点、CLOB(中央限价订单簿)交易 API 的分页绕过,以及一处 CORS(跨域资源共享)错误配置。

公开报告指出,Polymarket 多个端点据称完全不需要身份验证。比如评论端点支持暴力枚举完整的用户档案;报告端点暴露了用户活动数据;关注者端点允许任何人在不登录的情况下勾画任意钱包地址的完整社交关系图。

30 万+条记录里到底装了什么

xorcat 论坛贴文及 The CyberSec Guru、The Crypto Times 的复盘显示,外泄包大致按用户、市场、攻击工具三类组织(参见下方数据卡)。

用户侧的 1 万条独立用户档案包含姓名、昵称、个人简介、头像、代理钱包地址和底层钱包地址。9000 条关注者档案能勾勒出社交关系图。4111 条评论数据均带有附属用户档案。1000 条报告记录中涉及 58 个独立的以太坊地址。createdBy和updatedBy等内部用户 ID 字段也散落各处,间接还原了平台账户结构的部分轮廓。

市场侧涵盖 48,536 个来自 Polymarket Gamma 系统的市场(含完整元数据、condition ID、token ID)、超过 25 万个活跃的 CLOB 市场(附 FPMM 合约地址)、292 条带有提交者及裁定者内部用户名和钱包地址的事件,以及 100 份附带 USDC 合约地址和每日支付率的奖励配置。

钱包地址在链上本身是匿名的,但当它们与姓名、个人简介、头像同时出现,匿名性便随即坍塌。这是 Polymarket 此次回应中未触及的核心争议:

数据是否「公开」,与数据被聚合后是否仍能保护用户身份,是两个不同问题。

「这是功能不是漏洞」:Polymarket 的反驳

Polymarket 4 月 28 日在 X 发布的回应只有一条推文。该平台以表情符号「😂」开场,先质疑「被攻陷」一词,再逐条反驳:链上数据本就可被公开审计,没有数据被「泄露」,相同信息原本就可以通过公开 API 免费获取,不必付费购买。整段表述以「这是功能,不是漏洞」作为定性。

The Crypto Times 在报道中指出,Polymarket 的回应没有直接处理黑客所提出的具体技术指控,包括 API 错误配置、CORS 错误配置、未公开端点、缺失的速率限制等。平台在「数据是否公开」这一最容易反驳的层面强势开火,但对「攻击者通过非预期路径批量提取并打包」这一更核心的安全问题保持沉默。

xorcat 方面也称事前未通知 Polymarket,理由是该平台没有漏洞赏金计划。这一点目前未得到第三方核实,但若属实,便折射出 Polymarket 在主动安全治理方面的某种空缺:没有正式的负责任披露通道,攻击者倾向于直接公开发布而非内部上报。

这不是 Polymarket 第一次被曝安全问题

回到时间线,2024 年 8 月至 9 月,多名通过 Google 账号登录 Polymarket 的用户报告 USDC 被盗,攻击者利用 Magic Labs SDK 中proxy函数调用,将用户余额转入钓鱼地址。Polymarket 客服在 9 月底前确认了至少 5 起类似攻击。

2025 年 11 月,黑客利用 Polymarket 评论区发布钓鱼链接,被点击后向用户设备植入恶意脚本,相关诈骗活动累计造成超过 50 万美元损失。

2025 年 12 月,再次出现批量账户被盗。Polymarket 在 Discord 确认事件,归因于「第三方身份认证服务的漏洞」。社交媒体讨论普遍指向通过 Magic Labs 邮箱登录的用户群体,平台未公开点名涉事服务商,亦未披露受影响用户具体数量与损失规模。

每次事件后,平台都给出过不同程度的回应:有归咎于第三方服务商的,有承认问题并承诺联系受影响用户的。本次 xorcat 事件是其中第一次以「这本来就是公开数据」作为完整防线。从历史脉络看,本次回应更像是一次对事件性质的争夺,而非常规意义上的安全事件应对。

截至发稿,Polymarket 未对 xorcat 所披露的具体技术漏洞作出修复说明,论坛上的 PoC 脚本仍可被任何人下载。

Criptos en tendencia

Haedal ProtocolHAEDAL

Lecturas Relacionadas

Hyperliquid ETF Claim Draws Attention As HYPE Narrative Builds On X

A social media claim has brought attention to Hyperliquid (HYPE) and the growth of its related ETF products. According to a June 20 post on X by AlphaOnChain, three Hyperliquid ETFs launched in May 2026 have collectively amassed $158 million in assets under management, led by a Bitwise fund with $88 million and a 21Shares fund with $66 million. The article notes this claim is from social media and not verified by official issuer data, advising caution. Nonetheless, the report highlights that HYPE is gaining traction as a notable altcoin narrative. Its focus on on-chain perpetual trading and exchange infrastructure places it at the intersection of DeFi and derivatives, attracting traders looking for high-conviction plays beyond Bitcoin and Ethereum. The key takeaway is that while social momentum can influence short-term markets, sustainable growth for HYPE would require confirmed demand, liquidity, and continued ecosystem development.

bitcoinistHace 33 min(s)

Hyperliquid ETF Claim Draws Attention As HYPE Narrative Builds On X

bitcoinistHace 33 min(s)

How Does Codex Use a Computer? Three Entry Points and Permission Boundaries

This article explains the three primary methods for Codex to interact with a computer, each with distinct use cases, permission boundaries, and trust levels. **1. Computer Use:** This offers the broadest access, allowing Codex to visually control and interact with the graphical user interface of authorized macOS/Windows apps, system settings, and even iOS simulators. It's ideal for tasks lacking APIs or structured tools, such as operating legacy software or multi-app workflows. However, it's the slowest method and has the widest permission scope, requiring careful supervision for sensitive actions. **2. Chrome Extension:** This grants Codex access to the user's logged-in Chrome browser state, including cookies, profiles, and open tabs. It's best for tasks requiring user identity across websites like Gmail, LinkedIn, Salesforce, or internal dashboards. Its key advantage is multi-tab control for complex workflows. While more powerful for browser-based tasks than Computer Use, it carries higher sensitivity as actions are performed under the user's identity. **3. In-App Browser:** This is a browser isolated within the Codex thread, separate from the user's personal browsing data. It excels in web development and debugging scenarios—previewing local servers, testing responsive layouts, or annotating designs directly on the page. Its isolation is a strength for development but a limitation for tasks requiring login sessions. The core principle is to choose the narrowest, safest, and most structured interface for the task. Use plugins or MCPs first, resort to visual control (Computer Use) only for GUI-dependent tasks, employ the Chrome extension for identity-reliant browser work, and prefer the In-App Browser for isolated development. **Appshots** are clarified as a fourth, complementary tool for *inputting* context—capturing a screenshot of a window to point Codex to something—rather than a method for Codex to *act*. Together, this layered approach highlights a key to AI agent productization: not granting unlimited permissions, but constraining them within clear boundaries for specific tasks while preserving user oversight.

marsbitHace 44 min(s)

How Does Codex Use a Computer? Three Entry Points and Permission Boundaries

marsbitHace 44 min(s)

The "Iron Rule" of Chip Equipment Is Being Broken

For years, the semiconductor equipment industry followed an unwritten "iron rule": suppliers offered steep discounts for new tool introductions (Design-in) and faced consistent price pressure during repeat orders, especially during market downturns. This long-standing buyer's market dynamic is now being upended. Recently, SK Hynix's primary equipment suppliers have reportedly requested a 3-4% price *increase*, a nearly unprecedented move. This shift is driven by a severe supply-demand imbalance fueled by the AI compute boom. Securing equipment has become an urgent arms race as chipmakers' expansion speed dictates their ability to fulfill massive AI chip orders. Key areas feeling the strain include: **TCB (Thermal Compression Bonding) Equipment:** Demand is exploding, driven by the simultaneous needs of HBM4 memory stacking, AI chip Chip-on-Substrate (C2S), and logic Chiplet Chip-on-Wafer (C2W) packaging. Players like Hanmi Semiconductor, Hanwha Semitech, and ASMPT are receiving major orders. While hybrid bonding is seen as the future, TCB remains the pragmatic choice for HBM4 mass production, with its lifecycle extended by relaxed specifications and ongoing technological upgrades. **Test Equipment Bottlenecks:** Ironically, AI-driven shortages are now crippling test equipment manufacturing. Critical components like FPGAs, Driver ICs, and CPUs face severe shortages and extended lead times (up to 52 weeks for FPGAs), as AI data center and server vendors prioritize supply. This creates a paradoxical cycle: AI chip shortages drive fab expansion, which requires more test equipment, whose production is delayed because its key parts are diverted to make AI chips. The industry is entering a broad, AI-powered upcycle. SEMI forecasts global semiconductor equipment sales to hit a record $156 billion by 2027, fueled by investment in advanced logic/foundry, HBM-driven DRAM, and advanced packaging (like CoWoS). Major players like TSMC, SK Hynix, and Micron are aggressively ramping capital expenditure. In conclusion, leading equipment vendors are no longer just selling tools; they are selling the critical capability to deliver AI-era capacity. Pricing power is shifting decisively to those with indispensable technology in key process nodes like advanced logic, HBM, and advanced packaging, rewriting the industry's traditional power structure.

marsbitHace 57 min(s)

The "Iron Rule" of Chip Equipment Is Being Broken

marsbitHace 57 min(s)

Weekly Token Unlock: XPL to Release Millions in Token Value

Weekly Token Unlocks: XPL and SoSoValue Tokens Worth Over $10 Million Set for Release This week sees significant token unlocks for two projects. SoSoValue, an AI-powered crypto investment research platform, will unlock 13.03 million tokens, valued at approximately $3.87 million. The project aims to merge CeFi efficiency with DeFi transparency. Separately, Plasma, a Layer 1 blockchain designed for global stablecoin payments, will unlock 110 million tokens worth about $10.42 million. The network focuses on high throughput, stablecoin-native features, and full EVM compatibility. Both projects have provided their detailed token release schedules.

marsbitHace 1 hora(s)

Weekly Token Unlock: XPL to Release Millions in Token Value

marsbitHace 1 hora(s)

Bitcoin Must Hold $60K Or Risk Major Breakdown, TradingView Analyst Warns

Bitcoin has reached a critical juncture around the $60,000 level, which analysts view as a major technical and psychological support zone. According to a TradingView analysis, a successful hold above this demand area could pave the way for a recovery toward $81,000. However, the warning is clear: a decisive and sustained break below $60,000 would invalidate the bullish outlook, likely triggering stop losses and a deeper market correction. The current setup is described as a binary test—maintaining support keeps the recovery narrative alive, while losing it would signal a shift toward a more significant downturn.

bitcoinistHace 2 hora(s)

Trading

Spot

Futuros

Artículos destacados

Cómo comprar 4

¡Bienvenido a HTX.com! Hemos hecho que comprar 4 (4) sea simple y conveniente. Sigue nuestra guía paso a paso para iniciar tu viaje de criptos.Paso 1: crea tu cuenta HTXUtiliza tu correo electrónico o número de teléfono para registrarte y obtener una cuenta gratuita en HTX. Experimenta un proceso de registro sin complicaciones y desbloquea todas las funciones.Obtener mi cuentaPaso 2: ve a Comprar cripto y elige tu método de pagoTarjeta de crédito/débito: usa tu Visa o Mastercard para comprar 4 (4) al instante.Saldo: utiliza fondos del saldo de tu cuenta HTX para tradear sin problemas.Terceros: hemos agregado métodos de pago populares como Google Pay y Apple Pay para mejorar la comodidad.P2P: tradear directamente con otros usuarios en HTX.Over-the-Counter (OTC): ofrecemos servicios personalizados y tipos de cambio competitivos para los traders.Paso 3: guarda tu 4 (4)Después de comprar tu 4 (4), guárdalo en tu cuenta HTX. Alternativamente, puedes enviarlo a otro lugar mediante transferencia blockchain o utilizarlo para tradear otras criptomonedas.Paso 4: tradear 4 (4)Tradear fácilmente con 4 (4) en HTX's mercado spot. Simplemente accede a tu cuenta, selecciona tu par de trading, ejecuta tus trades y monitorea en tiempo real. Ofrecemos una experiencia fácil de usar tanto para principiantes como para traders experimentados.

761 Vistas totalesPublicado en 2025.10.20Actualizado en 2026.06.02

Discusiones

Bienvenido a la comunidad de HTX. Aquí puedes mantenerte informado sobre los últimos desarrollos de la plataforma y acceder a análisis profesionales del mercado. A continuación se presentan las opiniones de los usuarios sobre el precio de 4 (4).