Polymarket
Peer-to-peer prediction market for real-world events, with outcome shares on Polygon; US users go to the separate, CFTC-regulated Polymarket US.
Security record: 6 incidents · 1 own fault · 2 not or partly repaid · 2 refund pending- Outcome shares on Polygon, collateralized by pUSD, a token backed by USDC
- Non-custodial: Polymarket never takes possession of your funds
- Makers pay no fees; taker fees are 2% to 3.5% of trade value at 50c by category, and geopolitical markets are fee-free
- Markets on the UMA Optimistic Oracle settle after a proposal and a challenge period
- Daily liquidity rewards and maker rebates for resting limit orders, plus taker rebates by volume tier
Seven criteria on a scale of 10, the fee and market numbers computed from the data. Compare it with other prediction markets only. How we score
- Taker
- 3.5%
- Maker
- 0%
- Volume a day
- $87M
- Open interest
- $354M
- Rewards 8.0
- Daily liquidity rewards, maker rebates and volume-tier taker rebates
- Taker fee 2.1
- The highest taker fee: none is a 10, 4% or more is a 1.
- Volume 6.8
- Average a day: $1M is a 1, $1B is a 10, on a log scale. Under $100K a day the whole score stops at 5.
- Safety 10.0
- Live since 2020, non-custodial, UMA oracle resolution
- Ease 10.0
- Deposit from Ethereum, Solana, Bitcoin or Polygon; very wide market list
- Open interest 8.6
- $1M is a 1, $1B is a 10, on a log scale.
- Access 6.0
- No KYC, but about 37 countries are close-only, US, UK and France included
Cost to start: No Polymarket fee to deposit or withdraw; deposits from $3 on Solana and $20 on Ethereum
- Sign up with Google, email or a crypto wallet such as MetaMask, Rabby or Phantom
- Deposit crypto to your profile deposit address on Ethereum, Solana, Bitcoin or Polygon
- Pick a market and buy Yes or No shares
- Hold until resolution, when winning shares redeem for $1 pUSD, or sell early
- Polymarket vs Kalshi: What Differs for Traders Outside the USPolymarket and Kalshi price fees the same way. What differs is who regulates them, who holds your money, what you settle in and where you can trade.
- How Are Prediction Markets Resolved? Oracles and DisputesYou can be right about the world and still lose the market. How rules, oracles, feeds and disputes settle a prediction market, and what to read before you trade.
- How Frontend Hacks Drain Wallets, and How to Check a SiteThe contract was fine and the site was real, yet users lost funds. How third-party scripts, CDNs and DNS turn a trusted page into a drainer, and what to check.
Not available in the United States and several other countries; US users go to Polymarket US. Results proposed through UMA can be disputed and go to a UMA vote, which can delay payouts. Crypto sent to the wrong network or address cannot be reversed.
6 incidents · 1 own fault · 2 not or partly repaid · 2 refund pending
Past incidents 5
Compromised vendor dependency injected drainer into frontend. Polymarket said a third-party vendor was compromised, injecting a malicious script into its frontend for some users; it removed the dependency and said the compromise was contained. Estimates of losses rose from about $2.94M (Specter, at least 11 wallets) to about $3.1M in pUSD (AMLBot, 11 wallets). The vendor was not named and no smart contract was involved. Polymarket said on X that affected users will be fully refunded; reports say refunds are 'in process' but no completion has been announced. https://x.com/polymarkettrade/status/2070155882906730671
Partly own faultUsers lost $2.9M to $3.1MRefund promised
Sources: x.com, cointelegraph.com, thedefiant.io
Leaked internal top-up key drained UMA adapter funds. A six-year-old private key used for internal top-up (rewards payout) operations was compromised, and an attacker drained POL from the UMA CTF Adapter contract on Polygon. Estimates range from $520K (ZachXBT) to about $660K (Lookonchain). Polymarket said contracts, user funds and market resolution were not affected and revoked the key's permissions. Polymarket developers said 'User funds and market resolution are safe.' https://x.com/PolymarketDevs/status/2057755280641814769
Own faultNo user losses
Sources: x.com, cointelegraph.com
Five-minute BTC markets pushed via last-second Binance trade. A Stanford-led study (July 2026) of about 16,000 five-minute Bitcoin contracts found 821 traders who took about $8.2M by pushing the Binance spot price seconds before each single-snapshot settlement; 93% of losses fell on retail traders. The paper did not prove intent or link the spot orders to the same people. Polymarket switched these markets to time-weighted average prices (30-second window) on Aug 7, 2026, per reports. No refund or compensation announced; the response was a settlement-method change. No official statement URL found.
Partly own faultUsers lost about $8.2M (study estimate)Not repaid
Sources: bitcoinmagazine.com, primexbt.com
Third-party login provider flaw drained some accounts. Polymarket said on its Discord that it identified and resolved a security issue affecting a small number of users, caused by a vulnerability introduced by a third-party authentication provider, and that no lingering risks remained. Users on Reddit and X reported drained balances; users speculated the provider was Magic Labs, which Polymarket did not confirm. No loss total or user count was disclosed. Polymarket only said it 'will be in contact with impacted users'; no compensation statement found. https://www.theblock.co/post/383711/polymarket-third-party-vulnerability-hack
Partly own faultRefund not stated
Sources: theblock.co, forklog.com
UMA whale vote forced early YES on Ukraine minerals market. A roughly $7M market on whether Ukraine would agree to a Trump minerals deal before April resolved YES though no deal existed, after a UMA token holder with up to about 5M tokens swayed the oracle vote. Polymarket called the situation 'unprecedented' on Discord but said it was not a market failure and would not refund. UMA's co-founder denied any manipulation. Polymarket moderators said on Discord no refunds would be issued because it 'wasn't a market failure'. https://www.theblock.co/post/348171/polymarket-says-governance-attack-by-uma-whale-to-hijack-a-bets-resolution-is-unprecedented
Fault disputedNot repaid
Sources: theblock.co, cointelegraph.com
From the project’s statements and security coverage. Own fault means the project’s code, servers or keys; third party means a vendor, registrar, oracle or issuer it relies on.
