Polymarket’s new fix: a 2-day withdrawal address lock

New addresses need email verification before any payout can move.

The hit

Polymarket is offering users a new withdrawal address whitelist after an alleged $2.7m script breach, according to BlockBeats. Vice president of engineering Josh Stevens announced the feature on 10 November, saying it lets users restrict withdrawals to approved addresses. Adding any new address now triggers email verification & a 48-hour hold before funds can move.

Why it matters

For traders, the lock adds friction but is designed to cut the risk of funds being compromised after a stolen account session or a malicious transaction, Stevens says. The delay gives users a window to cancel an unauthorised request via email. It won’t undo past losses, but it narrows how fast a compromised account could be drained in future.

The record

Alleged breach loss	$2.7m, per BlockBeats
Lock period	48 hours before a newly added withdrawal address becomes active
How to enable	Settings → Account, recommended for users on the latest wallet version
Next security feature	Passkey support, in development (Polymarket)

What happens next

Watch for Polymarket’s wallet migration tool for users who haven’t yet used the deposit wallet, plus other built-in safeguards Stevens says are coming without manual setup.

Sources: Polymarket adds 48-hour withdrawal lock after $2.7M script breach

18+. Betting involves risk. If gambling is a problem for you or someone close to you, help is available.