@theweb3jess@consensus2026@CoinDesk So well said. Here's hoping crypto's light-hearted absurdity + genuine innovation outlasts the bro-culture era.
That energy, alongside the "cypherpunk cooperative" roots, feels way more crypto-native, and a lot more pluralist.
‼️ Polymarket, the decentralized prediction market platform, has allegedly been breached, with 300,000+ records and an exploit kit leaked on a popular cybercrime forum. The actor states Polymarket has no bug bounty program and was not notified.
⠀
‣ Threat Actor: xorcat
‣ Category: Data Leak / Exploit Kit
‣ Victim: Polymarket
‣ Industry: Cryptocurrency / Prediction Markets
⠀
The actor states the data was pulled via undocumented API endpoints, pagination bypass, and CORS misconfiguration on Polymarket's Gamma and CLOB APIs. The pack also includes working POCs for multiple CVEs and an auto-dump script. Date of extraction: 2026-04-27.
⠀
What's in it:
⠀
▪️ 300,000+ total records
▪️ ~750 MB extracted / ~8.3 MB compressed JSONs
▪️ 10,000 unique user profiles with full PII (name, pseudonym, bio, profile image, proxy wallet, base address)
▪️ 4,111 comments with attached profile objects
▪️ 1,000 report records containing 58 unique ETH addresses + admin_auth_addr indicator
▪️ 48,536 gamma markets with full metadata, condition IDs, token IDs
▪️ 250,000+ active CLOB markets with FPMM addresses
▪️ 292+ events with submitter/resolver ETH addresses and internal usernames
▪️ 100 reward configurations with USDC contract addresses and daily rates
▪️ 9,000 follower profiles with names, pseudonyms, proxy wallets
▪️ Internal user IDs exposed in createdBy/updatedBy fields
⠀
Vulnerabilities included (POCs in ZIP):
⠀
▪️ CVE-2025-62718: Axios NO_PROXY Bypass (CVSS 9.9, SSRF to internal services)
▪️ CORS Misconfiguration on CLOB API (wildcard origin + credentials=true)
▪️ CVE-2024-51479: Next.js Middleware Auth Bypass (CVSS 7.5)
▪️ CLOB Pagination Validation Bypass (limit=999999 accepted, no rate limiting)
▪️ Unauthenticated /comments/{id} endpoint (brute-forceable, leaks full profiles)
▪️ Unauthenticated /reports endpoint (leaks user activity + admin indicator)
▪️ Unauthenticated /v1/data/followers/{address} (full social graph enumeration)
⠀
Pack contents:
⠀
▪️ All dumped JSONs (markets, events, profiles, comments, reports, rewards, series)
▪️ 5 working POCs (CORS exploit, Axios SSRF, Next.js bypass, pagination DoS, WebSocket exploit)
▪️ Auto-dump script (continuously pulls fresh data until endpoints are patched)
▪️ Full redteam report with MITRE ATT&CK mapping
▪️ Additional 350MB data dump
Bitcoin has officially round-tripped back to where it was before Trump took office.
Along the way we got zero alt season, nonstop scams/grifts, pardons for fraudsters, geopolitical isolation, gestapo 2.0, and pedo protection.
Great trade, CT.
@grok@Theoblybriguy@shibuyayume@Acyn@grok
Do you think it's likely that Buttigieg actually believes taking corporate greed and outsized wealth out of politics is good for America?
That’s not exactly a fringe view.
Has he been consistent on this issue throughout political life?
Finally, the last infinity stone of the bull market is in place.
@UpOnlyTV about to Thanos them charts (directionally unclear)
Either way, looking forward to seeing the Cobie-Ledger duo back on a hot mic 🤝
Probably one of the most severe flushes I’ve ever seen on alts, I didn’t even imagine alts had this much leverage in them. It feels like someone got hit very hard and will see a large body float to the surface soon, reminds me a little of summer 2021.
Good reminder to myself to own things that I am actually bullish on, and not things I am trying to shift on momentum. Some charts look like they’ll never recover, whereas some things look buyable for the first time in a while.
When everyone is making hilarious amounts of money I am always tempted to start using leverage again. It is almost impossible to fight the feeling that you’re not making enough, or everyone else is outpacing you. Good reminder that fighting that feeling and avoid the wipeouts is worth it in the end.
Check on your friends, likely a bad day for many.
Personally, am concentrating my bags into the things I am happy to own for the next few years, and shedding the fat. Realised I own some assets based on not wanting to miss out, rather than on some actual thesis. Days like today are much easier for me if I think my bags will bounce back, and much worse if I’m losing money owning things I don’t even believe in.
Don’t let a leverage blowup dictate your long-term views. The future is bright, good things to come, patience is rewarded.
嵐の後
Secure, encrypted messaging is coming to the new Coinbase Wallet, powered by @xmtp_. DMs and group chats are about to get a whole lot more powerful.
- Talk with AI Agents
- Make trades in real-time
- Use mini apps directly in the chat
🗓 2025 Crypto May Calendar
May 1 : US - Initial Jobless Claims
May 1 : US - Fed's Balance Sheet
May 1 : JP - BoJ Interest Rate Decision
May 1 : Coinbase - Bitcoin Yield Institutional Fund
May 1 : MSTR - Earnings Call
May 1 : $WLD - Live Update with Sam Altman
May 1 : $RUNE - Mainnet V3.5
May 1 : $SUI - $253M Unlock
May 2 : US - Unemployment Rate
May 2 : US - Nonfarm Payrolls
May 1 ~ May 2 : $SUI - Sui Basecamp
May 2 : $PENDLE - Fee Structure Update
May 2 : $ENA - $13M Unlock
May 2 : Binance - $ALPACA $PDA $VIB $WING Spot Delisting
May 5 : $HYPE - New Fee/Stakigng Tiers System
May 5 : $RUNE - $TCY TGE
May 5 : $SHM - TGE
May 5 : IOTA - New Mainnet
May 5 : $KAS - Crescendo Hardfork
~May 5 : $CFX - CFX Burn Proposal
May 6 : $BERA - End of BOYCO
May 6 : House Financial Services Committee - Hearing on Digital Assets
May 6 ~ May 8 : $S - Sonic Summit
May 6 : $CSPR - Casper 2.0
May 7 : US - FOMC
May 7 : $ETH - Pectra Upgrade
May 7 : Exchanges - Suspension of ETH-Based Deposits and Withdrawals
May 7 : Upbit, Bithumb - $LOOM Delisting
May 7 : $BABYDOGE - https://t.co/kZl8McIUxL
May 7 : $OBOL - TGE
May 8 : US - Initial Jobless Claims
May 8 ~ May 11 : RU - Temporary Ceasefire in the Russia-Ukraine War
May 8 : JP - BOJ's March MPM Minutes
May 8 : Upbit - $HPO Delisting for Rebranding
May 8 : COIN - Earnings Call
~May 8 : $ZK - Big Announcement
May 9 : Coinbase - $BTC $ETH Futures for US
May 9 : $MOVE - $12M Unlock
May 11 : $LAYER - $84M Unlock (12.87% of Cir. Supply)
May 12 : US - Federal Budget Balance
May 12 : SEC - Virtual Asset TF 3rd Roundtable
May 12 : Upbit, Bithumb - $HIFI Delisting
~May 12 : $TRUMP - Snapshot Ends
May 12 : $APT - $62M Unlock
May 13 : US - CPI
May 13 : JP - BOJ's April MPM Summary of Opinions
May 13~5/16 : US - Trump Middle East Visit
May 14~5/16 : Consensus Toronto
May 15 : US - PPI
May 15 : $XEC - Network Upgrade
May 16 : Terraform Labs - Loss Claims Registration Deadline
May 19 : CME - XRP Futures
May 19 ~ May 22 : MSFT - Microsoft Build
May 20 ~ May 21 : GOOGL - Google I/O
May 22 : $TRUMP - Dinner with Trump
~May 26 : US - U.S. Senate to Vote on GENIUS Act
May 28 : NVDA - Earnings Call
May 30 : FTX - 2nd Repayment
👀 TBD in May
US, CN - Trump - Xi Jinping Meeting
TSLA - The Return of Elon Musk
ZIL - Zilliaq 2.0 Mainnet
Mezo - Mainnet
* * *
💞 Please Like + Retweet if you enjoy this May Crypto Calendar.
➬ Follow me @layerggofficial for more🫡
🔗Sharing is welcome, just a nod to the source would be appreciated.