Polymarket adds optional withdrawal allowlist with 48-hour lock on new addresses
Traders can now limit withdrawals to approved addresses. Adding an address needs email verification and a 48-hour wait. It follows the 29 October breach that drained $2.7M from 726 wallets.
· Effective · Verified 2026-11-11 via official announcement
Effective Nov 9, 2026: Polymarket adds optional withdrawal allowlist with 48-hour lock on new addresses. Affects: polymarket.com users on the latest deposit wallet who turn the setting on. Source: x.com, verified Nov 11, 2026. Polymarket code dexsheet.
Polymarket added withdrawal address allowlisting on 9 November 2026, its vice president of engineering Josh Stevens said on X. Users who turn it on can withdraw from their deposit wallet only to addresses they have approved. Adding a new address requires email verification and a 48-hour time lock, and the request can be cancelled from the email.
The setting is off by default and sits under Settings, then Account. Stevens said it is available on the latest wallet version; users on older, non-deposit wallets must wait for a migration tool Polymarket is building, or open a new account to get the feature now. He said that with the allowlist on, someone who gets into a session, or a bad transaction a user signs, cannot drain funds or move positions to an address the user does not control.
The change follows the 29 October incident in which a compromised third-party script on polymarket.com used open sessions to sell positions and move funds. Polymarket put the loss at $2.7 million from 726 wallets and said it is returning $3.9 million in total, including $1.19 million for losses during the trading pause. Blockchain data firm Bitquery counted 985 withdrawals in about an hour, each carrying a valid approval.
Stevens said passkey support is coming soon, along with built-in protection that will not need to be switched on. Neither has a date. The post concerns deposit wallets on polymarket.com and does not mention the separate Polymarket US app, which pays withdrawals to a bank account or other funding source.
“Adding a new address requires email verification and a 48-hour time lock, and you can cancel it from the email if it wasn’t you.”
— Josh Stevens, Polymarket VP of engineering, on X
Who this affects
polymarket.com users on the latest deposit wallet who turn the setting on. Users on older wallets need to migrate first or open a new account.
Polymarket at a glance
Polymarket is a prediction market where users trade Yes/No outcome shares on an order book. It runs two separate platforms: the international, crypto-based polymarket.com on Polygon, and Polymarket US, a fiat, CFTC-regulated exchange operated by QCX LLC. The international site also lists perpetual futures.
More from the newsroom
Sources
Last checked . Fees and terms change often; the venue's own page wins if it disagrees with ours.
- Josh Stevens on X - New security feature: Withdrawal address allowlisting (2026-11-09) — checked 2026-11-11
- Polymarket Traders on X: refund update (30 Oct 2026) — checked 2026-10-31
- Cryptopolitan - Polymarket rolls out 48-hour withdrawal time lock after $2.7M vendor script breach (2026-11-10) — checked 2026-11-11
- Cryptonews.net - Polymarket Hack Drains 737 Wallets in One Hour as Investigation Reveals $2.73 Million Theft (Bitquery data) — checked 2026-11-11
About DexSheet
DexSheet is an independent fee sheet for on-chain trading. It tracks the fees, custody, backers, incidents and availability of 98 crypto trading venues, with a dated source for every number. Every newsroom entry is checked against the venue's own announcement, docs or terms before it is published. Data: fees.json (CC BY 4.0) · RSS.