The decentralized prediction market Polymarket has introduced a new security layer designed to protect user assets from unauthorized transfers. Announced by Vice President of Engineering Josh Stevens, the platform now features a withdrawal address whitelist mechanism. This update aims to mitigate the risks associated with session hijacking and malicious transaction signing, ensuring that funds remain within the control of the legitimate account holder even if their account credentials are compromised.
New Defensive Mechanisms: Whitelisting and 48-Hour Locks
The core of the new security suite allows users to lock specific withdrawal addresses to their deposit wallets. To prevent immediate exploitation by bad actors, the platform has implemented a rigorous process for adding new destinations. According to the announcement, email verification is mandatory for each new address addition, followed by a 48-hour time lock before the address becomes active for transfers.
- Mandatory Email Verification: Confirms user intent through an external communication channel.
- 48-Hour Time Lock: Provides a window of opportunity to detect and stop unauthorized changes.
- Cancellation Protocol: Any non-self-initiated address additions can be immediately canceled via an automated email link.
Future Security Roadmap and Passkey Integration
Beyond the current manual whitelisting, Polymarket is expanding its technical infrastructure to simplify user protection. The engineering team confirmed that Passkey support will be integrated soon, offering a more robust alternative to traditional password-based authentication. Furthermore, a migration tool is in development for users utilizing non-deposit wallets, alongside advanced built-in security protections that will operate automatically without requiring manual configuration by the user.
Even if a session is compromised or a malicious transaction is accidentally signed, funds cannot be transferred to an uncontrolled address.
The implementation of these features reflects a growing trend among Web3 platforms to adopt traditional banking security standards to protect digital assets. As of November 10, 2024, users can access these new defensive options under the "Settings - Account" menu on the Polymarket interface. By introducing a delay in the withdrawal process for new addresses, the platform creates a critical buffer that enhances the overall resilience of the decentralized finance ecosystem.
Frequently Asked Questions
Quick answers to the most common questions about this topic.
For educational purposes only. Nothing here constitutes financial or investment advice. Crypto markets are highly volatile — always DYOR before making any decisions.
Fact-checked per our editorial policy. We maintain strict independence from advertisers. Spot an error? Let us know.