Polymarket Adds 48-Hour Delay for New Withdrawal Addresses

Polymarket now requires email verification and a 48-hour waiting period before any newly added withdrawal address can receive funds, part of a withdrawal allowlist the prediction market launched to block unauthorized transfers. Users who enable the setting restrict withdrawals to addresses they have explicitly approved, the company said.

The mechanics are simple and deliberately slow. Once the allowlist is active, funds move only to approved destinations. A newly added address stays ineligible until both the email verification and the 48-hour clock run out. If a user never requested the addition, they can cancel it by email during the window — turning a two-day delay into a tripwire against account takeover.

What threat does the allowlist address?

Polymarket built the control for a specific failure mode: a hijacked session or a maliciously signed transaction that would otherwise route funds to a fresh attacker-controlled address. Under the old flow, an attacker who gained access could add a new destination and withdraw immediately. Under the new flow, the victim has two full days to see the change and kill it.

That timing matters for operational reasons, not just security ones. Prediction-market accounts often hold active positions, and a forced 48-hour hold on new destinations could complicate rapid fund movement for sophisticated traders. Polymarket has not said whether the delay applies per-address or resets on other account changes; the company framed the feature strictly as an anti-theft measure.

What happens to older wallet accounts?

There's a migration catch. Accounts on an older wallet type must either use Polymarket's available migration tool to switch to the newer type, or create a new account entirely, before they can use the allowlist. That puts the burden of adoption on the user base, and it could slow uptake among long-standing account holders who would rather not re-key their positions.

Polymarket also plans to add passkey support, moving the platform toward hardware-backed authentication that resists phishing — a common pairing with withdrawal allowlists in crypto custody design.

How does the Oct. 29 breach fit in?

The feature lands weeks after a separate disclosure. On Oct. 29, Polymarket disclosed a breach at a provider serving its international platform. The company said the breach had been fixed and promised to reimburse affected traders. Its U.S. platform, which operates as a separate business, was not affected.

Polymarket did not name the provider, specify how many traders were hit, or put a figure on the reimbursement commitment. The allowlist rollout is the visible operational response: a structural control that reduces the blast radius of any future compromise at the account level, even if it wouldn't have stopped a provider-side breach on its own.

What should users do now?

For users, the practical sequence is short: migrate to the newer wallet type if needed, enable the allowlist, approve existing withdrawal destinations, and treat any unexpected address-addition email as an incident worth acting on within 48 hours.

For Polymarket, the rollout signals a shift from reactive reimbursement toward pre-emptive controls at a moment when the platform's security posture faces public scrutiny. Passkey support is the next announced step, and traders will be watching whether the company discloses further details — provider name, affected user count, payout totals — on the October breach.