Polymarket rolls out withdrawal whitelist to block phishing and session-hijack losses

Polymarket has officially launched a withdrawal address whitelist feature to help prevent asset losses tied to account hacks and phishing signatures. Josh Stevens, Polymarket’s vice president of engineering, said on Nov. 10 users can now set their accounts so funds can be withdrawn only to pre-approved addresses. Adding a new address requires passing a secondary email verification step, followed by a mandatory 48-hour withdrawal lockup period. If account compromise is suspected, users can immediately invalidate additional requests through the email sent to them.