Polymarket introduced an optional withdrawal address allowlist on November 10, 2026, giving users a way to restrict cryptocurrency withdrawals to pre-approved wallets and imposing a 48-hour waiting period on subsequent security changes. The protection is not yet available to customers using the platform’s older wallet infrastructure.
The feature allows eligible users to prevent withdrawals to unfamiliar addresses, even if an attacker gains access to an authenticated session or tricks them into authorizing a malicious request. Adding a new destination, removing an existing one or disabling the protection requires email verification and a two-day delay.
But older accounts, some of them the most established, do not get that option yet. Polymarket’s documentation confirms that customers using legacy Safe Wallets or Proxy Wallets cannot enable the setting until a planned migration tool becomes available. Their immediate alternative is to open a new account.
The rollout comes less than two weeks after an October 29 security breach in which compromised third-party code was used to sell customer positions and transfer funds. Polymarket subsequently disclosed approximately $2.7 million in direct losses and a broader $3.9 million compensation commitment.
Legacy Polymarket wallets cannot enable the new protection
Eligibility depends on the type of wallet associated with an account rather than simply whether the customer uses email or external-wallet authentication.
Polymarket says the allowlist is available to accounts using its newer Deposit Wallet architecture, which became the default for accounts created from May 4, 2026. Both email-based and external-wallet logins qualify when the account uses this architecture.
Older Safe Wallets, generally associated with external signing wallets, and Proxy Wallets, previously used with social or email authentication, remain excluded.
Josh Stevens, Polymarket’s vice president of engineering, confirmed the feature’s introduction and said the company was developing a migration tool for customers who had not yet adopted Deposit Wallets. He also indicated that passkey support and additional built-in security protections were being developed.
No firm release date was provided for the wallet migration tool. Polymarket has not disclosed how many customers remain on the older architectures or what proportion of accounts can currently activate the new protection.
For existing traders, creating a replacement account is not necessarily equivalent to upgrading an established one. Trading positions and balances are associated with an account’s wallet infrastructure, and the announcement did not describe an immediate, automated route for transferring everything into a newly created account.
For now, the gap is still there between old wallets and new ones.
How Polymarket’s 48-hour withdrawal rule works
Eligible users can activate the allowlist through Settings, under Account, by registering withdrawal destinations and verifying their email address.
Addresses entered during the initial setup become usable as soon as activation is completed. The 48-hour waiting period applies to addresses added afterward and to subsequent changes to the security configuration.
The waiting period covers adding or removing addresses, switching off the allowlist, changing the primary email and modifying backup email settings. A verified backup email can be promoted to the primary contact immediately.
That is where the 48 hours gets a little less straightforward. An address scheduled for removal remains authorized during the waiting period, meaning withdrawals can continue to that destination until the change takes effect.
Similarly, a request to disable the allowlist does not immediately restore unrestricted withdrawals. Existing restrictions remain effective until the two-day period expires.
Polymarket sends email notifications when changes are requested or canceled. Users can cancel a pending change immediately through their account settings or a one-time email link that does not require signing in.
Someone receiving an unauthorized change notification can therefore cancel the request before the waiting period expires. The system does not prevent a compromised email account from initiating changes, although those changes remain subject to the delay.
There is a catch here, and it is quite a practical one. Enabling the allowlist also restricts withdrawal networks.
Protected accounts can withdraw only USDC or USDC.e on Polygon, using previously approved addresses. Withdrawals to other supported networks become unavailable while the setting is active.
Users also cannot designate their login wallet or Polymarket Deposit Wallet as an approved withdrawal destination. Up to 100 unique addresses can be registered, including external wallets or exchange deposit addresses that support the appropriate assets on Polygon.
Customers relying on exchanges must check network compatibility before activating the restriction. An approved destination that cannot recieve the selected token on Polygon would not provide a usable withdrawal route.
The restrictions also extend to perpetuals withdrawals and transfers described as tips to other users. Deposits and normal trading activities remain availble, according to the documentation.
Security upgrade follows Polymarket’s $2.7 million breach
The November 10 rollout follows Polymarket’s October 29 third-party security breach, which exposed how compromised website code could interact with authenticated customer accounts.
In its October 30 incident report, Polymarket explained that an attacker had replaced a performance-monitoring provider’s script with malicious code targeting users who had the website open during a limited period.
The script used active sessions to sell positions and move funds out of affected wallets. Polymarket temporarily suspended trading and its relayer service, removed the compromised script, cleared caches and reset active login sessions.
It was not a small episode, not for the traders caught in it.
The company reported approximately $2.7 million in direct attack-related losses and committed another $1.2 million to compensate traders affected by forced position sales, slippage and the trading interruption.
In its October 30 update, Polymarket said 95% of affected wallets had been reimbursed in full. That statement did not establish that every outstanding reimbursement had subsequently been completed.
The new allowlist addresses a specific element of the attack mechanism: the ability to move assets to destinations outside a user’s control through a compromised session.
It does not eliminate the underlying risk of malicious third-party scripts or compromised signing credentials. Polymarket explicitly warns that possession of a wallet’s private key or recovery phrase falls outside the allowlist’s stated protection.
The measure is also seperate from controls governing trading execution or platform availability. A previously reported Polymarket trading infrastructure outage affected market data, trading APIs and Polygon settlement infrastructure. Withdrawal allowlisting would not prevent that type of disruption.
Withdrawal restrictions create operational trade-offs
For active traders, the new system changes how quickly assets can be redirected when a destination becomes unavailable or needs replacing.
A customer who regularly transfers funds to different exchanges or external wallets must either register destinations in advance or wait 48 hours after adding a new one. Disabling the feature to restore flexibility requires the same waiting period.
The limitation is particularly relevant when an approved destination must be replaced urgently. The existing address remains usable during removal, while a newly added replacement cannot receive withdrawals until its activation period expires.
Loss of email access introduces another complication. Polymarket permits users with verified backup emails to recover access to security codes, but changes handled through customer support still carry the 48-hour delay.
The protection applies to Polymarket’s international blockchain-based platform. Its U.S. operation uses seperate trading and payment infrastructure and should not be assumed to have adopted the same withdrawal controls.
The Commodity Futures Trading Commission’s official registration record identifies QCX LLC, operating as Polymarket US, as a designated contract market.
DaveFinances previously examined reports of prolonged withdrawals and account holds at Polymarket US. Those complaints concerned payment processing and account reviews, rather than the new Polygon withdrawal allowlist.
The immediate question for the international platform is how quickly Polymarket can extend the protection to existing Safe and Proxy Wallet customers without requiring them to abandon their current account arrangements.
Stevens has indicated that migration tools and further security features are planned, but the company has not published a rollout timetable or adoption figures. Until migration becomes possible, customers using legacy wallet architectures remain outside the newly introduced withdrawal protection, while eligible users must accept tighter restrictions on withdrawal destinations and networks.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.