Is Polymarket safe? Answer it per rail or the answer is wrong. The international site never holds your money the way a company with a bank account holds customer deposits — it is built on a wallet you control. Polymarket US is the opposite design: a regulated exchange that does custody your cash, under rules built for that exact job. Both can be safe in their own terms. Neither is insured.

The International Site: You Are the Custodian

polymarket.com runs on a proxy wallet layered over your own crypto wallet on Polygon. That is a meaningfully different security model from a sportsbook cashier or a bank: Polymarket cannot freeze or spend a balance it never took custody of in the first place, but you also don’t get a company standing behind you if something goes wrong on your end. The real risks on this rail are smart-contract bugs in the underlying protocol, phishing attacks that trick a user into signing a malicious transaction, and ordinary crypto-custody mistakes — not a company absconding with deposits.

Non-custodial cuts both ways. Nobody can freeze or seize your funds on the international platform, and nobody reverses a transaction you signed by mistake either. That trade is the whole point of self-custody, for better and worse.

Polymarket US: Custodied, Segregated, Still Not Insured

Polymarket US runs through QCX LLC, the CFTC-designated contract market Polymarket bought in 2025 to relaunch a KYC’d, dollar rail. As a designated exchange, it has to keep customer cash in accounts segregated from its own operating capital — the same structural requirement that governs a futures broker, not a courtesy Polymarket extended on its own. That protects you if the company itself ran into financial trouble. It does not insure a position: there is no FDIC or SIPC program sitting under a Polymarket US trading balance, the same gap that exists on every prediction-market or futures-style account in the country.

polymarket.com: non-custodial proxy wallet on Polygon · risk = smart contracts & wallet security

Polymarket US: KYC’d, CFTC-segregated custody via QCX LLC · risk = market risk, no deposit insurance

Shared across both: no FDIC or SIPC coverage on a resolved-contract balance

Has Polymarket Been Hacked?

No incident has surfaced that drained user funds from either rail as of late September 2026. The security stories that have circulated around the international site are front-end and phishing attempts aimed at individual wallets, not breaches of Polymarket’s own reserves — the predictable shape of risk on a platform where the platform itself never holds the money to begin with.

The Compliance Layer, Which Is a Different Risk

None of the above touches legality. polymarket.com has stayed geo-blocked for US IPs since the 2022 CFTC settlement, so a US user on that site is carrying a compliance risk that has nothing to do with wallet security. Polymarket US is the compliant answer for US customers, though its sports event contracts sit inside the same 2026 state-versus-CFTC fight complicating Kalshi in several states. “Safe” and “allowed here” are separate questions on this brand more than on almost any other.

The Verdict

Polymarket’s custody model is sound on both rails, just built two completely different ways — self-custody on the international site, regulated segregation on Polymarket US. What neither rail offers is insurance: no FDIC, no SIPC, and no refund for a contract that resolves against you. That isn’t a safety defect. It’s what a prediction-market contract is.