Polymarket Plans $3.9M in Refunds Following Security Breach
Polymarket has announced a total of $3.9 million in refunds following an October 29 security breach caused by a compromised third-party monitoring script that impacted user wallets and forced a trading pause.
TL;DR: Polymarket clarified that its October 29 incident stemmed from a compromised monitoring script, with an October 30 update setting total refunds at $3.9 million, encompassing losses tied to the trading pause.
Polymarket has released further details regarding the third-party security breach that impacted its international platform on October 29. Rather than focusing solely on the resumption of trading, this update outlines the mechanics of the attack and the strategy for customer compensation.
Additionally, the incident highlights how an onchain application can remain vulnerable to offchain website components that possess access to active user sessions.
The refund figure includes more than drained funds
According to its October 30 postmortem, Polymarket is returning a total of $3.9 million. This sum comprises $2.7 million linked directly to the attack and $1.2 million designated for losses stemming from the trading pause. The platform stated that 95% of impacted wallets had received complete refunds as of that afternoon.
The breach occurred when a compromised performance-monitoring script leveraged active sessions to liquidate positions and transfer funds. In response, the company eliminated the script, flushed caches, reset sessions, and temporarily halted both trading and relayer operations.
Because the 95% metric reflects a specific timestamp from the company report, it should not be viewed as a real-time completion rate or as definitive proof that every customer’s disputed balance has been settled.
Website code can become part of the financial boundary
Third-party scripts execute simply because a website is configured to load them. Depending on their execution context and permissions, these scripts can gain access to portions of the web page and browser sessions that users believe are secure and tied directly to the trusted platform.
As outlined in Mozilla’s documentation on subresource integrity, browsers can employ a defense mechanism by checking a downloaded file against a predetermined cryptographic hash, rejecting any content that fails to match. This helps distinguish authorized files from modified ones delivered via the same URL.
While helpful, this safeguard is limited. It does not evaluate whether the original code was secure to begin with, meaning platforms must still maintain rigorous procedures for reviewing updates and managing which external resources are allowed to run.
A trading pause can create a second category of loss
For markets tied to time-critical events, freezing transactions can harm users even if their wallets are never directly breached. Positions may reach settlement during an outage, or market valuations can shift dramatically before trading is brought back online.
Addressing these types of losses demands a clear framework. Operators must establish specific timestamps, position sizes, and valuation techniques, and apply them uniformly. Without a consistent approach, headline refund figures can mask underlying disputes regarding which specific losses qualify for coverage.
This challenge is heightened when forced liquidations coincide with low market liquidity. The gap between a quoted price and an execution price often widens precisely when a platform experiences stress.
The durable test is the replacement control system
While deleting the malicious file neutralizes the immediate threat highlighted in the postmortem, the long-term security depends on how future code updates are vetted, the level of privileges granted to external scripts, and the speed at which anomalous behavior is identified.
A clear distinction exists here: preventing an unauthorized script from loading onto a sensitive page is fundamentally different from identifying malicious activity after execution has commenced. Both measures have value, but they serve distinct purposes.
Furthermore, users and counterparties will rely on transparent reconciliation between finalized payouts and unresolved grievances. Operational recovery does not always mean accounting work has finished.
Polymarket’s latest report supplies specific data regarding these distinct operational challenges. Future evaluations will need to monitor verified payout results and the strength of updated security controls, keeping in mind that blockchain finality alone cannot shield users from every vulnerability present in the broader application stack.
Frequently Asked Questions
What caused the October 29 incident on Polymarket?
The incident was caused by a compromised third-party performance-monitoring script that utilized active user sessions to sell positions and transfer funds.
How much is Polymarket paying out in total refunds?
Polymarket set total refunds at $3.9 million, which includes $2.7 million for attack-related losses and $1.2 million for losses tied to the trading pause.
What actions did Polymarket take in response to the breach?
The company removed the compromised script, cleared caches, reset active sessions, and temporarily halted trading and relayer activity.
Are all customer disputes fully resolved?
While Polymarket reported that 95% of affected wallets were fully refunded as of October 30 afternoon, this figure represents a specific timestamp and is not a guarantee that every disputed amount has been completely settled.