Polymarket to Refund $3.9 Million After Third-Party Script Breach Compromised User Wallets
Key Takeaways
- •Polymarket committed to a total of $3.9 million in reimbursements after attackers exploited a compromised third-party script to move cryptocurrency out of customer wallets on October 29, 2026.
- •The compensation package includes $2.7 million for direct attack-related losses and an additional $1.2 million for losses tied to the temporary suspension of trading.
- •Reuters identified the compromised provider as DebugBear, a website performance monitoring company that acknowledged the incident and advised customers to remove its monitoring code.
- •The injected malicious code exploited users' active trading sessions to sell positions and transfer funds without authorization, a vector resembling the 2018 Magecard-style supply-chain attacks on British Airways and Ticketmaster.
- •Roughly 95% of affected wallets have already received full refunds, and Polymarket is strengthening script verification, monitoring, and third-party code restrictions while the incident remains under investigation by law enforcement, the company, and the vendor.
Polymarket has committed to reimbursing users a total of $3.9 million after a cybersecurity incident on October 29, 2026, in which attackers moved cryptocurrency out of customer wallets using a compromised third-party script. The prediction market platform confirmed that hackers exploited a performance-monitoring script supplied by an external vendor to execute unauthorized transactions from affected accounts.
In a security update published on October 30, Polymarket detailed a compensation package that includes $2.7 million for attack-related losses and an additional $1.2 million for trading disruptions. According to the company, 95% of affected wallets had already received full refunds.
Compromised Vendor Script Exploited Active Sessions
The breach originated with a performance-monitoring script provided by an outside technology provider. Attackers replaced the legitimate script with malicious code designed to exploit active trading sessions on Polymarket's international platform. Because users remained logged into their accounts, the injected code enabled unauthorized transactions: the attackers sold trading positions and transferred funds from connected cryptocurrency wallets without the account holders' authorization.
Reuters identified the affected provider as DebugBear, a website performance monitoring company. The vendor acknowledged a security incident and advised customers to remove its monitoring code while it investigated the compromise. The entry point fits a broader class of web supply-chain compromises: third-party scripts run inside trusted pages, and similar vectors were used in the 2018 Magecart card-skimming attacks that touched British Airways and Ticketmaster — though those campaigns harvested payment card data, while this one targeted logged-in trading sessions and connected crypto wallets.
Polymarket temporarily suspended trading and transaction processing after detecting suspicious activity. The platform then removed the malicious script, cleared website caches, and reset active login sessions before restoring normal operations.
Compensation Extends Beyond Stolen Funds
The reimbursement program covers more than the assets taken directly during the attack. Polymarket also pledged to compensate traders who suffered financial losses because of the temporary trading suspension.
The supplemental $1.2 million addresses qualifying losses tied to positions affected by the interruption, including positions that lost value when markets closed during the pause and certain transactions completed after trading resumed. Eligible users will receive compensation automatically, determined from blockchain records and trading activity, and customers who believe their reimbursement is incorrect can request an additional review. Because payouts are calculated from on-chain and trading records rather than a manual claims process, users disputing an amount must rely on that review path to correct it.
Security Overhaul Targets Third-Party Risk
The incident highlights vulnerabilities associated with external software integrated into cryptocurrency trading platforms. Even when core blockchain infrastructure remains operational, compromised website components can expose users to substantial financial losses. In practice, a platform's attack surface includes vendor-supplied front-end code alongside smart contracts and key management.
Polymarket said it is strengthening its security controls through stricter script verification, additional monitoring, and improved restrictions on third-party code. The company has referred the incident to law enforcement and continues to investigate the attackers.
The $3.9 million compensation commitment represents a significant financial response to the breach, which underscores the importance of protecting active trading sessions as prediction markets attract broader participation. The remaining items to watch are the refunds owed to the roughly 5% of affected wallets not yet made whole, adjustments from user-requested reviews, and the outcomes of the law-enforcement referral and the continuing investigations by Polymarket and DebugBear.
Source: CryptoMeter io
