Industry
Polymarket sets $3.9M refund plan after malicious script attack
Polymarket says it is returning $3.9 million to traders after an October 29 attack on its international website, including compensation for losses caused by the trading pause.
A monitoring script used to target traders
Attackers replaced a third-party performance-monitoring script loaded by Polymarket's international website with code designed to target its users. In a postmortem published on October 30, Polymarket said the malicious script used some active browser sessions to sell trading positions and move funds from wallets.
The platform temporarily switched to cancel-only mode and paused trading activity on October 29. It says it removed the compromised script, cleared caches and reset active login sessions before restoring trading. The case has been referred to law enforcement.
Compensation includes losses during the shutdown
Polymarket said it was returning $3.9 million in total: $2.7 million associated with the attack and another $1.2 million to cover losses linked to the trading pause. That total is a reimbursement commitment, not an estimate of how much cryptocurrency was stolen.
As of its October 30 update, the company said 95% of affected wallets had been refunded in full. It also said it would compensate traders whose positions were force-sold or lost value because trading stopped. Eligible wallets were identified from trading and blockchain records without requiring claims. Polymarket is introducing tighter controls for external scripts, including version pinning and additional monitoring.