POLYMARKET ANNOUNCES $3.9 MILLION IN REIMBURSEMENTS AFTER THIRD-PARTY CYBERATTACK DRAINS USER WALLETS

NEW YORK, NEW YORK — Cryptocurrency-based prediction market Polymarket announced that it is returning approximately $3.9 million to affected traders following an October 29, 2026, cybersecurity attack that allowed an unauthorized actor to manipulate user trading sessions and transfer funds from cryptocurrency wallets. The breach originated through a compromised third-party website monitoring service, exposing users to malicious code delivered through the platform’s own website.

According to a post-incident report published by Polymarket on October 30, attackers compromised a performance-monitoring script supplied by DebugBear, a third-party service used to evaluate website performance. The legitimate script was replaced with malicious code designed to target individuals actively using Polymarket. Users who had the website open during a limited period were exposed to unauthorized trading activity, including the forced sale of positions and transfers of funds from their wallets.

The attack exploited an existing trust relationship between the platform and an external technology provider. Rather than requiring direct access to Polymarket’s primary infrastructure, the malicious script operated through a component that the website was already configured to load. Once executed within an active user session, the code could interact with trading functionality and initiate transactions without the account holder’s authorization.

Polymarket responded by removing the compromised script, clearing website caches, and temporarily suspending trading operations and transaction relaying to prevent additional unauthorized transfers. The company also invalidated active login sessions, requiring users to authenticate again before resuming access. Trading resumed after the platform completed its immediate containment measures and restored affected services.

The company confirmed that approximately $2.7 million of its reimbursement commitment covers losses associated with the attack, while an additional $1.2 million addresses financial losses connected to the trading interruption. The additional compensation includes losses resulting from positions that changed in value while trading was suspended and transactions completed shortly after services resumed. Polymarket also committed to compensating users whose positions were forcibly sold, including losses caused by unfavorable execution prices.

Polymarket stated that it identified eligible wallets through blockchain transaction records and internal trading information, allowing reimbursements to be issued without requiring affected users to submit individual claims. In its October 30 report, the company said that 95 percent of affected wallets had already received full reimbursement. Traders who believe their compensation was calculated incorrectly or who have not received an expected payment were directed to request a review through the company’s official incident reporting process. The total number of affected individuals has not been publicly disclosed.

Following the incident, Polymarket announced additional safeguards for external scripts loaded by its website, including stronger Content Security Policy restrictions, explicit version controls, additional isolation mechanisms, and continuous monitoring intended to identify unauthorized modifications. The company stated that these protections were being incorporated as third-party scripts were redeployed. It also confirmed that the matter had been referred to law enforcement while its internal investigation into the responsible threat actor continued.

DebugBear acknowledged the compromise and reported that its preliminary investigation pointed toward unauthorized access involving its domain registrar. The company stated that it was experiencing difficulties receiving email through its domain and that the available evidence suggested the attack was directed at a particular customer. DebugBear also reported that it had not identified evidence of a compromise affecting its internal systems, although the investigation remained ongoing.

The incident demonstrates the security risks associated with externally hosted scripts operating inside financial platforms. Even when an organization’s primary systems remain protected, compromised third-party resources can create opportunities for attackers to interfere with authenticated sessions, manipulate transactions, and access financial assets. For cryptocurrency-based services, where transactions may be difficult to reverse once completed, the integrity of external software components is particularly important.

Polymarket — Security Incident: Third-Party Vendor Compromised, official incident report and postmortem, October 29–30, 2026. Documents the malicious third-party script, unauthorized wallet transactions, response measures, law enforcement referral, and $3.9 million reimbursement commitment. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE