Polymarket refunds traders after vendor script breach

A performance-monitoring script that loaded on polymarket.com was swapped for malicious code on 29 October and used traders' open sessions to sell positions and move funds out of their wallets. Polymarket says it is returning $3.9 million to traders, and that it has referred the case to law enforcement. The incident hit Polymarket's international crypto exchange; CNBC reports that the company's US platform was not compromised.

What Polymarket has confirmed

Polymarket's VP of Engineering, Josh Stevens, described the attack in a post on X that the main @Polymarket account reposted on 30 October: "Yesterday, a 3rd-party performance script on polymarket.com was compromised by its vendor's attacker & swapped for one built to target our users. For a small window of time, it used open sessions to sell positions and move funds. The vendor has publicly confirmed the breach."

Polymarket's status page shows the exchange in cancel-only mode, with relayer actions paused, from 14:05 to 15:05 ET on 29 October (19:05 to 20:05 CET). Polymarket says it removed the compromised script "within the hour", cleared its caches and reset all active login sessions.

In its postmortem, published on the evening of 30 October, Polymarket says: "In total, we're returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses." The extra money covers positions that the script force-sold and positions that lost value while trading was paused. Earlier that day, the @PolymarketTrade account said 689 of 726 affected wallets had been refunded in full and the remaining 37 were being paid as each was verified. The postmortem put the share at 95% of affected wallets. Polymarket says no claims or tickets are needed, and points traders who think an amount is wrong to a form linked in the postmortem.

What others report

As of 30 October, in its posts and its postmortem, Polymarket does not name the vendor. BleepingComputer and the security firm Hudson Rock say the script came from DebugBear, a website performance-monitoring company, citing a Polymarket code change titled "remove debugbear rum script". CNBC reports the same link from a person familiar with the matter. DebugBear itself posted on 29 October that it was "impacted by an ongoing security incident" and asked customers of its Real User Monitoring (RUM) product to remove its embed code. In a further post early on 31 October (CET), DebugBear said its DNS records had been compromised through its domain registrar and that, "based on our initial investigation", the attack "targeted the website of a specific customer".

Bubblemaps and BleepingComputer published estimates on 29 October, before Polymarket's own figures. Bubblemaps counted "700+ users drained", analytics firms cited by CNBC counted 710 wallets, and BleepingComputer traced about 28.6 million POL tokens, worth roughly $2.57 million, to attacker-linked wallets. Polymarket's own numbers are $2.7 million and 726 wallets.

CNBC also reports that Polymarket told users on Discord that people who lost less than $10,000 would have funds restored by 30 October, and that larger losses would require a signed release form. Polymarket's 30 October post and postmortem say no claims or tickets are needed and do not mention a release form.

This is not the first incident of its kind. In June 2026 Polymarket said a third-party vendor had been compromised and had injected a malicious script into its front end for some users. CoinDesk, citing blockchain analytics firm AMLBot, put the losses then at about $3.1 million from 11 wallets.

Our reading

The point that matters for anyone who keeps crypto on a gambling or betting site is where the attack ran. According to Polymarket, the malicious code ran on its own site and used sessions that were already logged in. It was not a fake copy of the site, and Polymarket does not describe it as a flaw in its smart contracts. That kind of supply-chain attack is hard for a user to spot. Logging out of sessions you are not using and not leaving more balance on a platform than you need lower the exposure. If you were affected, rely on Polymarket's own channels for refund information: incidents like this tend to attract fake "refund" messages.

We covered a different crypto incident at Gamdom's hot-wallet breach, and Polymarket's US exchange in stolen-card fraud and same-source withdrawals. On regulation, see Michigan and Polymarket's sports contracts and Norway's DNS block notices.

Availability: Polymarket's international exchange is blocked or restricted in a number of countries; whether it is available depends on where you live.