Polymarket Promises $3.9 Million in Refunds After Attack via External Script

A compromised script from an external vendor affected active sessions of some users of the Polymarket.com trading platform. According to the company, the attacker replaced the external vendor’s code, which was intended to monitor website performance, with a malicious script. For users with an open session, it was able to sell positions and move funds from wallets.

On October 29, 2026, the platform temporarily suspended trading and the relayer, removed the affected script, cleared the cache, and reset active login sessions. In an updated statement on October 30, it said trading had resumed and that it had referred the incident to law enforcement.

How the Compromised Script Affected Active Sessions

The issue involved JavaScript loaded on Polymarket.com from an external vendor. After it was replaced with malicious code, the attack exploited active sessions of users who were already logged in to the platform, enabling the sale of positions and the transfer of funds from wallets.

This type of scenario is considered a vendor, or supply-chain, incident. A web service may use external elements for analytics, performance measurement, or monitoring, for example. If an attacker gains the ability to change code distributed through such a vendor, malicious content may load directly in a visitor’s browser.

Polymarket said the malicious script sold positions and moved assets from wallets for some users. The platform did not provide the exact number of affected wallets. Secondary sources cite a range of 726 to 737 wallets, but these figures have not yet been consistently confirmed in the current official announcement.

Refunds Are Intended to Cover Forced Sales as Well

Polymarket announced refunds totaling $3.9 million. Of this amount, $2.7 million is intended to go directly to affected wallets. Another $1.2 million is intended to cover losses related to forced position sales and the trading interruption.

Independent on-chain analysis by Bitquery estimates the value of the stolen assets at approximately $2.73 million. However, this is not a final official forensic calculation of the damage. The difference from the total compensation amount reflects Polymarket’s stated intention to compensate users for the consequences of forced position closures and the service interruption as well.

The platform did not provide further details in the cited information about the refund process or the date by which it would be fully completed.

The Vendor Was Not Named in the Statement

In its official post-mortem, Polymarket did not disclose the external vendor’s name. However, the Associated Press and The Washington Post identified the affected provider as DebugBear. According to those reports, DebugBear publicly confirmed that it was dealing with an ongoing security incident.

The attacker’s identity, how DebugBear was compromised, and the incident’s full impact on other customers of the vendor have not yet been publicly confirmed. An independent calculation of the final value of the transferred assets and their subsequent movement on the blockchain has also not been completed.

Polymarket Plans to Reduce the Risk of External Scripts

After the incident, the platform said it was implementing stricter controls for external scripts. It mentioned a Content Security Policy (CSP), pinned versions of the components in use, and sandboxing. CSP can restrict the sources from which a page is allowed to load scripts, while pinning versions is intended to prevent the uncontrolled loading of modified code.

For Polymarket users, the key point at this stage is that the platform reset active sessions during its response and resumed trading. Further information is expected mainly on refunds, the number of affected wallets, and the technical circumstances of the vendor compromise.

Verified and updated: 11/01/2026 15:22