Polymarket released a post‑mortem describing a security incident that occurred on October 29 when a third‑party performance‑monitoring script was compromised. The script accessed active user sessions, resulting in unauthorized position sales and fund transfers.
Refund plan
In an update posted on October 30, Polymarket announced a total refund amount of $3.9 million. The figure includes $2.7 million linked to the direct effects of the script compromise and an additional $1.2 million to compensate users for losses incurred during a temporary trading pause.
According to the company, 95 % of affected wallets had been fully refunded by the afternoon of the update.
Technical response
Polymarket removed the compromised script, cleared caches, reset user sessions, and halted trading and relayer activity while the issue was addressed.
Implications for platform security
The incident highlights the reliance of on‑chain applications on off‑chain web components that can access active sessions. While mechanisms such as subresource integrity can verify the integrity of loaded resources, they do not guarantee the safety of the code itself. Ongoing controls for reviewing updates, managing script permissions, and detecting anomalous activity are essential.
Impact of the trading pause
In markets tied to time‑sensitive outcomes, a trading pause can cause additional user losses even when wallets are not directly drained. Determining compensation for such losses requires a clear methodology for valuing positions at specific timestamps.
Next steps
Polymarket indicated that reconciliation of completed refunds and any remaining disputes will continue. Future assessments will focus on the verification of compensation outcomes and the effectiveness of revised security controls.
