Polymarket says it is returning $3.9 million to traders following an attack on its international platform. In an October 30 update, the company said 95% of affected wallets had received full reimbursement.
The update follows an October 29 security incident that temporarily stopped trading on Polymarket.com. Trading resumed that afternoon after a pause of approximately an hour, according to Associated Press reporting.
The Refund Total Includes Losses From the Trading Pause
Polymarket divided the reimbursement into $2.7 million connected to the attack and another $1.2 million for pause-related losses. The larger total therefore includes compensation beyond money removed from wallets.
The company said compensation covers positions taken or forcibly sold during the attack. It also covers certain losses where markets ended during the trading pause or customers sold shortly after trading resumed.
The 95% completion figure refers to affected wallets. It does not establish that 95% of the total reimbursement value had already been distributed.
Researchers Found Malicious Code in a Website Monitoring Script
Cybersecurity researchers at Hudson Rock examined a script delivered through infrastructure belonging to DebugBear, a service used to monitor website performance. Their analysis found code designed to locate an existing Polymarket trading session, inspect holdings and attempt unauthorized sales or transfers.
That finding points to a risk inside an already open trading page. The researchers said the code sought to reuse authority available through the signed-in application, rather than simply directing customers to a fake login screen.
Reuters separately reported that a source familiar with the incident identified DebugBear as the provider involved. DebugBear acknowledged a security incident and advised customers using its monitoring product to remove the embedded code from their websites.
Hudson Rock’s investigation did not identify the attacker or independently establish total losses. Its analysis also did not demonstrate a wider compromise affecting other DebugBear customers.
Eligible Wallets Are Being Identified Automatically
Polymarket said it used blockchain and trading records to identify eligible wallets, with no initial claim required. Customers who believe a payment is missing or incorrect can request a review through the form linked in its official incident update.
The platform said it removed the compromised script, reset active login sessions and referred the case to law enforcement. It is also adding controls to verify and monitor third-party scripts.
