Quick Answer
Polymarket says it will return $3.9 million after malicious code in a compromised third-party monitoring script used some active user sessions to sell positions and move funds. The company says it removed the script, reset every active login session, and refunded 95% of affected wallets. Review wallet activity and confirm any refund through Polymarket’s official account channels.
Key Takeaways
- Polymarket identified unauthorized wallet activity at 5:38 p.m. UTC on October 29, 2026.
- A compromised third-party performance-monitoring script was replaced with malicious code on Polymarket.com.
- Polymarket says the code used active sessions during a short exposure window to sell positions and move funds.
- The company says it will return $3.9 million, including $2.7 million tied to drained wallets.
- SecurityWeek reported that 726 wallets were affected, while 37 remained under review on October 30.
What happened in the Polymarket security breach?
The Polymarket security breach involved malicious code loaded through a compromised third-party performance-monitoring script on Polymarket.com. Polymarket identified unauthorized wallet activity at 5:38 p.m. UTC on October 29, 2026, and marked the incident resolved at 6:06 p.m. UTC. The web app and account access were affected during the incident, which meant users with active sessions could face a direct risk to trading positions and wallet funds.
Polymarket says the compromised script was replaced with code designed to target Polymarket users. The company paused trading and its relayer, which is the service that helps process certain transactions, while it removed the script and cleared caches. Polymarket’s incident report and postmortem says the company also reset every active login session before restoring normal operations.
The most important point is that the incident did not require an attacker to obtain every affected user’s wallet credentials directly. The malicious code could act through some users’ already active website sessions. Users who had Polymarket open during the exposure window should review completed trades, wallet transfers, and linked-account activity rather than assuming a normal-looking login means no action occurred.
How did the malicious script drain Polymarket wallets?
The malicious Polymarket script used active sessions of some users who had the website open during a short window to sell positions and move funds out of their wallets. Polymarket described the event as a third-party script compromise, not as a failure of a user’s individual device. That distinction matters because browser sessions can carry authorization that a website recognizes after a user signs in.
A third-party script is code supplied by an outside service and loaded into a website. Performance-monitoring tools can help a company measure loading speed and errors, but a compromise in that supply chain can place malicious code in front of legitimate users. The same basic exposure exists in other web incidents, including cases where cached AI prompts were exposed through a service problem rather than a user mistake.
Polymarket says it is adding stronger content-security-policy controls, version pinning, sandboxing, and continuous monitoring. Content security policies limit which code and connections a webpage can use. Version pinning helps prevent an outside script from silently changing to an unapproved version. Those controls can reduce similar risk, but users should still treat an active crypto trading session as sensitive and close it when they finish using the platform.
Which Polymarket users were affected by the attack?
Polymarket says the attack affected some users who had active sessions open while the malicious script was loaded. The company did not state that every Polymarket account or wallet was exposed. The exposure was limited by the short incident window, but the consequences for an affected wallet could include sold positions and transferred funds.
SecurityWeek reported on November 2, 2026, that 726 wallets were affected and that 37 wallets remained under review at the time of Polymarket’s October 30 update. SecurityWeek’s report also said DebugBear attributed the underlying compromise to DNS records accessed through its domain registrar, with preliminary findings indicating a single customer was targeted.
Users should not interpret the reported wallet count as a reason to ignore an unexpected transaction. A wallet can be unaffected by the main incident but still face separate risks from phishing pages, malicious browser extensions, or copied support accounts. The practical response is to inspect the transaction history for any unfamiliar sales or outbound transfers, then use only Polymarket’s official support and account channels for questions about eligibility.
| Incident detail | What Polymarket or reporting says | Why it matters for users |
|---|---|---|
| Initial detection | Unauthorized wallet activity was identified at 5:38 p.m. UTC on October 29, 2026. | Users active around the incident window have the clearest reason to inspect account activity. |
| Attack path | A compromised third-party monitoring script loaded malicious code on Polymarket.com. | The risk came through an active website session, not necessarily a compromised personal wallet key. |
| Affected wallets | SecurityWeek reported 726 affected wallets and 37 under review. | Refund eligibility depends on Polymarket’s identification and review process. |
| Immediate response | Polymarket removed the script, cleared caches, paused trading, and reset sessions. | Existing sessions were invalidated to limit continued unauthorized activity. |
What did Polymarket do after finding the compromised script?
Polymarket removed the compromised script, cleared caches, paused trading and its relayer, and reset every active login session after finding the unauthorized activity. Those actions were designed to stop the malicious code from loading and to invalidate the active sessions that the company says were used in the attack. Polymarket later resumed international-platform trading after roughly an hour.
Polymarket also says it is implementing stronger content-security-policy controls, version pinning, sandboxing, and continuous monitoring. The company’s stated response addresses the third-party code path identified in its postmortem. At the same time, no website security control removes the need for users to check trading activity after an incident involving session-based authorization.
Associated Press reported that Polymarket referred the matter to a UK law-enforcement agency. The Associated Press report also confirmed the roughly one-hour trading interruption. The law-enforcement referral signals that the company is treating the event as unauthorized activity, but users should rely on the platform’s confirmed notices rather than messages claiming to offer immediate recovery.
How much money will Polymarket return to users?
Polymarket says it will return $3.9 million in total to users affected by the incident. The company says $2.7 million is tied to drained wallets, while $1.2 million covers trading-pause-related losses. The split matters because users whose positions were affected during the pause may have a different basis for reimbursement than users whose wallets lost funds.
Polymarket says 95% of affected wallets had been refunded in full as of its October 30 postmortem. The company also says identified eligible wallets do not need to submit a claim or open a support ticket. That process can reduce friction for known victims, but users whose activity appears abnormal should preserve transaction details and contact Polymarket through its official site if they are not included in the automated refund process.
Refund announcements often attract scams because attackers can imitate a platform’s branding and claim that a user must connect a wallet, approve a transaction, or disclose a recovery phrase. A legitimate reimbursement should not require a user to reveal a seed phrase. Crypto users should be particularly cautious after major incidents, including reports about the Binance hot-wallet breach, because public attention can make impersonation attempts more convincing.
What does the DebugBear DNS finding mean for Polymarket?
The DebugBear DNS finding suggests that the compromise began in the infrastructure used to direct requests for a third-party service, rather than in Polymarket’s own application code alone. SecurityWeek reported that DebugBear said its DNS records were compromised through its domain registrar and that preliminary findings indicated a single customer was targeted. DNS records help direct browsers to online services, so control of those records can create a path to deliver altered resources.
The DebugBear finding does not mean every service using a monitoring vendor was compromised. The preliminary finding described one targeted customer, and Polymarket identified the affected script on its own site. The limitation is important because early incident details can change as companies complete forensic review and determine exactly how access was obtained.
For users, the technical origin does not change the immediate safety steps. The useful conclusion is that trusted websites can face third-party supply-chain risk, even when a user has not installed suspicious software. Keep browsers updated, remove unnecessary extensions, and treat unexpected wallet approval prompts as a reason to stop rather than as routine account maintenance.
What should Polymarket users do now?
Polymarket users should review wallet transfers, completed position sales, and account notifications for activity they did not authorize. Start with the period around October 29, 2026, then compare the wallet’s transaction history with any positions you expected to hold. This review is more useful than repeatedly changing settings because Polymarket says it already reset every active login session after the incident.
- Check Polymarket position history and connected wallet activity for unfamiliar sales or outbound transfers.
- Save transaction hashes, timestamps, screenshots, and account notices if any activity appears unauthorized.
- Sign in again through the official Polymarket website, not through a link in an email, direct message, or social post.
- Confirm whether a refund appeared in the wallet before responding to anyone who claims to provide reimbursement help.
- Contact Polymarket through its official support path if suspicious activity appears and no refund is shown.
Users should avoid signing wallet transactions solely to “verify” refund eligibility. Attackers often use urgency after a public breach to pressure users into approving a transfer. Browser extensions deserve added scrutiny because compromised or hijacked extensions can alter searches and web activity, as shown by reporting on hijacked Chrome extensions.
Stop and contact Polymarket support or a qualified digital-asset security professional if a wallet shows continuing unexplained transfers, unfamiliar authorization requests, or signs that its recovery phrase may have been exposed. Do not share a seed phrase, private key, or wallet backup with support staff, recovery services, or anyone offering help through social media.
FAQ
Was Polymarket hacked?
Polymarket says a compromised third-party performance-monitoring script loaded malicious code on Polymarket.com. The code used some active user sessions to sell positions and move funds from affected wallets during a short window.
How many wallets did the Polymarket security breach affect?
SecurityWeek reported that 726 wallets were affected by the Polymarket incident. The report said 37 wallets remained under review at the time of Polymarket’s October 30 update.
Will Polymarket users need to file a refund claim?
Polymarket says identified eligible wallets do not need to file claims or support tickets for refunds. Users who see unauthorized activity but no refund should contact Polymarket through its official support channels.
How much is Polymarket returning after the script attack?
Polymarket says it will return $3.9 million in total. The company says $2.7 million relates to drained wallets and $1.2 million relates to losses from the trading pause.
Should Polymarket users move funds after the breach?
Polymarket users should first review account and wallet activity for unauthorized sales or transfers. Users should stop and seek qualified help if they suspect a seed phrase or private key was exposed, because moving funds without understanding the compromise can create further risk.