Polymarket repaid $3.9 million after a vendor's script turned on its users. What broke?
A hijacked performance-monitoring script on polymarket.com used logged-in sessions to sell positions and pull funds. Polymarket's postmortem says 95% of affected wallets are now fully refunded, and it paid $1.2 million more for losses during its trading pause.
Key points
- On October 29, 2026, an attacker swapped out a third-party performance-monitoring script that loaded on polymarket.com and used active user sessions to sell positions and move funds out.
- Polymarket says it has returned $3.9 million: $2.7 million for drained wallets and $1.2 million for traders hurt by the trading pause. As of its October 30 postmortem, 95% of affected wallets were fully refunded.
- No smart contract was broken. Polymarket removed the script, reset every login session and says third-party code will now load with tighter controls such as version pinning and sandboxing.
What happened
Prediction market Polymarket says an outside vendor's code turned against its own users on Thursday, October 29, 2026. According to the incident page on Polymarket's status site, a third-party vendor ran a performance-monitoring script that loaded on polymarket.com. An attacker replaced that script with a version built to target Polymarket users.
The fake script did not need anyone's password or private key. It ran inside the browser of anyone who had the site open during a short window, and it used their already logged-in session to sell their positions and move funds out of their wallets. In security terms this is a supply chain attack: the weak point was not Polymarket's own code but a tool it trusted.
Polymarket's status page logged the incident as identified at 1:38 p.m. ET and marked it resolved at 2:06 p.m. ET. Security firm SlowMist's Hacked database lists the case as a $2.7 million supply chain attack on Polymarket International. LC Insight's roundup of late October hacks covered the first on-chain tracing of the drained accounts.
Timeline
Polymarket identifies unauthorized activity affecting user wallets and marks the web app and login systems as a major outage
Exchange goes into cancel-only mode and relayer actions are paused
Polymarket marks the wallet incident resolved and points users to a longer write-up on Discord
Cancel-only period and relayer pause end, per the status history
Postmortem posted: $3.9 million returned, 95% of affected wallets fully refunded
Who got paid back, and how much
Polymarket's postmortem, posted on October 30, puts the total returned at $3.9 million. That splits into $2.7 million for wallets that were drained and $1.2 million for losses caused by the trading pause itself.
The second number matters. To stop the drain, Polymarket froze trading and its relayer, the service that submits transactions on users' behalf. Traders who lost value during that pause, or who sold right after the market reopened, were paid the difference from the value at the moment of the pause. Positions the attacker sold were refunded at their value when taken, including slippage, the extra cost of a forced sale in a thin market.
As of the postmortem, 95% of affected wallets had been refunded in full, counting both drain refunds and goodwill payments. Polymarket says it found eligible wallets from on-chain and trading data, so users did not have to file a claim. Anyone who thinks the amount is wrong can ask for a recheck through a form linked on the incident page. Polymarket did not give a count of affected users.
What Polymarket returned after the October 29 attack
US$ million
Source: Polymarket status page, postmortem of October 30, 2026
How Polymarket shut it down
The response, as Polymarket describes it, came in four steps. It removed the vendor's compromised script and cleared all caches so the bad version could not keep loading. It paused trading and the relayer to stop further drains, then reopened once the site was clean. It reset all active login sessions, which cut off any session the attacker might still have been riding. And it referred the case to law enforcement while running its own investigation into the attacker.
The status history shows a separate notice for the exchange running in cancel-only mode from 2:05 to 3:05 p.m. ET, during which users could cancel orders but not place new ones.
Polymarket has not named the vendor. Its postmortem says the vendor has confirmed the compromise publicly.
Why one script could do this
Modern websites load code from many outside companies: analytics, error tracking, chat widgets, performance monitors. That code runs with the same powers as the site's own code. If a user is logged in, a script on the page can usually do what the user can do.
Polymarket says it will redeploy third-party scripts with added integrity controls, continuous monitoring and verification. The examples it gives are a stronger Content Security Policy (a browser rule that limits which code may run on a page), explicit version pinning (loading one checked version of a script instead of whatever the vendor serves today) and sandboxing (running outside code in a box that cannot touch the main page).
For users, the lesson is uncomfortable. Nobody in this case clicked a phishing link or signed a strange message. They only had the real site open at the wrong time.
LC Insight analysis
This section is our reading of the facts above, not a statement of fact.
- We think the $1.2 million paid for pause losses is the most telling number here. Stopping an attack has its own cost to users, and Polymarket chose to cover it rather than argue that a pause is part of normal risk.
- The likely result is that more crypto front ends will treat third-party scripts like smart contract dependencies: pinned, reviewed and isolated. SlowMist's database lists at least one other October case, Bloom Trading, as a supply chain attack.
- A 95% full-refund rate is high, but the remaining 5% and the lack of a user count leave the final size of the incident open.
What's next
- Whether the vendor publishes its own account of how its script was replaced
- Any law enforcement update on the referral
- How many wallets are still waiting on a full refund
Disclaimer. This article is based on public information and the sources listed below as of the update time shown. It is for information only and is not investment, legal or tax advice. Figures may change as companies and authorities publish new data.
