Polymarket repays $3.9 million after a hacked vendor script hits it for the second time
On October 29, a compromised outside script on polymarket.com used logged-in sessions to sell positions and drain 726 wallets. Polymarket paused trading, repaid 689 of them in full within a day, and is covering pause losses too. It was the second vendor script attack in four months.
Key points
- On October 29, 2026, a hacked third-party monitoring script on polymarket.com used live sessions to sell positions and drain 726 wallets.
- Polymarket is returning $3.9 million: $2.7 million to drained wallets and $1.19 million to about 5,500 wallets hurt by the theft or the trading pause.
- It was the second vendor script attack in four months. In June, Bubblemaps counted about $3 million lost across fewer than 15 accounts.
What happened on October 29
Polymarket, the crypto prediction market, is returning $3.9 million to users after an attacker drained 726 wallets on October 29, 2026. The company flagged unauthorized activity affecting user wallets at 1:38 p.m. ET that day, according to its status page. The web app and login systems were listed as having a major outage until 2:06 p.m. ET. Around 3:00 p.m. ET, Polymarket posted on X that trading was fully back online and that all affected traders would be reimbursed.
The smart contracts were not the problem. An outside script was. In a postmortem added to the status page on October 30, the company said a vendor whose performance-monitoring script loaded on polymarket.com had been compromised. The attacker swapped in a script built to target Polymarket users. For some people who had the site open during a short window that afternoon, it used their active session to sell positions and move funds out of their wallets. Polymarket said the vendor has confirmed the compromise publicly, but it did not name it.
This kind of attack is called a supply chain compromise. Websites load small pieces of code from outside companies, for analytics or performance tracking. If one of those vendors is breached, the attacker's code runs inside the site with the logged-in user's permissions.
How Polymarket responded
The postmortem lists the steps. Polymarket removed the compromised script and cleared every cache. It paused trading and the relayer, the service that submits transactions on users' behalf, to stop further drains, then reopened once the site was clean. It reset all active login sessions.
It is now redeploying outside scripts with extra integrity controls. Examples it gave include a stronger content security policy, pinning exact script versions and sandboxing. Polymarket said it has referred the case to law enforcement and is running its own investigation into the attacker.
The pause itself caused losses for some traders, and Polymarket chose to cover those as well as the stolen funds.
The refund numbers
On October 30 at 10:37 a.m. ET, Polymarket said on X that 689 of 726 affected wallets had been refunded in full, with the remaining 37 being paid as each is verified. It added $1.19 million for about 5,500 wallets whose positions were taken or who lost money during the pause. In total it is returning $3.9 million, the $2.7 million for drained wallets plus the pause-related money.
The postmortem explains the goodwill payments. If the script force-sold a position, Polymarket pays what it was worth when taken, including slippage. If a market ended during the pause, or a trader sold right after reopening, Polymarket covered the drop from the value at the pause. No claims are needed: eligible wallets were found from on-chain and trading data. Users who think their amount is wrong can ask for a recheck.
Polymarket refunds after the October 29 incident
US$ million
Source: Polymarket on X (October 30, 2026) and Polymarket postmortem
The same kind of attack in June
Polymarket dealt with a similar problem in June. On June 25, 2026, it said on X that a third-party vendor had been compromised, injecting a malicious script into its front end for some users. It said the problem was contained, the affected dependency removed and impacted users would be refunded in full.
On-chain analytics firm Bubblemaps counted fewer than 15 affected accounts and about $3 million in losses at the time. Polymarket has not publicly named the vendor in either case.
What Polymarket has not said
Several details are missing from what Polymarket has published. It has not named the vendor behind the monitoring script or said when the script was first changed. It has not said whether the separate US platform, Polymarket US, was touched. Its X post promised a postmortem, and the one on the status page is short; a fuller technical report has not appeared.
The incident capped a difficult week. On October 28, Polymarket US agreed to stop offering new sports event contracts to Michigan residents and to close all open positions there by the end of November 25, the Michigan Gaming Control Board said. The deal, approved by a federal court, ends state enforcement action as long as the company complies. Polymarket's appeal in that case is still pending.
For a business that runs on trust in settlement, two front-end incidents in one year carry a reputational cost even when users are made whole.
Timeline
Polymarket discloses first third-party vendor compromise
Unauthorized wallet activity identified; major outage logged
Incident marked resolved on status page
Polymarket says trading is fully back online
689 of 726 wallets repaid; $3.9 million total announced
Postmortem posted on status page
LC Insight analysis
This section is our reading of the facts above, not a statement of fact.
- We think the pattern matters more than the dollar amount. Two vendor script attacks in four months suggest Polymarket's website still trusts too much outside code, and that is a design choice it can fix.
- Paying back pause losses as well as stolen funds is a strong signal. Most users will probably stay, but they will now expect a public list of which third-party scripts still run on the site.
- The lesson for users is simple. A hacked website can act with your logged-in session. Logging out when you are not trading limits what an attacker can do.
What's next
- Whether Polymarket names the vendor or publishes a fuller technical report
- Confirmation that the remaining 37 drained wallets are repaid
- Changes to how Polymarket loads third-party code
Disclaimer. This article is based on public information and the sources listed below as of the update time shown. It is for information only and is not investment, legal or tax advice. Figures may change as companies and authorities publish new data.
Sources
- Polymarket status page, Security incident and postmortem (October 29 to 30, 2026)
- Polymarket Traders on X, refund update (October 30, 2026)
- Polymarket Traders on X, trading back online (October 29, 2026)
- Polymarket Traders on X, June vendor compromise (June 25, 2026)
- Bubblemaps on X, June incident count (June 25, 2026)
- Michigan Gaming Control Board, Polymarket backs down in Michigan (October 28, 2026)
