Polymarket Announces $3.9 Million Refunds Following Third-Party Security Breach

Polymarket has announced a $3.9 million compensation plan following an October 29 cyberattack that affected users of its international prediction market platform. In an October 30 update, the company allocated $2.7 million to attack-related losses and another $1.2 million to trading pause-related losses. Polymarket said 95% of affected wallets had received full refunds by October 30.

The incident originated from a compromised performance-monitoring script supplied by a third-party vendor. Attackers replaced the legitimate script with malicious code that exploited active user sessions to sell trading positions and transfer funds from wallets. Polymarket temporarily suspended trading and transaction processing to contain the attack. The company subsequently removed the compromised script, cleared website caches, reset active sessions, and restored trading.

Polymarket said its compensation program also covers traders who suffered losses during the temporary shutdown. Eligible users do not need to submit claims because the platform identified affected wallets through blockchain and trading records. Meanwhile, the company has referred the incident to law enforcement and is introducing stronger security controls for external scripts. These measures include additional monitoring, stricter browser security policies, and script integrity checks.