Polymarket Reveals $1.2M in Extra Payouts for Traders Hurt by the Hour-Long Trading Halt

Polymarket has announced an additional $1.2 million (£895,000) in compensation for about 5,500 wallets affected by losses linked to its hour-long trading halt on Thursday, 29 October, after malicious code delivered through a compromised third-party script targeted users of its international platform.

The payments form part of a wider $3.9 million (£2.91 million) reimbursement programme. Polymarket said it was returning about $2.7 million (£2.02 million) to 726 wallets affected by the attack, alongside $1.2 million in goodwill refunds for positions taken during the incident and losses associated with the trading pause.

In an update published on 30 October, the company said 689 of the 726 affected wallets had been refunded in full, with payments to the remaining 37 being processed. In its post-mortem, Polymarket rounded this progress to 95% of affected wallets refunded in full, counting both drained-wallet reimbursements and goodwill payments. It said eligible wallets were identified using on-chain and trading data, so users did not need to submit claims.

How Hackers Exploited Polymarket Users' Sessions

Polymarket temporarily halted trading on Polymarket.com on Thursday after detecting unauthorised activity affecting user wallets. Its status page recorded a major outage lasting about an hour, and trading resumed at approximately 3pm Eastern Time.

The company said a third-party provider had been compromised and referred the incident to law enforcement. It later explained that the provider's performance-monitoring script, which loaded on Polymarket's website, had been replaced with malicious code designed to target its users.

According to Polymarket's post-mortem, the code exploited active sessions belonging to some people who had the site open during a short window. It used those sessions to sell positions and move funds out of users' wallets. Polymarket said it removed the compromised script, cleared its caches, paused trading and relayer activity, and reset active login sessions before reopening the platform.

Reuters identified the third-party provider as DebugBear, citing a source familiar with the matter. DebugBear's Real User Monitoring tool measures website performance by collecting data from visitors' browsers. The company separately warned customers using the product about a security incident and advised them to remove its embedded code from their websites.

DebugBear Reports DNS Compromise

The Hacker News reported on 1 November that DebugBear said attackers had compromised its DNS records through its domain registrar. The company's preliminary findings indicated that the incident targeted one customer's website, with no evidence at that stage that DebugBear's internal systems had been breached.

The findings remain preliminary. They do not establish that all DebugBear customers were affected or that the company itself knowingly contributed to the attack. Polymarket has described the incident as a compromise involving a third-party provider, while DebugBear's reported account points to the manipulation of DNS records used to direct traffic to the script.

How Much Cryptocurrency Did Attackers Take?

The amount traced to a suspected attacker-controlled wallet should not be confused with Polymarket's total reimbursement commitment. The Hacker News reported that blockchain records showed about 28.6 million POL tokens reaching the wallet in less than an hour. Those tokens were worth approximately $2.64 million (£1.97 million) at the time of the calculation.

That estimate covers the value of the POL tokens, not the value of positions also taken from affected accounts. It is therefore not a complete accounting of user losses, nor an independently audited figure for the total amount stolen.

Polymarket's $3.9 million (£2.91 million) programme covers more than funds moved during the attack. The company said it would also compensate traders whose positions were taken or force-sold, including slippage, and those who lost value because markets ended during the trading pause or because they sold shortly after trading resumed.

Polymarket Adds Security Measures

Polymarket said it was introducing additional controls for third-party scripts, including stronger content security policies, pinned script versions, sandboxing and continuous monitoring. It also said it was continuing its own investigation and co-operating with law enforcement.

The incident illustrates the risks of allowing external scripts to run on websites where users are signed in and can move funds. A compromised script can potentially exploit the privileges available within an active browser session, even when the platform has not reported a direct breach of its core infrastructure.

Polymarket's reimbursement programme addresses the immediate financial impact, but questions remain about how the malicious script was able to operate on the platform and how the compromise went undetected. The company says it has strengthened controls around third-party code; the ongoing investigation will help establish whether those measures are sufficient to prevent a similar incident.