Polymarket Says $3.9M Refunds Cover Hack And Trading Pause

Polymarket said it is returning $3.9 million to traders after its 29th October breach, including $1.2 million for losses associated with the trading pause. Its postmortem, published at 20:07 UTC on 30th October 2026, sets out compensation beyond funds taken in the attack.

For positions moved or forcibly sold by the malicious code, Polymarket said it would restore their value when taken. For traders whose positions lost value because a market ended during the pause, or who sold immediately after reopening, it said it covered the difference from the position's value when trading stopped.

The company put the attack component at $2.7 million and said 95% of affected wallets had been refunded in full by that afternoon. It said eligible wallets were identified from blockchain records and trading data.

Polymarket also provided a review form for traders who believe their payment amount is wrong or that an eligible payment was missed.

The breach affected the international Polymarket.com platform. Its separate US platform was not compromised, according to CNBC's report. The report, updated on 30th October, also described a condition on larger repayments: a Polymarket Discord message said users who lost under $10,000 would have funds restored by that date, while those who lost more would need to sign a release form.

The postmortem specifies how covered losses are calculated but does not address the release condition.

BleepingComputer's examination of malicious JavaScript provides independent evidence of how the theft worked. The code checked whether visitors were logged in, inspected their balances and positions, and used the site's existing trading functionality to carry out unauthorised transactions.

Depending on how a user had authenticated, the script attempted either to sell prediction positions or transfer their tokens directly. BleepingComputer also found code designed to convert crypto holdings into transferable assets. The code also sent information about targeted accounts, balances and transactions to a server on DebugBear's infrastructure.

The publication identified the script on infrastructure belonging to website performance provider DebugBear and reported that DebugBear had publicly warned customers to remove its monitoring code. Polymarket said it removed the compromised script, reset active sessions and was adding controls over outside scripts as part of its response.