Polymarket’s postmortem says a third-party performance-monitoring script on polymarket.com was replaced on 29 October by code that used open sessions to sell positions and move funds out of users’ wallets, and the company says it is returning $3.9M to traders.
According to Polymarket’s status page, a vendor whose script loaded on the site was compromised, and the attacker swapped it for a script built to target Polymarket users. For some people who had the site open during a short window that afternoon, it used their active session to sell positions and move funds out of their wallets. Polymarket says the vendor has confirmed the compromise publicly. The page records a major outage on the web app and on account access and authentication from 5:38 PM to 6:06 PM UTC.
The company lists what it did: removed the vendor’s script and cleared every cache, paused trading and the relayer to stop further drains, reopened once the site was clean, and reset all active login sessions. It is redeploying third-party scripts with additional integrity controls and continuous monitoring and verification, and names stronger CSP, explicit version pinning and sandboxing as examples. It has referred the case to law enforcement.
On refunds, Polymarket says 95% of affected wallets have been repaid in full. The $3.9M total is the $2.7M drained plus $1.2M in goodwill payments for losses during the trading pause. Eligible wallets were identified from on-chain and trading data, so users file no claims.
A script running inside an authenticated page can do whatever the session can do, which is how this attack moved money out of wallets. In our reading, the controls Polymarket lists apply to any site that loads vendor code into a logged-in view, and they fit the same supply-chain pattern as the tampered extension Microsoft traced in Cursor’s marketplace and the BTCPay Server wallet thefts. List every third-party script on pages that handle money or sessions, pin versions, and alert on any change to what those scripts serve.
