Polymarket Refunds $3.9 Million to Users Following Vendor Script Exploit and Trading Halt

Decentralized prediction market platform Polymarket has moved swiftly to make its user base whole following a major security breach, announcing that it is returning a total of $3.9 million to affected traders. The payout comes in the wake of an incident on Thursday, October 29th, in which a malicious actor hijacked a third-party page-speed script to drain funds from hundreds of accounts on the platform’s international site.

The security compromise, which struck deep into the operational integrity of the prediction market interface, resulted in direct financial losses across 726 user wallets. However, aggressive intervention by the Polymarket team has significantly mitigated the damage. As of Friday morning, the platform confirmed via public updates that the vast majority of the fallout has been addressed, setting a strong precedent for user protection and platform accountability in the decentralized finance and prediction market ecosystem.

According to official updates from Polymarket’s trade communications channels, 689 of the 726 impacted wallets have already been fully reimbursed. The remaining 37 wallets are currently undergoing final verification processes, with repayments slated to go out immediately as each account’s ownership and loss metrics are securely confirmed by the platform’s security and support staff.

What’s the Scoop?

The crisis began unfolding when users interacting with Polymarket’s international interface encountered an unexpected security vulnerability. Unlike exploits targeting underlying smart contracts or core protocol logic, the attack vector utilized a compromised third-party vendor script responsible for optimizing page speed and frontend performance. By injecting malicious code into this external script, the attacker was able to intercept user interactions and drain approximately $2.7 million directly from 726 individual wallets before the threat was isolated and neutralized.

The incident underscored the severe risks associated with third-party software dependencies in modern web applications. Even protocols built on robust, audited smart contracts remain vulnerable if external frontend assets—such as analytics tools, CDNs, or performance scripts—are successfully targeted by malicious actors. In this case, the compromised script bypassed backend protocol logic by manipulating the user-facing interface, tricking traders into authorizing transactions that emptied their balances.

Compounding the crisis, the sudden discovery of the frontend exploit forced Polymarket leadership to temporarily pause trading operations on the platform. While the emergency halt was necessary to contain the breach, prevent further unauthorized drains, and secure the frontend infrastructure, it introduced secondary complications for traders actively positioned in fast-moving prediction markets. The trading pause left certain market participants unable to manage their positions or execute time-sensitive trades during a period of high market volatility.

Recognizing the broader impact of the operational disruption, Polymarket made the decision to absorb losses stemming not only from the direct script drain but also from the platform’s forced downtime. In addition to covering the $2.7 million stolen via the hijacked page-speed script, the platform allocated an additional $1.19 million to compensate users for losses directly tied to the trading pause. This brings the total remediation package to $3.9 million, fully funded by the platform to restore complete user trust.

The swift financial intervention has drawn widespread attention across the decentralized finance community, where protocols handling millions of dollars in user funds face constant scrutiny regarding their security architecture and incident response capabilities. By stepping in to cover both direct theft and downtime-related losses, Polymarket has established a clear standard for platform responsibility, ensuring that users do not bear the financial burden of a third-party vendor vulnerability. As the final verified wallets receive their reimbursements, the platform continues to review its vendor integration policies to prevent similar frontend vulnerabilities from threatening its infrastructure in the future.