Polymarket Returns $3.9M to Merchants After Vendor Script Leaked

Polymarket says it will return $3.9 million to users after a hacked third-party script drained hundreds of accounts on its international site on Thursday (October 29). From Friday morning, the prediction market reports that 689 of the 726 affected wallets are now fully refunded, with the final 37 being paid as each is verified.

— (@)

• The vector: Polymarket’s contracts were not the problem. According to URI’s Scott Helme ReportA page speed monitoring script provided by vendor DebugBear’s CDN was replaced with a drainer that hijacked login sessions for about an hour, deleting or moving positions and sweeping money through Polymarket’s own relay. Polymarket did not name the vendor, although its build log shows a commit pulling the “debugbear rum script.”

  Do you like this article?

  Subscribe to Bankless or log in

• The damage: Polymarket values ​​the thefts at $2.7 million and adds $1.19 million for approximately 5.5 thousand wallets that lost during the trading break or had their positions taken. By Bitquery AnalysisMost victims were small (the median account lost $171), but four accounts that each lost more than $100,000 accounted for 43% of the gain.

• Are there conditions attached? : The biggest victims would have had to sign a waiver to be reimbursed, and the terms users shared overnight, including identity checks and a broad non-disparagement clause, sparked strong reactions. Polymarket has not addressed them publicly.

• Second strike: This is the second time since June that a compromised supplier has injected malicious code into the Polymarket interface. That previous incident took about $3 million from a much smaller group of accounts.

• Why it’s important: Helme claims that Polymarket’s security policy whitelisted all domains affected by the drainer and that pinning the script to a known hash would have prevented the exchanged file from running. Regardless, every interface that loads external code alongside wallet signing presents the same exposure, so expect Polymarket’s promised post-mortem to be read closely before next week’s midterms.