Polymarket Sets $3.9M Refund Plan After Third-Party Script Compromise
Summary
Polymarket said a compromised third-party performance-monitoring script used active user sessions to sell positions and move funds during its October 29 incident. The company reported $3.9 million in refunds: $2.7 million tied to the attack and $1.2 million for losses associated with the trading pause. It said 95% of affected wallets had been fully refunded as of October 30. Polymarket removed the script, cleared caches, reset sessions and paused trading and relayer activity. The incident highlights how off-chain website components can expose users of on-chain applications. Remaining concerns include verifying refund outcomes, defining compensation consistently and improving controls over third-party scripts and code changes.
