Polymarket Issues $1.2M Goodwill Payouts Following Third-Party Script Breach
Platform compensates traders for losses incurred during a malicious hour-long service disruption.
1Comprehensive Reimbursement Strategy
Polymarket announced a $3.9 million total reimbursement program to address losses from a late October security incident. This initiative includes $2.7 million for drained wallets and an additional $1.2 million in goodwill payments. These funds specifically compensate traders for force-sold positions and slippage occurring during the platform's one-hour trading halt.
2Incident Timeline and Scope
On October 29, Polymarket detected unauthorized activity, prompting an immediate trading suspension at 3pm Eastern Time. The breach affected approximately 5,500 wallets, with 726 wallets directly targeted by the malicious code. By October 30, the company confirmed that 689 of these affected wallets had already received full compensation for their losses.
3Mechanism of the Breach
The attack originated from a compromised third-party performance-monitoring script provided by DebugBear. Attackers manipulated DNS records via the domain registrar to inject malicious code into the script. This code exploited active user sessions, allowing unauthorized actors to sell positions and drain funds directly from user wallets during the active window.
4DebugBear Security Findings
DebugBear reported that the incident involved a DNS compromise rather than a breach of their internal systems. Preliminary findings suggest the attack specifically targeted one customer's website. While the investigation remains ongoing, the company advised all clients to remove the embedded code to prevent further potential exploitation of their own web traffic.
5Quantifying the Financial Impact
Blockchain analysis indicated that approximately 28.6 million POL tokens, valued at roughly $2.64 million, were moved to an attacker-controlled wallet within one hour. However, this figure does not represent the total loss, as it excludes the value of force-sold positions and market slippage covered under Polymarket's broader $3.9 million reimbursement commitment.
6Operational Recovery Measures
To restore platform integrity, Polymarket cleared all caches, reset active login sessions, and removed the compromised script before resuming operations. The company identified eligible wallets using on-chain and internal trading data, ensuring that affected users did not need to submit individual claims to receive their specific reimbursement or goodwill payments.
7Enhanced Security Protocols
Polymarket is implementing stricter controls for third-party scripts to mitigate future risks. These measures include the adoption of stronger content security policies, pinned script versions, and sandboxing environments. Continuous monitoring is now in place to detect unauthorized script behavior, ensuring that external code cannot easily exploit user privileges within active browser sessions.
8Industry Security Implications
This incident highlights the systemic vulnerability of platforms relying on external scripts for performance monitoring. Even without a direct breach of core infrastructure, compromised third-party code can bypass security layers. The ongoing investigation will determine if current defensive measures are sufficient to protect users against similar sophisticated supply-chain attacks in the future.