# Polymarket Issues $1.2M Goodwill Payouts Following Third-Party Script Breach Platform compensates traders for losses incurred during a malicious hour-long service disruption. - **Source:** [Latest news RSS](https://feeds.ibtimes.co.uk/feeds/bhsz8.rss) - **Published:** 2026-11-01 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/fd8c97d2-7c11-447b-a367-808e5168b220 ## Comprehensive Reimbursement Strategy Polymarket announced a $3.9 million total reimbursement program to address losses from a late October security incident. This initiative includes $2.7 million for drained wallets and an additional $1.2 million in goodwill payments. These funds specifically compensate traders for force-sold positions and slippage occurring during the platform's one-hour trading halt. ## Incident Timeline and Scope On October 29, Polymarket detected unauthorized activity, prompting an immediate trading suspension at 3pm Eastern Time. The breach affected approximately 5,500 wallets, with 726 wallets directly targeted by the malicious code. By October 30, the company confirmed that 689 of these affected wallets had already received full compensation for their losses. ## Mechanism of the Breach The attack originated from a compromised third-party performance-monitoring script provided by DebugBear. Attackers manipulated DNS records via the domain registrar to inject malicious code into the script. This code exploited active user sessions, allowing unauthorized actors to sell positions and drain funds directly from user wallets during the active window. ## DebugBear Security Findings DebugBear reported that the incident involved a DNS compromise rather than a breach of their internal systems. Preliminary findings suggest the attack specifically targeted one customer's website. While the investigation remains ongoing, the company advised all clients to remove the embedded code to prevent further potential exploitation of their own web traffic. ## Quantifying the Financial Impact Blockchain analysis indicated that approximately 28.6 million POL tokens, valued at roughly $2.64 million, were moved to an attacker-controlled wallet within one hour. However, this figure does not represent the total loss, as it excludes the value of force-sold positions and market slippage covered under Polymarket's broader $3.9 million reimbursement commitment. ## Operational Recovery Measures To restore platform integrity, Polymarket cleared all caches, reset active login sessions, and removed the compromised script before resuming operations. The company identified eligible wallets using on-chain and internal trading data, ensuring that affected users did not need to submit individual claims to receive their specific reimbursement or goodwill payments. ## Enhanced Security Protocols Polymarket is implementing stricter controls for third-party scripts to mitigate future risks. These measures include the adoption of stronger content security policies, pinned script versions, and sandboxing environments. Continuous monitoring is now in place to detect unauthorized script behavior, ensuring that external code cannot easily exploit user privileges within active browser sessions. ## Industry Security Implications This incident highlights the systemic vulnerability of platforms relying on external scripts for performance monitoring. Even without a direct breach of core infrastructure, compromised third-party code can bypass security layers. The ongoing investigation will determine if current defensive measures are sufficient to protect users against similar sophisticated supply-chain attacks in the future. ## Sources covering this story - https://www.ibtimes.co.uk/polymarket-adds-compensation-after-third-party-script-attack-1829333 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._