A third-party script on Polymarket's international site was replaced

$3.9 million was returned, of which $2.7 million was the amount stolen

Reimbursement · Polymarket

As of the afternoon of the review, 95% of affected wallets had been refunded in full. That included wallets that were drained and goodwill compensation. $2.7 million was the part moved out in the attack. Another $1.2 million covered losses during the trading pause. The project said users did not need to file a ticket. Eligibility came from on-chain data and trading data.

In total, we're returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses.

• Polymarket · Statement · Primary

The project said the case had been sent to law enforcement

Enforcement · Polymarket

The review said the case had been referred to law enforcement. The project was still cooperating, and it was investigating the attacker itself. The review did not name the agency that took the case. It did not publish an attribution.

We've referred the case to law enforcement and continue to work with them while conducting our own investigation into the threat actor.

• Polymarket · Statement · Primary

Review: the script used logged-in sessions to sell positions

Technical · Polymarket

Polymarket said the script the attacker put in place targeted users who had the site open during a short window that afternoon. It used their active sessions to sell positions and move funds. The team also reset active logins and added integrity checks on third-party scripts.

For some people who had the site open during a small window yesterday afternoon, it used their active session to sell positions and move funds out of their wallet.

• Polymarket · Statement · Primary

A report identified the script supplier as DebugBear

Technical · SecurityWeek

SecurityWeek wrote that researchers linked the malicious code to the British website-performance company DebugBear. It also mentioned a production build that said the DebugBear script was removed. Polymarket's own review said only "a third-party vendor." It said the vendor had publicly confirmed it was compromised. The review did not write this company's name.

• SecurityWeek · Article · Secondary
• Polymarket · Statement · Primary

Trading resumed, and the cause was given as a third-party script

Confirmation · Polymarket

At 18:06 UTC the status page marked the incident resolved. The text said a script the vendor loaded on Polymarket.com had been swapped. For a short time, active sessions of some users who had the site open were used to sell positions and move funds. At 18:15 UTC the status page showed service back to normal.

A third-party vendor whose script loaded on Polymarket.com was compromised. The attacker replaced the script with one built to target Polymarket users.

• Polymarket Status · Statement · Primary

Trading and the relayer were paused

Halt · Polymarket

The review says the team removed the swapped script, cleared caches, and paused trading and the relayer, to stop further transfers. The status page recorded the major outage through 18:06 UTC.

• Polymarket · Statement · Primary
• Polymarket Status · Statement · Primary

The status page confirmed unauthorized activity in user wallets

Alert · Polymarket

The Polymarket status page wrote this update at 17:38 UTC. It marked a major outage of the website and of account access. It did not yet say which vendor.

We've identified unauthorized activity affecting user wallets. The team is investigating, and we'll share updates here as we learn more.

• Polymarket Status · Statement · Primary