Polymarket expands refunds to cover wallet theft and trading pause losses

Polymarket is returning about 3.9 million dollars after an attack involving a compromised DebugBear script affected 726 wallets, according to The Hacker News. The refunds cover both stolen funds and losses incurred during a trading pause.

Compromised script exploited active sessions

On October 29, malicious code replaced a DebugBear page-speed script. According to The Hacker News, the code exploited signed-in Polymarket sessions to sell positions and transfer funds.

The theft was described as totaling about 2.7 million dollars. About 2.64 million dollars reached the hacker’s wallet in under an hour, highlighting how quickly the compromised script translated into losses.

Repayments extend beyond stolen funds

By October 30, Polymarket had refunded 689 of the 726 affected wallets, according to The Hacker News. That leaves 37 wallets outside the reported completed-refund count at that point.

The approximately 3.9 million dollars being returned exceeds the reported theft because it also includes losses during the trading pause. The supplied reporting does not break out those two components separately.

What it means for prediction markets

• Position integrity: The attack involved selling positions through signed-in sessions, meaning affected traders faced changes to their holdings as well as transfers of funds.
• Operational risk: The incident shows how a compromised third-party page-speed script can become a route to losses on a prediction-market platform.
• Recovery status: The October 30 figures show refunds were substantially completed, but do not establish that all 726 affected wallets had been repaid.
• Pause-related losses: Polymarket’s reimbursement scope includes losses during the trading pause, making the recovery effort broader than repayment of stolen funds alone.