Polymarket Sets $3.9M Refund Plan After Third-Party Script Compromise

TL;DR: Polymarket says its October 29 incident involved a compromised monitoring script. Its October 30 update put total refunds at $3.9 million, including losses linked to the trading pause. Polymarket has published a more detailed account of the third-party compromise that disrupted its international platform on October 29. The update shifts the focus from whether trading had reopened to how the attack worked and how customers would be compensated. The company’s explanation is also a reminder that an onchain application can depend on offchain website components with access to active user sessions. The refund figure includes more than drained funds In its October 30 postmortem, Polymarket said it was returning $3.9 million: $2.7 million associated with the attack and another $1.2 million for pause-related losses. It reported that 95% of affected wallets had been refunded in full as of that afternoon. The company said a compromised performance-monitoring script used some active sessions to sell positions and move funds. Its response included removing the script, clearing caches, resetting sessions and temporarily stopping trading and relayer activity. The 95% figure is a timestampe...