Polymarket Posts Oct. 30 Postmortem: 95% of Hacked Wallets Refunded, $3.9M Total
By Crypto Wire
October 30, 2026
Polymarket published an Oct. 30 status postmortem on the Oct. 29 attack against polymarket.com, saying as of that afternoon about 95% of affected wallets from the hack had been refunded in full and putting the total make-whole near $3.9 million — about $2.7 million for drained wallets plus roughly $1.2 million covering pause-related losses. That refund tally is the Orange County desk’s new primary fact beyond Thursday’s cancel-only halt and same-day reopen, and it sits apart from this site’s earlier New York gambling suit file.
The postmortem restates the attack path in plain language. A third-party vendor whose performance-monitoring script loaded on polymarket.com was compromised; the attacker replaced that script with one built to target Polymarket users; for some people who had the site open during a short afternoon window on Oct. 29, the malicious script used their active session to sell positions and move funds out of their wallet. Polymarket says the vendor has confirmed the compromise publicly. CNBC, citing a person familiar with the matter, named the performance-monitoring vendor as DebugBear and said the company referred the case to U.K. law enforcement because that is where DebugBear is based — treat that naming and jurisdiction as attributed secondary color until Polymarket’s own status note spells the vendor.
What Polymarket says it did next is the operational half of the policy file. The desk removed the compromised script and cleared caches, paused trading and the relayer to stop further drains, then reopened once the site was clean, reset all active login sessions, and is redeploying third-party scripts with stronger integrity controls such as tighter CSP, explicit version pinning, and sandboxing. The status timeline still shows the international exchange moved from cancel-only around 6:05 p.m. UTC Oct. 29 into a resolved window near 7:05 p.m. UTC the same day after a monitoring note that trading would resume around 3 p.m. ET — about a one-hour major outage on the public status board.
Independent tape around the drain still belongs in the receipts stack, not as Polymarket’s own dollar print. The Block reported Arkham data showing a suspected attacker wallet holding about $2.65 million in POL after USDC.e-to-POL swaps through Relay. CNBC relayed analytics from Betting Intelligence and Polysights putting at least $2.7 million withdrawn across roughly 710 other wallets. Those figures sit beside Polymarket’s later $2.7 million drain bucket inside the $3.9 million total — attribute each number to its source and do not invent a reconciled on-chain hash set in this chapter.
Refund scope is broader than drained balances alone. Polymarket says goodwill covers positions the script force-sold, paid at their value when taken including slippage, and covers losses during the trading pause when a market ended mid-halt or a trader sold right after reopen. Eligible wallets were identified from on-chain and trading data with no claims ticket required; traders who think a payment is wrong can file a recheck form. An earlier Discord note relayed by CNBC said wallets under $10,000 taken would be restored by Oct. 30, while larger drains would need a release form — keep that process note attributed and secondary to the Oct. 30 95% / $3.9 million status print.
Scope labeling still matters for collectors who trade event contracts beside NFT bids. Polymarket and wraps say the international polymarket.com venue on Polygon was hit; the U.S. platform was not compromised in the attributed accounts. The disruption lands days before expected midterm-election volume on Nov. 3, which is calendar color, not proof of another drain. June’s prior third-party vendor incident that Polymarket also said it would refund remains backdrop only — today’s chapter is the Oct. 30 postmortem math.
Adjacent desks stay separate. Binance’s Nov. 1 withdrawal / Nov. 2 PoR calendar, FREEDZ’s burn vault, and Pupkins’ ticket climb remain their own Orange County files. This chapter only advances Polymarket’s make-whole and vendor-script postmortem after the Oct. 29 halt.
What to watch next is whether the remaining ~5% of affected wallets clear without a second process fight, whether U.K. law-enforcement steps produce a named charging document, and whether the CSP / script-pinning redeploy actually holds through the Nov. 3 midterm volume spike — plus any formal DebugBear customer advisory that matches Polymarket’s status language.
What changes for bids: Prediction-market rails that NFT desks already price beside culture and election contracts now carry an explicit third-party script integrity rule set and a published $3.9 million make-whole after a same-day halt — treat session-hijack vendor risk as live venue weather until the remaining refunds and LE trail go quiet.
Bottom line: Polymarket’s Oct. 30 postmortem puts about 95% of hacked wallets refunded and a $3.9 million total make-whole after the Oct. 29 third-party script attack on polymarket.com.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
