Polymarket refunds $3.9M after third-party script compromise, covers trading pause losses
Polymarket released a detailed account of the October 29 platform compromise: a third-party performance-monitoring script was altered, used some active sessions to sell positions and move funds, and led to a temporary halt of trading and relayer activity. The company removed the script, cleared caches, reset sessions, and shifted attention to compensation and control improvements.
Refunds and scope
Polymarket’s October 30 postmortem set total refunds at $3.9 million: $2.7 million tied to the attack and $1.2 million for losses caused by the trading pause. The company reported that 95% of affected wallets had been refunded in full as of that afternoon. The 95% figure is timestamped and should not be treated as a live completion rate or as confirmation that every dispute is resolved.
Offchain website code inside the financial boundary
Third-party scripts execute because a site chooses to load them. Depending on permissions and the execution environment, such code can interact with page elements and active sessions that users associate with the trusted application. Mozilla’s subresource integrity describes one defense: a browser checks a resource against an expected hash and blocks mismatches. This separates an approved file from a modified file, but it does not prove the approved code is safe. Applications still need rigorous review of updates and strict control over which resources can run.
Trading pause created secondary losses
Time-sensitive markets can impose losses unrelated to direct wallet drains. Positions can settle during an outage or change in value before trading resumes. Fair compensation requires a defined reference: a specific timestamp, position size, and valuation method applied consistently. Thin liquidity during stress widens the gap between displayed quotes and executable prices, which increases the impact of forced sales.
Controls and reconciliation
Removing the malicious file closed the immediate route. Durable protection depends on verifying future code changes, limiting external script privileges, and detecting unusual activity quickly. Preventing unnecessary scripts from reaching sensitive pages is distinct from detecting misuse after execution. Users and counterparties benefit from clear reconciliation of completed refunds and any remaining disputes. The next assessment should focus on verified compensation outcomes and the effectiveness of revised controls, without assuming blockchain settlement alone protects users from every component of the application used to reach it.
Written by the News Desk and edited by Samuel Rae.
Authors credited by the source: NewsBTC Editorial Team
Published by Holder based on an external source.
