On 29 October 2026 Polymarket halted trading on its international site after people reported positions sold and funds moved without them asking. On 30 October the company’s post-mortem put the repayment at about $3.9 million. About $2.7 million of that covers what was taken. About $1.2 million covers harm from the halt itself, including positions the script sold, across roughly 5,500 wallets. The theft itself was put at 726 wallets. Polymarket said no claim form is required, because it would identify the wallets from its own trading record. The Record, writing on 2 November, said that as of Saturday 95 percent of the affected wallets had been refunded. This page will not describe the script.
Polymarket is a prediction market. A person takes a position on an outcome, and the site is the place that position is bought and sold. The session in the browser is allowed to trade. That permission is the product. On 29 October it was also the hole, because a script the page loaded could use a session that was already open. See A wallet signature is not a handshake. Connect, trade, and send are different acts. A page that can do the second one while you are looking at it does not need a new approval to do the third.
What happened
Polymarket’s account is that an attacker replaced the performance-monitoring script loaded on polymarket.com. For some people who had the site open during a small window, that script used the active session to sell positions and move funds out of the wallet. The company said the vendor has confirmed the compromise in public. It removed the script, paused trading, and reset active login sessions. It later put a vendor script back, and said it had added integrity checks and continuous monitoring. Putting the vendor back is a product decision. It is not a finding that the window cannot open again.
The Record reports that the post-mortem identified the vendor as DebugBear, which sells a script sites use to measure how fast a page loads. The sentences Polymarket is quoted as publishing name the script and the vendor’s confirmation. They are the company’s impact statement. DebugBear’s own note says its domain records were changed at the registrar, that it cannot receive email sent to its domain, that the attack appeared aimed at one customer’s website, and that it has not seen a compromise of its own internal systems. It did not, in that note, name the customer. The investigation, DebugBear said, is still open. This page will not describe how a registrar record is changed, and it will not describe what the replacement script looked for.
Two piles should stay separate. The 726 wallets are the theft. The roughly 5,500 wallets are the halt and the positions sold while trading was off or being forced. The $2.7 million and the $1.2 million are those two piles. Adding them is the $3.9 million. A later percentage, 95 percent refunded as of Saturday, is a progress figure on the wallets Polymarket had already marked. It is not a new theft, and it is not a statement that every wallet has been paid.
Why it matters
If you had the international site open in that window, the risk Polymarket described was the session, not a seed phrase typed into a form. The repayment is the company paying from a list it built. It is not the chain undoing the trades. If the site was closed, this page did not spend a wallet that the session could not reach. If you use any site that can trade or send while you are logged in, a script that site loads is part of the custody. The diagram that draws the monitoring tool outside the wallet is the diagram that failed.
A refund announcement is also a phishing costume. Polymarket said eligible wallets were identified without a ticket. A page, a direct message, or a “support” account that needs a recovery phrase, a fresh connection, or a file before it can pay you is not that process. See A practical checklist for keeping crypto safer. See How crypto wallets actually work if a login and a key are still the same object in your head.
What happens next
The wallets still inside the remaining 5 percent, if that Saturday figure holds. DebugBear’s remaining questions, including how the registrar was reached, which it has not answered. The law-enforcement report Polymarket said it made. Watch Polymarket’s own channels for who has been paid, and DebugBear’s for what it is willing to say about its own domain. We will not treat 95 percent as every wallet, and we will not treat a restored monitoring script as proof the session is safe.
Not a recommendation to use Polymarket, or to open or close a position. Not a finding that every prediction market loads this vendor. Not a description of the script. The company’s own account was a window, a session, and a promise to pay about $3.9 million without a claim form.
