Polymarket - Notice history

Trading will resume at approximately 3pm ET.

We have identified and fixed the issue impacting our international platform, Polymarket.com. One of our third party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online. 

We're giving this community a transparent Update on the Oct 29 attack on polymarket.com: what happened, what we did, and where refunds stand. What happened

A third-party vendor whose performance-monitoring script loaded on polymarket.com was compromised. The attacker replaced the script with one built to target Polymarket users. For some people who had the site open during a small window yesterday afternoon, it used their active session to sell positions and move funds out of their wallet. The vendor has confirmed the compromise publicly.

What we did

• Removed the vendor's compromised script and cleared every cache

• Paused trading and the relayer to stop further drains, then reopened once the site was clean

• Reset all active login sessions

• Redeploying third party scripts with additional integrity controls and continuous monitoring and verification (some examples include stronger CSP, explicit version pinning, sandboxing, etc)

• We've referred the case to law enforcement and continue to work with them while conducting our own investigation into the threat actor

Refunds

• As of this afternoon, 95% of affected wallets from the hack have been refunded in full between wallets drained and goodwill refunds.

• In addition to refunding drained wallets from the attack, we gave goodwill refunds to the following traders:

• Positions taken during the attack. If the script moved or force-sold your positions, we will pay what they were worth when they were taken: inclusive of any slippage incurred in the sale.

• Losses during the trading pause. If you held a position when we paused trading and it lost value because the market ended during the pause, or you sold right after we reopened, we covered the difference from its value at the pause.

In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses. No claims or tickets needed: we identified eligible wallets from on-chain and trading data. If you think your amount is wrong or you should have received a payment, fill out this google form and we'll recheck it.

This incident is resolved.

A third-party vendor whose script loaded on Polymarket.com was compromised. The attacker replaced the script with one built to target Polymarket users. For some users who had the site open during a short window on Oct 29, it used their active session to sell positions and move funds out of their wallets.

Full write-up: https://discord.com/channels/710897173927297116/775506448041115669/1565812938466660502