Polymarket will repay traders after a vendor script theft. Trust is the real test.
Signal Snapshot
- Polymarket says it will return about $3.9 million to users after the Thursday attack on its international site. That sum covers stolen funds plus losses linked to the trading pause.
- About $2.7 million was drained from 726 wallets. As of Friday morning, 689 wallets were fully repaid. The final 37 will be paid once each case is checked.
- It covers traders who lost money while trading was halted or had positions moved.
- Token Metrics sees this as a front end failure, not a smart contract failure. A page speed script was swapped for a drainer.
- Trading is now fully back online. The top near term risk is phishing tied to fake refund posts.
Key Takeaways
- A hijacked vendor script drained user wallets on Polymarket international site on Thursday. The team paused trading, fixed the issue, and started repayments.
- The contracts held up. The web site did not. That split matters for how users judge safety on fast growing trading apps.
- Full refunds plus pause cover can rebuild trust fast. But repeat front end lapses would hurt more than one theft.
What Happened
Polymarket says it is returning about $3.9 million to traders after the international site attack on Thursday. Oct. 29. The plan covers two groups. The first group is direct victims. The second group felt the pause.
The direct drain took about $2.7 million from 726 wallets. As of Friday morning, 689 of those wallets were fully repaid. The last 37 are being paid as each case is checked. No new user action was cited as needed for the core refund.
It aims at traders who lost money while trading was stopped. It also covers traders whose positions were moved or taken during the window.
The team points to a third party script, not its own contracts. That script was swapped for a drainer. Polymarket has not named the vendor in its own posts.
A trading pause freezes buys and sells. It stops the bleeding. But it can leave open bets stuck. Prices can move while users wait. That can cause losses even with no theft. Covering those losses goes past the normal refund.
Verification here means checking each wallet one by one. The team confirms ownership. It confirms loss size. It then sends funds. That takes time. It lowers the chance of paying scammers.
Why It Matters
Here is the deal. The money was not lost in a contract bug. It was lost in the web layer. That is a key split. Users often audit contracts in their heads. They rarely audit web scripts. Yet web scripts can move money when wallets stay logged in.
For investors the read is simple. Front end risk is business risk. A clean refund can turn a bad day into a trust win. A slow or partial refund can do the reverse. Covering pause losses sends a clear signal. The team wants active traders to stay.
This touches the exchanges rail. Prediction markets live or die on fast deposits and fast exits. If users fear the login box, they trade less. Less trading means wider gaps between buyers and sellers. That hurts all users, not just victims. A fast full payback helps keep that rail strong.
Second order risk sits with vendors. One bad script can hit many apps at once. Crypto apps load lots of outside code. Each vendor is a door. This event may push teams to lock those doors tighter.
Market Context
This is a security event. It is also a company event. The firm chose to pay more than the stolen sum. That choice shapes the story.
Market structure matters here. Prediction markets need trust in two layers. The base layer is contracts and cash. The top layer is the web site and login. This break hit the top layer. The base layer stayed intact. That is why trading could restart fast.
Scale is the context. Hundreds of wallets faced direct theft. Thousands more faced pause effects. The refund plan covers both groups. That is rare. Many past refunds in crypto cover theft only. Covering pause effects sets a higher bar.
Regulation is not the driver here. This is not a rules shift. It is an ops test. How a team handles keys, scripts, and vendor access matters more than new laws in this case.
User habits add context. Many traders stay logged in all day. They approve sessions for speed. That speed helps in live markets. It also gives a hijacked script more power. Short sessions and fresh logins lower that power. Hardware checks add one more lock.
Vendor code adds wider context. Modern sites load chat tools and speed tools and ad tools. Each tool runs with broad rights. One swap can change what the page does. That is why front end checks now matter as much as contract checks. Teams that list vendors and lock versions cut risk.
Risks to Watch
First risk is phishing. Scammers love refund news. They post fake claim links. They pose as support. Only trust official posts and in app notices. Do not sign unknown transactions.
Second risk is incomplete payback. Watch the final 37 wallets. If they stay unpaid for days, trust slips. If new wallets report losses, scope grows. Both would change the read.
Third risk is repeat access. If bad code stayed in other pages, harm could return. Watch for fresh reports of drained sessions. Watch for a second pause. A clean restart with no new cases would calm fears.
What would make this matter less? Fast proof that all 726 are whole. Plus proof that pause group got paid. And proof that bad script is fully removed. If all three land, the headline fades to noise.
What to Watch Next
- Watch the final refund count. The team reports 689 of 726 repaid. Look for 726 of 726. That is the clean end state.
- Look for start times and done times. Look for how loss size was set. Clear rules help trust.
- Watch the vendor post mortem. Look for which script was hit and for how long. Look for what checks were added. No vendor name yet means this part is still open.
- Watch for copycat lures. Fake refund sites may pop up. Do not connect wallets from social links. Use bookmarks and official app entry points.
- Watch trading activity after restart. Stable volume suggests trust held. Sharp drops suggest users stepped back.
This article is for information only. It is not investment advice.
