Polymarket to Refund $3.9M After Malicious Script Drains 726 Trader Wallets

Decentralized prediction market Polymarket will refund $3.9 million to affected traders after detecting a malicious script on its web interface on Thursday, October 29. The attack vector did not breach the underlying smart contract infrastructure, focusing instead on the web layer through a compromised third-party vendor. At 18:05 UTC that same Thursday, the platform temporarily halted order execution and shifted its matching engine to cancel-only mode to contain the incident. According to the breakdown shared through official channels, attackers directly drained nearly $2.7 million from 726 user wallets .