POLYMARKET · Vendor
NO FIX YET
A third-party performance-monitoring script loaded on polymarket.com was replaced by an attacker with code that used active user sessions to sell positions and move funds out of wallets. Polymarket reports that 95% of affected wallets have been refunded and that the vendor has confirmed the compromise.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Users who had polymarket.com open during the short window on October 29 when the replaced vendor script was live; their active sessions were used to sell positions and move funds. The sources do not describe a flaw in a customer's own systems, so teams that do not run Polymarket's site are not affected by this incident.
Not affected if no-polymarket-session-during-window
Who cares polymarket, security, third-party-scripts, web-app
Unknown from the sources.
Unknown from the sources.
Type: Incident Duration: 45 minutes
Affected Components: Account Access & Authentication, Polymarket Web App
Oct 30, 20:07:02 GMT+0 - Postmortem - **We're giving this community a transparent Update on the Oct 29 attack on** [**polymarket.com**](http://polymarket.com)**: what happened, what we did, and where refunds stand.** **What happened**
A third-party vendor whose performance-monitoring script loaded on was compromised. The attacker replaced the script with one built to target Polymarket users. For some people who had the site open during a small window yesterday afternoon, it used their active session to sell positions and move funds out of their wallet. The vendor has confirmed the compromise publicly.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
What we did
Refunds
In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses. No claims or tickets needed: we identified eligible wallets from on-chain and trading data. If you think your amount is wrong or you should have received a payment, [fill out this google form](https://docs.google.com/forms/d/e/1FAIpQLScUUGRhp1ANXKLt2-X-bVWQL4sd2ZgS%5FmT4LdqMpNsYwS--MA/viewform "fill out this google form
(https://docs.google.com/forms/d/e/1FAIpQLScUUGRhp1ANXKLt2-X-bVWQL4sd2ZgS_mT4LdqMpNsYwS--MA/viewform)") and we'll recheck it. Oct 29, 18:06:00 GMT+0 - Resolved - This incident is resolved.
A third-party vendor whose script loaded on Polymarket.com was compromised. The attacker replaced the script with one built to target Polymarket users. For some users who had the site open during a short window on Oct 29, it used their active session to sell positions and move funds out of their wallets.
Full write-up: Oct 29, 17:38:00 GMT+0 - Identified - We’ve identified unauthorized activity affecting user wallets. The team is investigating, and we’ll share updates here as we learn more.