{"id":"INC-polymarket-cmvvek1i90eme14ruga1z6tuj","kind":"incident","aliases":[],"related":[],"title":"Polymarket: Security incident - 3rd party vendor compromised","description":"Type: Incident\n    Duration: 45 minutes\n\n    Affected Components: Account Access & Authentication, Polymarket Web App\n    Oct 30, 20:07:02 GMT+0 - Postmortem - **We're giving this community a transparent Update on the Oct 29 attack on** [**polymarket.com**](http://polymarket.com)**: what happened, what we did, and where refunds stand.** **What happened**   \n  \nA third-party vendor whose performance-monitoring script loaded on [polymarket.com](http://polymarket.com) was compromised. The attacker replaced the script with one built to target Polymarket users. For some people who had the site open during a small window yesterday afternoon, it used their active session to sell positions and move funds out of their wallet. The vendor has confirmed the compromise publicly.   \n  \n**What we did**\n\n* Removed the vendor's compromised script and cleared every cache\n* Paused trading and the relayer to stop further drains, then reopened once the site was clean\n* Reset all active login sessions\n* Redeploying third party scripts with additional integrity controls and continuous monitoring and verification (some examples include stronger CSP, explicit version pinning, sandboxing, etc)\n* We've referred the case to law enforcement and continue to work with them while conducting our own investigation into the threat actor\n\n  \n**Refunds**\n\n* As of this afternoon, 95% of affected wallets from the hack have been refunded in full between wallets drained and goodwill refunds.\n* In addition to refunding drained wallets from the attack, we gave goodwill refunds to the following traders:\n* Positions taken during the attack. If the script moved or force-sold your positions, we will pay what they were worth when they were taken: inclusive of any slippage incurred in the sale.\n* Losses during the trading pause. If you held a position when we paused trading and it lost value because the market ended during the pause, or you sold right after we reopened, we covered the difference from its value at the pause.\n\n  \n**In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses.** No claims or tickets needed: we identified eligible wallets from on-chain and trading data. If you think your amount is wrong or you should have received a payment, [fill out this google form](https://docs.google.com/forms/d/e/1FAIpQLScUUGRhp1ANXKLt2-X-bVWQL4sd2ZgS%5FmT4LdqMpNsYwS--MA/viewform \"fill out this google form\n\n(https://docs.google.com/forms/d/e/1FAIpQLScUUGRhp1ANXKLt2-X-bVWQL4sd2ZgS_mT4LdqMpNsYwS--MA/viewform)\") and we'll recheck it. Oct 29, 18:06:00 GMT+0 - Resolved - This incident is resolved.\n\nA third-party vendor whose script loaded on [Polymarket.com](http://Polymarket.com) was compromised. The attacker replaced the script with one built to target Polymarket users. For some users who had the site open during a short window on Oct 29, it used their active session to sell positions and move funds out of their wallets.\n\nFull write-up:  Oct 29, 17:38:00 GMT+0 - Identified - We’ve identified unauthorized activity affecting user wallets. The team is investigating, and we’ll share updates here as we learn more.","summary":"A third-party performance-monitoring script loaded on polymarket.com was replaced by an attacker with code that used active user sessions to sell positions and move funds out of wallets. Polymarket reports that 95% of affected wallets have been refunded and that the vendor has confirmed the compromise.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Polymarket","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","polymarket","security","third-party-scripts","vendor","web-app"],"not_affected_if":["no-polymarket-session-during-window"],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2026-10-29T17:38:00+00:00","first_seen_at":"2026-11-08T17:00:42+00:00","triaged_at":"2026-11-08T17:01:19+00:00","updated_at":"2026-11-08T17:01:19+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-08T17:01:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Polymarket: third-party script swapped to drain user wallets","impact":"high","summary":"A third-party performance-monitoring script loaded on polymarket.com was replaced by an attacker with code that used active user sessions to sell positions and move funds out of wallets. Polymarket reports that 95% of affected wallets have been refunded and that the vendor has confirmed the compromise.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["polymarket","web-app","third-party-scripts"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker sells positions and drains wallet funds through active sessions.","analyst_note":"","how_to_check":"unknown","plain_action":"If you traded on Polymarket on October 29, check your account for unexpected sales or withdrawals, and if you were drained, submit the Polymarket refund form if your amount looks wrong.","product_name":"","needs_analyst":false,"not_affected_if":["no-polymarket-session-during-window"],"who_is_affected":"Users who had polymarket.com open during the short window on October 29 when the replaced vendor script was live; their active sessions were used to sell positions and move funds. The sources do not describe a flaw in a customer's own systems, so teams that do not run Polymarket's site are not affected by this incident.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000822,"input_tokens":5600,"output_tokens":523,"severity_before":"unknown","breached_checked":true},"analyst_status":null,"analyst_note":null,"search":"'+0':93C,460C,531C '/forms/d/e/1faipqlscuugrhp1anxklt2-x-bvwql4sd2zgs%5fmt4ldqmpnsyws--ma/viewform':440C '/forms/d/e/1faipqlscuugrhp1anxklt2-x-bvwql4sd2zgs_mt4ldqmpnsyws--ma/viewform)':448C '00':458C,529C '02':91C '06':457C '07':90C '1.2':395C '17':527C '18':456C '2.7':392C '20':89C '29':106C,455C,505C,526C '3.9':387C '30':88C '38':528C '3rd':4A '45':77C '95':59B,271C 'access':82C 'account':81C 'activ':44B,167C,217C,509C,537C 'actor':265C 'addit':225C,290C 'affect':61B,79C,273C,538C 'afternoon':163C,270C 'amount':423C 'app':23B,86C 'attack':39B,107C,139C,297C,310C,480C 'authent':83C 'built':145C,486C 'cach':198C 'case':247C 'chain':415C 'claim':404C 'clean':214C 'clear':196C 'cmvvek1i90eme14ruga1z6tuj':11A 'code':41B 'communiti':99C 'compon':80C 'compromis':7A,73B,137C,184C,193C,478C 'conduct':258C 'confirm':71B,182C 'continu':229C,252C 'control':227C 'cover':373C,398C 'csp':237C 'data':418C 'differ':375C 'docs.google.com':439C,447C 'docs.google.com/forms/d/e/1faipqlscuugrhp1anxklt2-x-bvwql4sd2zgs%5fmt4ldqmpnsyws--ma/viewform':438C 'docs.google.com/forms/d/e/1faipqlscuugrhp1anxklt2-x-bvwql4sd2zgs_mt4ldqmpnsyws--ma/viewform)':446C 'drain':207C,285C,293C 'durat':76C 'elig':410C 'end':361C 'enforc':250C 'etc':242C 'everi':197C 'exampl':234C 'explicit':238C 'fill':433C,441C 'follow':304C 'forc':317C 'force-sold':316C 'form':437C,445C 'full':282C,521C 'fund':52B,174C,516C 'gave':299C 'give':97C 'gmt':92C,459C,530C 'goodwil':287C,300C 'googl':436C,444C 'hack':277C 'happen':112C,121C 'held':347C 'identifi':409C,532C,535C 'inc':9A 'inc-polymarket-cmvvek1i90eme14ruga1z6tuj':8A 'incid':3A,13B,75C,463C 'includ':235C 'inclus':332C 'incur':336C 'integr':226C 'investig':261C,544C 'law':249C 'learn':553C 'll':451C,547C 'load':32B,132C,473C 'login':218C 'loss':340C,402C 'lost':356C 'm':388C,393C,396C 'market':360C 'minut':78C 'monitor':30B,130C,230C 'move':51B,173C,314C,515C 'need':407C 'oct':87C,105C,454C,504C,525C 'on-chain':413C 'one':144C,485C 'open':157C,498C 'parti':5A,18B,27B,125C,222C,469C 'paus':199C,344C,352C,364C,381C,400C 'pause-rel':399C 'pay':323C 'payment':432C 'peopl':152C 'perform':29B,129C 'performance-monitor':28B,128C 'pin':240C 'plus':394C 'polymarket':1A,10A,12A,14B,56B,84C,148C,489C 'polymarket.com':34B,109C,110C,134C,135C,475C,476C 'posit':49B,171C,306C,320C,349C,513C 'postmortem':94C 'public':185C 're':96C,385C 'receiv':430C 'recheck':452C 'redeploy':220C 'refer':245C 'refund':65B,118C,266C,280C,288C,292C,301C 'relat':401C 'relay':203C 'remov':189C 'reopen':209C,371C 'replac':36B,140C,481C 'report':57B 'reset':215C 'resolv':461C,465C 'return':386C 'right':368C 'sale':339C 'sandbox':241C 'script':19B,31B,131C,142C,194C,223C,313C,472C,483C 'secur':2A,15B 'sell':48B,170C,512C 'session':46B,168C,219C,510C 'share':548C 'short':501C 'site':156C,212C,497C 'slippag':335C 'small':160C 'sold':318C,367C 'stand':119C 'stop':205C 'stronger':236C 'taken':307C,331C 'target':147C,488C 'team':542C 'think':421C 'third':17B,26B,124C,221C,468C 'third-parti':25B,123C,467C 'third-party-script':16B 'threat':264C 'ticket':406C 'total':383C 'trade':200C,343C,353C,417C 'trader':305C,390C 'transpar':101C 'type':74C 'unauthor':536C 'updat':102C,549C 'use':43B,165C,507C 'user':45B,149C,490C,493C,539C 'valu':357C,378C 've':244C,534C 'vendor':6A,20B,69B,126C,180C,191C,470C 'verif':232C 'version':239C 'wallet':55B,62B,178C,274C,284C,294C,411C,520C,540C 'web':22B,85C 'web-app':21B 'whose':127C,471C 'window':161C,502C 'work':254C 'worth':327C 'write':523C 'write-up':522C 'wrong':425C 'yesterday':162C","nicknames":[],"mitigations":[],"who_affected":"Users who had polymarket.com open during the short window on October 29 when the replaced vendor script was live; their active sessions were used to sell positions and move funds. The sources do not describe a flaw in a customer's own systems, so teams that do not run Polymarket's site are not affected by this incident.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you traded on Polymarket on October 29, check your account for unexpected sales or withdrawals, and if you were drained, submit the Polymarket refund form if your amount looks wrong.","pkeys":["polymarket"],"ptokens":["polymarket"],"labels":["high","incident","polymarket","security","thirdpartyscripts","vendor","webapp"],"campaign_type":null,"search_a":"'3rd':4A 'cmvvek1i90eme14ruga1z6tuj':11A 'compromis':7A 'inc':9A 'inc-polymarket-cmvvek1i90eme14ruga1z6tuj':8A 'incid':3A 'parti':5A 'polymarket':1A,10A,12A 'secur':2A 'vendor':6A","search_b":"'95':59B 'activ':44B 'affect':61B 'app':23B 'attack':39B 'code':41B 'compromis':73B 'confirm':71B 'fund':52B 'incid':13B 'load':32B 'monitor':30B 'move':51B 'parti':18B,27B 'perform':29B 'performance-monitor':28B 'polymarket':14B,56B 'polymarket.com':34B 'posit':49B 'refund':65B 'replac':36B 'report':57B 'script':19B,31B 'secur':15B 'sell':48B 'session':46B 'third':17B,26B 'third-parti':25B 'third-party-script':16B 'use':43B 'user':45B 'vendor':20B,69B 'wallet':55B,62B 'web':22B 'web-app':21B","search_c":"'+0':93C,460C,531C '/forms/d/e/1faipqlscuugrhp1anxklt2-x-bvwql4sd2zgs%5fmt4ldqmpnsyws--ma/viewform':440C '/forms/d/e/1faipqlscuugrhp1anxklt2-x-bvwql4sd2zgs_mt4ldqmpnsyws--ma/viewform)':448C '00':458C,529C '02':91C '06':457C '07':90C '1.2':395C '17':527C '18':456C '2.7':392C '20':89C '29':106C,455C,505C,526C '3.9':387C '30':88C '38':528C '45':77C '95':271C 'access':82C 'account':81C 'activ':167C,217C,509C,537C 'actor':265C 'addit':225C,290C 'affect':79C,273C,538C 'afternoon':163C,270C 'amount':423C 'app':86C 'attack':107C,139C,297C,310C,480C 'authent':83C 'built':145C,486C 'cach':198C 'case':247C 'chain':415C 'claim':404C 'clean':214C 'clear':196C 'communiti':99C 'compon':80C 'compromis':137C,184C,193C,478C 'conduct':258C 'confirm':182C 'continu':229C,252C 'control':227C 'cover':373C,398C 'csp':237C 'data':418C 'differ':375C 'docs.google.com':439C,447C 'docs.google.com/forms/d/e/1faipqlscuugrhp1anxklt2-x-bvwql4sd2zgs%5fmt4ldqmpnsyws--ma/viewform':438C 'docs.google.com/forms/d/e/1faipqlscuugrhp1anxklt2-x-bvwql4sd2zgs_mt4ldqmpnsyws--ma/viewform)':446C 'drain':207C,285C,293C 'durat':76C 'elig':410C 'end':361C 'enforc':250C 'etc':242C 'everi':197C 'exampl':234C 'explicit':238C 'fill':433C,441C 'follow':304C 'forc':317C 'force-sold':316C 'form':437C,445C 'full':282C,521C 'fund':174C,516C 'gave':299C 'give':97C 'gmt':92C,459C,530C 'goodwil':287C,300C 'googl':436C,444C 'hack':277C 'happen':112C,121C 'held':347C 'identifi':409C,532C,535C 'incid':75C,463C 'includ':235C 'inclus':332C 'incur':336C 'integr':226C 'investig':261C,544C 'law':249C 'learn':553C 'll':451C,547C 'load':132C,473C 'login':218C 'loss':340C,402C 'lost':356C 'm':388C,393C,396C 'market':360C 'minut':78C 'monitor':130C,230C 'move':173C,314C,515C 'need':407C 'oct':87C,105C,454C,504C,525C 'on-chain':413C 'one':144C,485C 'open':157C,498C 'parti':125C,222C,469C 'paus':199C,344C,352C,364C,381C,400C 'pause-rel':399C 'pay':323C 'payment':432C 'peopl':152C 'perform':129C 'performance-monitor':128C 'pin':240C 'plus':394C 'polymarket':84C,148C,489C 'polymarket.com':109C,110C,134C,135C,475C,476C 'posit':171C,306C,320C,349C,513C 'postmortem':94C 'public':185C 're':96C,385C 'receiv':430C 'recheck':452C 'redeploy':220C 'refer':245C 'refund':118C,266C,280C,288C,292C,301C 'relat':401C 'relay':203C 'remov':189C 'reopen':209C,371C 'replac':140C,481C 'reset':215C 'resolv':461C,465C 'return':386C 'right':368C 'sale':339C 'sandbox':241C 'script':131C,142C,194C,223C,313C,472C,483C 'sell':170C,512C 'session':168C,219C,510C 'share':548C 'short':501C 'site':156C,212C,497C 'slippag':335C 'small':160C 'sold':318C,367C 'stand':119C 'stop':205C 'stronger':236C 'taken':307C,331C 'target':147C,488C 'team':542C 'think':421C 'third':124C,221C,468C 'third-parti':123C,467C 'threat':264C 'ticket':406C 'total':383C 'trade':200C,343C,353C,417C 'trader':305C,390C 'transpar':101C 'type':74C 'unauthor':536C 'updat':102C,549C 'use':165C,507C 'user':149C,490C,493C,539C 'valu':357C,378C 've':244C,534C 'vendor':126C,180C,191C,470C 'verif':232C 'version':239C 'wallet':178C,274C,284C,294C,411C,520C,540C 'web':85C 'whose':127C,471C 'window':161C,502C 'work':254C 'worth':327C 'write':523C 'write-up':522C 'wrong':425C 'yesterday':162C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T17:38:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"polymarket:cmvvek1i90eme14ruga1z6tuj","url":"https://status.polymarket.com/incident/cmvvek1i90eme14ruga1z6tuj","severity":null,"published_at":"2026-10-29T17:38:00+00:00","modified_at":"2026-10-29T17:38:00+00:00","first_seen_at":"2026-11-08T17:00:42+00:00","fetched_at":"2026-11-09T01:49:38+00:00","note":null}],"documents":[],"disclosures":[{"company":"Polymarket","domain":"status.polymarket.com","url":"https://status.polymarket.com/incident/cmvvek1i90eme14ruga1z6tuj","kind":"statuspage","published_at":"2026-10-29T17:38:00+00:00","quote":"A third-party vendor whose performance-monitoring script loaded on [polymarket.com](http://polymarket.com) was compromised.","confidence":0.8500000238418579,"source":"statuspage","created_at":"2026-11-08T17:12:40+00:00","entry":"exposed-secret"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}