---
id: "INC-polymarket-cmvvek1i90eme14ruga1z6tuj"
page: "https://infrastack.ai/live/INC-polymarket-cmvvek1i90eme14ruga1z6tuj"
kind: "incident"
aliases: []
title: "Polymarket: Security incident - 3rd party vendor compromised"
severity: "high"
cvss: null
epss: null
exploited: false
status: "resolved"
category: "vendor"
products: [{"name": "Polymarket", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["incident", "polymarket", "security", "third-party-scripts", "vendor", "web-app"]
not_affected_if: ["no-polymarket-session-during-window"]
published_at: "2026-10-29T17:38:00+00:00"
first_seen_at: "2026-11-08T17:00:42+00:00"
updated_at: "2026-11-08T17:01:19+00:00"
sources: [{"source": "statuspage", "url": "https://status.polymarket.com/incident/cmvvek1i90eme14ruga1z6tuj", "first_seen_at": "2026-11-08T17:00:42+00:00"}]
exploit_sources: []
---

# Polymarket: Security incident - 3rd party vendor compromised

Link for people: https://infrastack.ai/live/INC-polymarket-cmvvek1i90eme14ruga1z6tuj (this .md is for agents)

A third-party performance-monitoring script loaded on polymarket.com was replaced by an attacker with code that used active user sessions to sell positions and move funds out of wallets. Polymarket reports that 95% of affected wallets have been refunded and that the vendor has confirmed the compromise.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Polymarket affected range not listed fixed no fixed version listed

## Timeline

- 2026-10-29T17:38:00+00:00 confirmed by Polymarket (statuspage) https://status.polymarket.com/incident/cmvvek1i90eme14ruga1z6tuj "A third-party vendor whose performance-monitoring script loaded on [polymarket.com](http://polymarket.com) was compromised."
- 2026-11-08T17:00:42+00:00 statuspage https://status.polymarket.com/incident/cmvvek1i90eme14ruga1z6tuj

## From the sources

Type: Incident
    Duration: 45 minutes

    Affected Components: Account Access & Authentication, Polymarket Web App
    Oct 30, 20:07:02 GMT+0 - Postmortem - **We're giving this community a transparent Update on the Oct 29 attack on** [**polymarket.com**](http://polymarket.com)**: what happened, what we did, and where refunds stand.** **What happened**   
  
A third-party vendor whose performance-monitoring script loaded on [polymarket.com](http://polymarket.com) was compromised. The attacker replaced the script with one built to target Polymarket users. For some people who had the site open during a small window yesterday afternoon, it used their active session to sell positions and move funds out of their wallet. The vendor has confirmed the compromise publicly.   
  
**What we did**

* Removed the vendor's compromised script and cleared every cache
* Paused trading and the relayer to stop further drains, then reopened once the site was clean
* Reset all active login sessions
* Redeploying third party scripts with additional integrity controls and continuous monitoring and verification (some examples include stronger CSP, explicit version pinning, sandboxing, etc)
* We've referred the case to law enforcement and continue to work with them while conducting our own investigation into the threat actor

  
**Refunds**

* As of this afternoon, 95% of affected wallets from the hack have been refunded in full between wallets drained and goodwill refunds.
* In addition to refunding drained wallets from the attack, we gave goodwill refunds to the following traders:
* Positions taken during the attack. If the script moved or force-sold your positions, we will pay what they were worth when they were taken: inclusive of any slippage incurred in the sale.
* Losses during the trading pause. If you held a position when we paused trading and it lost value because the market ended during the pause, or you sold right after we reopened, we covered the difference from its value at the pause.

  
**In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses.** No claims or tickets needed: we identified eligible wallets from on-chain and trading data. If you think your amount is wrong or you should have received a payment, [fill out this google form](https://docs.google.com/forms/d/e/1FAIpQLScUUGRhp1ANXKLt2-X-bVWQL4sd2ZgS%5FmT4LdqMpNsYwS--MA/viewform "fill out this google form

(https://docs.google.com/forms/d/e/1FAIpQLScUUGRhp1ANXKLt2-X-bVWQL4sd2ZgS_mT4LdqMpNsYwS--MA/viewform)") and we'll recheck it. Oct 29, 18:06:00 GMT+0 - Resolved - This incident is resolved.

A third-party vendor whose script loaded on [Polymarket.com](http://Polymarket.com) was compromised. The attacker replaced the script with one built to target Polymarket users. For some users who had the site open during a short window on Oct 29, it used their active session to sell positions and move funds out of their wallets.

Full write-up:  Oct 29, 17:38:00 GMT+0 - Identified - We’ve identified unauthorized activity affecting user wallets. The team is investigating, and we’ll share updates here as we learn more.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_