Polymarket hacked: is your money safe, and who gets refunded?

The attackers went after a supplier, not Polymarket itself. DebugBear, a UK website performance company, sells a Real User Monitoring tool (RUM, a bit of code that records how fast pages load for real visitors). Polymarket’s international site loaded its own copy of that script on every page.

DebugBear says the attackers took control of its DNS records (the internet’s address book entries that point a web name to a server) through its domain registrar. That let them point DebugBear’s script address at a server they controlled. DebugBear says its early findings show only one customer’s site was targeted, and it has seen no sign that its own systems were broken into, though it is still checking.

Security firm Hudson Rock pulled a copy of the malicious file from the exact address Polymarket’s pages were calling. It also spotted a change in Polymarket’s site code, pushed shortly before the public announcement, that removed the DebugBear script.

The script didn’t steal logins. It borrowed the access a trader already had in an open, signed-in Polymarket tab. Hudson Rock found no part of the code that sent passwords, seed phrases or private keys anywhere.

Instead it looked for the parts of the page that place orders and approve transactions, checked what the visitor held, and then took one of two routes:

• Email sign-in accounts: it sold the trader’s positions at steadily worse prices, then moved the cash out.
• Crypto wallet sign-in accounts: it sent the position tokens directly to a wallet the attackers controlled.

In both cases the code asked the account’s own signer to approve its requests and passed them to Polymarket’s relayer to submit. Hudson Rock cautions that a signing request doesn’t prove every victim approved something blindly, because some wallet providers may still show a prompt or refuse.

It was fast. Blockchain records show the attacker’s wallet collected about 28.6 million POL tokens, worth roughly $2.64 million at the time, in under an hour. The wallet then spread those tokens across three other addresses.

How much was stolen, and why the numbers differ

You’ll see several figures, because each tracker measured something slightly different. Polymarket’s own refund count is the most useful one for traders:

• About $2.7 million across 726 wallets, the amount Polymarket is refunding.
• $2.71 million, the estimate from blockchain security firm GoPlus.
• About $2.65 million held in the suspected attacker wallet, per Arkham data.
• Roughly 700 users affected, according to analytics firm Bubblemaps.

GoPlus also counted 731 addresses on the main attack path, but it points out that addresses don’t map neatly onto individual people.

For most traders, yes. Polymarket says it removed the bad script within the hour, cleared every cache, logged everyone out by resetting all active sessions, and paused trading until the site was clean. Trading came back about an hour after the first pause.

The refund picture, as of October 30:

• 689 of the 726 hit wallets had been refunded in full.
• The remaining 37 were being paid as each one was checked.
• About 5,500 more wallets that lost money during the pause, or had positions taken, are sharing $1.19 million.
• In all, Polymarket says it is returning $3.9 million.

Refunds are automatic. If your amount looks wrong, or you think you were missed, Polymarket’s status page links to a form to raise it.

One important detail for American readers: Polymarket US, the newer platform that runs as a federally regulated exchange for people inside the country, was not affected. The hack hit only the crypto-based international site, which is officially off-limits to US users.

The attack shows that a strong password and two-factor login can’t help when the danger comes from inside a page you trust. These steps cut the risk next time:

1. Check your balance and history. Compare your positions with what you held before October 29, and use the status-page form if a refund looks short.
2. Sign in again with care. Every session was reset, so you’ll need to log back in. Type the address yourself rather than following links in messages.
3. Reject any signing request you didn’t start. This is Hudson Rock’s main advice. If a wallet pop-up appears when you haven’t clicked trade or withdraw, decline it.
4. Log out when you’re done. The script worked only on signed-in pages, so an open session left running is an open door.
5. Keep long-term holdings off trading sites. Money parked in a separate wallet you control can’t be sold from a hijacked tab.

This is not the platform’s first brush with third-party trouble. In June 2026 it disclosed another case where an outside supplier’s compromise injected a malicious script into its site, with losses reported between $2 million and $3 million depending on the tally. The same week as this attack, Binance was hit by a far bigger theft, roughly $6 billion, that blockchain firms have tied to North Korea.

Polymarket is also a big target. It raised $1 billion in August 2026 and is now valued at $21 billion. The company says it is restoring outside scripts only with tighter controls, including a stricter Content Security Policy (rules telling the browser which code may run), pinned script versions and sandboxing.

If you run a website that uses DebugBear

DebugBear has told every RUM customer to remove its embed code now. Removing it stops new loads, but it doesn’t undo anything that already happened. Security experts suggest checking templates, plugins and tag managers to be sure the code is really gone, clearing cached pages, and resetting sessions and API keys for anyone who loaded affected pages, starting with admin accounts.

The wider lesson for site owners is to keep unneeded outside code off pages where users pay, trade or sign, and to use Subresource Integrity where possible. That browser feature refuses to run a script if its contents change from the version you approved.