Polymarket says it’s returning $3.9M to users after a hijacked third-party script emptied hundreds of accounts on its international site on Thursday (Oct. 29th). As of Friday morning, the prediction market reports that 689 of 726 hit wallets are now fully repaid, with the last 37 getting paid as each one is verified.

— (@)

What’s the Scoop?

• The vector: Polymarket’s contracts weren’t the problem. According to Report URI’s Scott Helme, a page-speed monitoring script served from vendor DebugBear’s CDN was swapped for a drainer that hijacked logged-in sessions for about an hour, dumping or moving positions and sweeping cash out through Polymarket’s own relayer. Polymarket hasn’t named the vendor, though its build log shows a commit pulling the “debugbear rum script.”

  Enjoying this article?

  Subscribe to Bankless or sign in

  Subscribe for free

• The damage: Polymarket pegs thefts at $2.7M, and it’s adding $1.19M for roughly 5.5K wallets that lost out during the trading pause or had positions taken. Per Bitquery’s analysis, most victims were small (the median account lost $171), but four accounts that each lost over $100K made up 43% of the haul.

• Strings attached?: Larger victims reportedly need to sign off on a release to get repaid, and terms that users shared overnight, including ID checks and a broad non-disparagement clause, drew sharp pushback. Polymarket hasn’t publicly addressed them.

• Second strike: This marks the second time since June that a compromised vendor has injected malicious code into Polymarket’s frontend. That earlier incident took roughly $3M from a far smaller group of accounts.

• Why it matters: Helme argues Polymarket’s security policy allowlisted every domain the drainer touched, and that pinning the script to a known hash would have kept the swapped file from running. Either way, every frontend that loads outside code alongside wallet signing carries the same exposure, so expect Polymarket’s promised postmortem to get a close read ahead of next week’s midterms.