Polymarket pledges $3.9 million after third-party script steals millions from users
Hackers compromised a third-party performance-monitoring script on Polymarket and turned it into malware on October 29. The attackers used the script to steal funds from users. Polymarket said it will repay what users lost plus additional compensation. The total reimbursement commitment is $3.9 million. The company published a post-mortem on the incident. The breach adds to a string of third-party supply-chain incidents affecting the platform this year.
The $3.9 million payout drains Polymarket's treasury at a moment when rivals already argue that regulated custody prevents exactly this theft. Competitors like Kalshi and ForecastEx can now cite concrete loss figures to traders weighing speed against security. The shared Polymarket brand means trust damage on the international site bleeds into the CFTC-regulated U.S. exchange operated through QCX LLC. Polymarket must choose between deeper reserves or higher insurance costs.
Other platforms treated reimbursements as marketing costs and discovered traders read shortfalls as balance-sheet warnings. Any delay hands rivals a live case that federal registration carries tangible protections. This is Polymarket's third security incident this year by its own related coverage count. Each reimbursement raises the cost benchmark the industry measures against. The platform's next payout decision will shape how competitors frame custody architecture to prospective users.