Polymarket refunds $3.9M after vendor script exploit drains user wallets
A compromised third-party page-speed script drained approximately $2.73 million from 737 Polymarket user wallets on October 29, 2026. The attackers executed 985 withdrawals in about one hour, routing drain transactions through Polymarket's own relayer. Polymarket halted trading during the incident. The platform is reimbursing the stolen funds plus an additional $1.19 million for losses tied to the trading pause, for a total of $3.9 million.
Polymarket's international platform now faces its third supply-chain security incident in recent months, each forcing treasury reimbursement. The repeated hits strain reserves and give competitors like Kalshi and ForecastEx concrete losses to cite when arguing that regulated custody infrastructure prevents recurring thefts.
Traders choosing between venues must weigh whether Polymarket's speed and breadth outweigh its supply-chain vulnerabilities. The shared Polymarket brand means trust damage on the offshore site bleeds into the CFTC-regulated US exchange operated through QCX LLC. Each breach sets a cost benchmark the whole industry will be measured against, and a delayed payout would amplify the argument that registration matters more than quick launches.