---
type: "post"
id: "polymarket-says-a-compromised-third-party-script-drained-5fbb8f"
slug: "polymarket-says-a-compromised-third-party-script-drained-5fbb8f"
title: "Polymarket says a compromised third-party script drained some user wallets"
description: "Polymarket says an attacker replaced a compromised vendor’s performance-monitoring script on polymarket.com, then used some users’ active sessions to sell positions and move funds from wallets."
retrieval_nugget: "Polymarket says an attacker replaced a compromised vendor’s performance-monitoring script on polymarket.com, then used some users’ active sessions to sell positions and move funds from wallets."
published_at: "2026-11-10"
updated_at: "2026-11-10"
record_date: "2026-11-10"
date_kind: "published_at"
topics: ["security"]
entities: ["Polymarket"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "Polymarket says a compromised vendor script drained some wallets and reports that 95% of affected wallets have been refunded in full."
prior_refs: []
source_url: "https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj"
source_urls: ["https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:polymarket-says-a-compromised-third-party-script-drained-5fbb8f"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/polymarket-says-a-compromised-third-party-script-drained-5fbb8f/","markdown":"https://newruntime.com/posts/polymarket-says-a-compromised-third-party-script-drained-5fbb8f.md","json":"https://newruntime.com/posts/polymarket-says-a-compromised-third-party-script-drained-5fbb8f.json"}
markdown_url: "https://newruntime.com/posts/polymarket-says-a-compromised-third-party-script-drained-5fbb8f.md"
---

# Polymarket says a compromised third-party script drained some user wallets

## Retrieval answer

Polymarket says an attacker replaced a compromised vendor’s performance-monitoring script on polymarket.com, then used some users’ active sessions to sell positions and move funds from wallets.

## Summary

Polymarket says an attacker replaced a compromised vendor’s performance-monitoring script on polymarket.com, then used some users’ active sessions to sell positions and move funds from wallets. The company says it removed the script, paused trading, reset sessions and is returning $3.9 million, including compensation for losses during the pause. The incident highlights the risk of granting third-party code a place in a live, authenticated product.

## What happened

Polymarket’s status page says a third-party vendor’s performance-monitoring script, which loaded on polymarket.com, was compromised. The attacker replaced it with a script designed to target Polymarket users. For some people who had the site open during a short window on the afternoon of October 29, the malicious script used their active session to sell positions and move funds out of their wallets. Polymarket says the vendor publicly confirmed the compromise.

The status timeline records the incident as a major outage affecting both the Polymarket Web App and Account Access & Authentication. It lists the incident as identified at 5:38 PM UTC on October 29, with the affected services operational again at 6:06 PM UTC. The incident page gives a resolved window ending at 6:15 PM UTC. Polymarket says it removed the compromised script and cleared every cache, paused trading and its relayer to stop further drains, and reopened trading once the site was clean. It also reset all active login sessions.

The company says it is redeploying third-party scripts with additional integrity controls and continuous monitoring and verification. Examples it names include a stronger content security policy, explicit version pinning and sandboxing. Polymarket says it referred the case to law enforcement and continues to work with authorities while conducting its own investigation into the threat actor.

In an October 30 update, Polymarket said 95% of affected wallets had been refunded in full as of that afternoon, counting both drained wallets and goodwill refunds. It says it is returning $3.9 million in total: $2.7 million for the attack and another $1.2 million for losses related to the trading pause. The company says it identified eligible wallets using on-chain and trading data, so users do not need to submit claims or tickets. It describes two categories of additional compensation: the value of positions when they were taken, including slippage from forced sales; and losses when a market ended during the pause or a user sold just after trading reopened. Users who believe their payment is incorrect can request a recheck through a form linked from the status update.

## What the archive adds

New Runtime’s earlier coverage described an audit in which eight of ten third-party sandboxes had network-bypass vulnerabilities, noting that network confinement can fail independently of VM isolation ([October 21, 2026 note](https://newruntime.com/posts/audit-of-10-third-party-sandboxes-found-8-54fdd3/)). Another note covered an OpenCode breach affecting 1.4% of Console users ([October 24, 2026 note](https://newruntime.com/posts/isec-news-opencode-says-breach-tied-to-distillation-e57018/)). This is a new incident, not a new fact in either earlier story; it adds a distinct example of compromised third-party software affecting a live service.

## Trend signal

This incident does not yet fit a pattern New Runtime tracks. The status update shows a concrete failure involving a compromised script in a web application, but it does not establish a broader agent-security trend or describe an agent runtime. Treating it as evidence for a pattern about agent permissions, protocols or memory would go beyond what Polymarket has reported.

## Why now

The incident occurred on October 29, and Polymarket’s October 30 update adds a specific refund figure and describes changes to its third-party-script controls. Those details shift the story from an initial report of unauthorized wallet activity to a public account of remediation and compensation. The timing matters to affected users deciding whether their losses have been covered, and to operators reviewing how external code is deployed in authenticated applications.

## Why it matters

A monitoring script is not a product’s core transaction logic, but it can execute inside a browser session where a user is logged in. Polymarket says the attacker used that position to sell user-held positions and move funds. For teams building authenticated workflows, that makes vendor-delivered code part of the application’s security boundary once it runs on product pages. Vendor review alone cannot guarantee that the code served later is unchanged.

Polymarket’s stated response offers a practical review list: restrict permitted scripts with content security policy, pin explicit versions, sandbox scripts where possible, and monitor and verify deployed code. Operators also need a response path that can remove a dependency, invalidate sessions, halt risky operations and assess user impact. The company has not said which individual controls would have prevented this attack, but the event makes the operational requirement clear: external code in an authenticated experience needs containment and recovery planning alongside approval.

## Limits and uncertainty

Polymarket has not identified the vendor in the status update or disclosed how the compromise occurred, how the attacker gained control of the script, or how many wallets and users were affected. It says 95% of affected wallets had been refunded by the afternoon of October 30, but does not give the total number of affected wallets or say when the remaining refunds would be completed. The company says its investigation and law-enforcement work continue; the threat actor’s identity and the full technical findings are therefore not established in this update. The incident details and refund totals are Polymarket’s account and have not been independently verified here.

## Reader takeaway

Polymarket says compromised vendor code running on its website used some users’ active sessions to move funds, and that it is returning $3.9 million to traders. For teams, the central point is operational: third-party scripts that execute inside authenticated experiences deserve security controls and a removal-and-recovery plan, not just vendor approval.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)