Polymarket Hack Refund: $3.9M Going Back to 6,226 Wallets — 7 Checks Before You Trust Any 'Refund' Link

Polymarket is refunding $3.9 million to traders after a hijacked page-speed script drained about $2.7 million from 726 wallets on October 29, 2026 — and 689 of those wallets had already been repaid in full by October 30. That is the good news, and it arrived fast by crypto standards.

The bad news is just as urgent: the moment a real refund is announced, fake refund portals appear. Security researchers warned within days that copycat domains and fraudulent links were already spreading on social media, dressed up as Polymarket refund claim pages. If you traded on Polymarket, or you plan to bet on the November 3 US midterm elections, the difference between the real payout and a scam could be the rest of your wallet.

This article explains exactly what happened, how a harmless-looking website speed tool became a theft machine in under an hour, who gets paid and how, what Polymarket is changing, and the seven checks you must run before you click anything that mentions a refund. No claim form is needed for the real payout — and anyone telling you otherwise is the story.

What happened on October 29, in plain English

Polymarket is a prediction market: users buy and sell shares in the outcome of real-world events, from elections to sports results to economic data. Its international platform, Polymarket.com, runs on the Polygon blockchain. On Thursday, October 29, 2026, traders began reporting unauthorized withdrawals from their accounts in the afternoon, European time.

The attack did not break Polymarket's smart contracts. That distinction matters, because it changes what you should worry about. The smart contracts — the on-chain code that holds and settles markets — were not breached. Instead, the attack rode in through the website itself, through a piece of third-party code that Polymarket's site loaded from an outside vendor.

The vendor was DebugBear, a UK-based website performance company whose real-user monitoring tool measures how fast pages load for real visitors. Polymarket embedded DebugBear's script so it could track page speed. On October 29, the file served from DebugBear's content delivery address was replaced with malicious code. DebugBear later said its DNS records were compromised through its domain registrar. Researchers at Hudson Rock downloaded the malicious file on October 29 from the same address Polymarket's site used to load the script, confirming the supply-chain route.

For traders who were signed in to Polymarket.com in their browsers, the malicious script could sell their positions and move their funds. Blockchain records show crypto worth about $2.64 million reached the attacker's wallet in under an hour, and analytics firm Bitquery counted 985 unauthorized withdrawals between 17:10 and 18:10 UTC. The attacker swapped stolen USDC.e for POL tokens using a service called Relay, according to on-chain analysis cited in coverage of the incident. Arkham data linked a wallet holding about $2.65 million in POL tokens to the suspected attacker.

Polymarket's response was quick once the reports landed. It posted its first status update about unauthorized activity at 17:38 UTC, put the exchange into cancel-only mode at 18:05 UTC — users could cancel existing orders but not place new trades — and paused its relayer, the service that helps process transactions on-chain. The company said it removed the script within the hour, cleared every cache, reset all active login sessions, and paused trading until the site was clean. It also referred the case to law enforcement; because the third-party provider operates in the UK, the referral went to UK law enforcement. Trading has since resumed in full.

Crucially, Polymarket's separate US platform was not affected. The breach hit the international platform only. That is one of the first facts to check if someone tries to scare you about a US account you do not even hold on the affected site.

The $3.9 million refund: who gets what

Polymarket's compensation package totals $3.9 million, and it covers two different groups of losses. Understanding the split stops a lot of confusion — and a lot of scams.

First, the direct victims: about $2.7 million drained from 726 trader wallets. Polymarket promised full reimbursement for every affected wallet, and by the morning of October 30, 689 of those 726 wallets had already received their full funds, with no extra procedures required. The remaining 37 accounts were being paid one by one as each was verified, to confirm ownership and the exact amount before the final payouts. Traders whose losses were below $10,000 were due to be refunded by October 30, while larger losses required a release form — a detail that matters, because scammers love to invent urgent forms for everyone.

Second, the collateral victims: about $1.19 million to roughly 5,500 wallets that lost money during the trading halt or had positions taken while the exchange was in cancel-only mode. Polymarket chose to cover those losses too, which is why the total restitution is $3.9 million rather than just the $2.7 million stolen. Add the two groups together and about 6,226 wallets are touched by the payout in one way or another.

The single most important refund fact is this: traders do not need to file a claim. Polymarket has stressed that all restitution payments are issued directly on-chain to the original user addresses, without asking users to connect to third-party dashboards or sign new contract allowances. Its status page links a form only for anyone who thinks their amount is wrong or believes they should have received a payment. That is your best filter: any message asking you to connect a wallet, approve an allowance, or enter a seed phrase to "claim" a refund is not Polymarket. Close it.

A minute-by-minute timeline of the attack and the fix

Timelines are where security stories either make sense or fall apart. Here is the sequence as reported by Polymarket, researchers, and on-chain analysts, with the numbers that anchor each step.

When (October 29–30, 2026)	What happened	Why it matters
Afternoon, October 29	Traders report unauthorized withdrawals on Polymarket.com	Community reports, not an internal alert, surfaced the attack first
17:10–18:10 UTC, October 29	985 unauthorized withdrawals; about $2.64 million reaches the attacker's wallet in under an hour	Speed was the weapon — the theft was nearly finished before most users heard about it
17:38 UTC, October 29	Polymarket posts its first status update on unauthorized activity	Public acknowledgement came within about half an hour of the withdrawal wave
18:05 UTC, October 29	Exchange switches to cancel-only mode; relayer actions paused	Freezing new trades contained the damage while the cause was hunted
Within the hour	Malicious script removed; caches cleared; all login sessions reset	Removing the script stopped new victims, but stolen funds were already gone
October 29–30	Case referred to law enforcement; full reimbursement promised	Recovery shifted from containment to paying victims back
Morning, October 30	689 of 726 drained wallets refunded in full; $1.19 million halt-loss payouts begin to about 5,500 wallets	About 95 percent of direct victims were whole within roughly a day
Early November 2026	Final 37 wallets paid as verified; full forensic post-mortem expected	The tail of the payout is verification, not a second crisis

Why a page-speed script could steal millions

To understand the attack, you need one mental model: your browser trusts every script a website loads, including scripts loaded from other companies. When you log in to a trading site, scripts running on that page can often read what is on the page and, in some designs, interact with your session. A compromised third-party script therefore inherits the trust of the site that embedded it.

That is the supply-chain problem in a sentence: the web layer around crypto — the sites, scripts, and vendors users touch every day — is now a primary attack surface.

Polymarket says it is putting third-party scripts back in place with extra checks, including a stronger Content Security Policy, pinned versions of scripts, and sandboxing. In plain terms, the site will lock each script to an exact known-good version and fence scripts off. DebugBear, for its part, told customers of its monitoring product to remove its embed code from their websites, and the address that served the malicious file had no DNS record at all by November 1. Those are the right moves, but they are also a reminder: the fix for a supply-chain attack is never one patch. It is a permanent change in how much outside code a site is willing to trust.

What most people get wrong about this hack

Five misunderstandings are already circulating, and each one makes someone poorer if believed.

Getting the target wrong. Many headlines say "Polymarket hacked" and leave readers assuming the prediction market's blockchain or its market contracts were broken. They were not. The malicious code ran in the website layer through a compromised vendor. That matters because it means your on-chain positions were not magically unsafe everywhere — but your logged-in browser session on that site was.

Getting the refund process wrong. The loudest scam right now is the fake claim portal. Polymarket pays directly to original addresses and asks nobody to connect a wallet or sign an allowance to receive a refund. Any site, direct message, or social post that reverses that — "connect to claim" — is a trap, full stop.

Getting the scale wrong. Two numbers are doing the rounds: $2.7 million and $3.9 million. Both are real, and they measure different things. About $2.7 million was stolen from 726 wallets. About $3.9 million is the total being returned once halt-related losses to roughly 5,500 more wallets are included. Quoting only the smaller number understates the payout; quoting only the larger number without the split overstates the theft.

Getting the US platform wrong. Polymarket's US exchange was not affected. If you only trade on the US platform, this breach did not touch your account, and any message claiming otherwise is fishing for a reaction.

Getting the lesson wrong. The lesson is not "never use prediction markets" or "never trust any website." The lesson is narrower and more useful: a site is only as safe as the third-party code it loads, and your own setup should assume that any single website session can one day turn hostile. Small hot balances, hardware storage for the rest, and a refusal to sign unexpected approvals are worth more than any hot take about the platform.

What happens next: midterms, the post-mortem, and the copycats

Timing is why this story is not over. The breach landed days before the US midterm elections on November 3, 2026, an event expected to drive very high trading volumes on both Polymarket's international and US exchanges. Prediction markets live or die on big-event volume, and a security scare right before the biggest event on the calendar is the worst possible moment for trust to wobble. Polymarket's fast, full refund looks, in that light, like both a customer-protection decision and a business-survival decision: traders who feel whole are traders who come back for election night.

Three things to watch in the coming days. First, the final 37 wallets: Polymarket said they were being paid as each was verified, so the payout should close out quietly rather than with a new announcement. Second, the full forensic post-mortem, expected in the first days of November: it should name the exact vendor compromise path and the controls that failed, and it will be the document serious traders should actually read. Third, the copycat wave: security firms already warned about fraudulent refund links spreading on social platforms. Expect that wave to peak around the midterms, when search interest in Polymarket is highest and newcomers are least able to tell a real announcement from a fake one.

The 7-point refund safety checklist

Use this checklist before you click, connect, sign, or share anything about the Polymarket refund — or any crypto refund, because the same traps are already being reused for the Binance hack. Our earlier investigation into Binance hack refund scams and their fake compensation claims found the same playbook: urgency, a fake portal, and a wallet connection request.

1. Start from the official status page, never from a link in a post. Type the address yourself or use a bookmark you made before the incident. Search results and social posts are where copycat domains live.
2. Never connect your wallet to claim a refund. Polymarket pays directly on-chain to original addresses. A connection request is the scam, not a step in the process.
3. Never sign a new token approval or contract allowance for a refund. A refund needs no permission from you. An approval hands a stranger the right to move your tokens.
4. Never enter a seed phrase or private key anywhere, for any reason. No legitimate refund, support agent, or recovery service will ever ask for it. This rule has no exceptions.
5. Ignore urgency and countdown timers. "Claim in 2 hours or lose it" is a pressure tactic. The real payout has no claim deadline because there is no claim to file.
6. Verify the amount, not just the message. If you were affected, check whether a payment already arrived at your original address on-chain. A message claiming a refund is not a refund; a transaction is.
7. Report fakes instead of forwarding them. Report the fake domain or account on the platform where you saw it, and warn friends with the official status page link — not a screenshot of the scam, which can itself spread the fake address.

Is Polymarket safe to use now?

The honest answer has two halves. On the incident itself, Polymarket did most of what a good response looks like: it acknowledged the problem within about half an hour, froze trading to contain it, removed the malicious script within the hour, reset every session, referred the case to law enforcement, resumed trading only after the site was clean, and paid victims in full — plus halt losses — directly and quickly. Traders who were affected are, with 37 verifications pending, essentially whole.

If you are new to prediction markets entirely, start with the basics before you trade a dollar: our guide to what Polymarket is and how crypto prediction markets work explains how shares, prices, and settlement actually function, so you can tell a market mechanic from a scam narrative. And if you want the wider security picture from the same brutal week, read how the FBI traced the far larger Binance theft in our coverage of the FBI naming North Korea in the $6.3 billion Binance hack — the contrast between a $6 billion state-linked theft and a $2.7 million vendor-script theft tells you how wide the threat landscape now is.

For the practical side, see the best crypto wallets for beginners and how crypto wallets actually work: a hardware wallet kept offline cannot be drained by a script running in a browser tab.

Frequently asked questions

Was Polymarket hacked?

Yes, in the website layer. A malicious script replaced a DebugBear page-speed script loaded by Polymarket.com, and it drained about $2.7 million from 726 trader wallets on October 29, 2026. Polymarket's smart contracts were not breached, and its separate US platform was not affected.

Will I get a refund if my Polymarket wallet was drained?

If your wallet was among the 726 affected, Polymarket promised full reimbursement paid directly on-chain to your original address. By October 30, 689 wallets had been refunded in full and the remaining 37 were being paid as each was verified. You do not need to file a claim to receive it.

Do I need to connect my wallet or sign anything to claim the refund?

No. That is the key scam filter. Polymarket pays directly to original addresses and asks users to connect to no third-party dashboard and sign no new allowance. Any site asking you to connect or sign to "claim" a refund is fraudulent.

What about losses from the trading halt?

Polymarket is also paying about $1.19 million to roughly 5,500 wallets that lost money during the trading pause or had positions taken while the exchange was in cancel-only mode. Combined with the $2.7 million drained, the total restitution package is about $3.9 million.

Is Polymarket trading back online?

Yes. After removing the script, clearing caches, and resetting all login sessions, Polymarket restored full trading on its international platform. The incident happened days before the November 3 US midterm elections, when prediction-market volume is expected to be very high.

How can I protect myself from the next supply-chain attack?

Keep only small trading balances in any hot wallet connected to a website, store long-term holdings offline in a hardware wallet, never sign an unexpected token approval, never share a seed phrase, and start from official status pages rather than links in social posts. Assume any single website session can turn hostile, and set your setup up accordingly before an incident, not during one.

Conclusion

The Polymarket hack is a small theft with a large lesson. About $2.7 million vanished in under an hour not because a blockchain broke, but because a website trusted a third-party script that had itself been compromised. The platform's response — fast containment, full direct refunds to 689 of 726 wallets within about a day, plus $1.19 million for halt losses — is about as good as incident response gets in crypto. And yet the most dangerous part of the story may still be ahead: the fake refund portals already spreading in the payout's wake, aimed at traders who are anxious, in a hurry, and one click away from handing a scammer the keys.

Remember the one rule that cuts through all of it: the real refund comes to you, on-chain, to your original address, with no claim, no connection, and no signature. Anything that asks for more is not the refund. It is the second hack.

Sources: The Hacker News coverage of the DebugBear script compromise, Crypto-Economy on the $3.9 million refund package, and Stocktwits on the weekend refund update.