Polymarket to refund $3.9 million after script compromise

Polymarket will return $3.9 million to users after malicious code delivered through a compromised DebugBear monitoring script used active sessions to sell positions and move funds, the prediction market said in a postmortem. The incident occurred on October 29, when the script loaded on Polymarket’s website was replaced with code that targeted signed-in users. Polymarket said the attacker used access within active sessions to sell positions and transfer funds. The company said about $2.7 million of its compensation would cover initial losses, with another $1.2 million for losses associated with a trading shutdown. Polymarket said it identified 726 affected wallets. By October 30, it reported that 689 had been fully refunded, while the remaining 37 were being checked and paid. The company also said it would compensate about 5,500 wallets for losses related to the shutdown or positions taken during it. Users do not need to submit claims, though Polymarket directed people who dispute their payment calculations to contact the company. Blockchain tracing by Ohey recorded inflows to the collecting wallet between 17:10 and 18:02 UTC on October 29. The wallet received 28.6 million...