Polymarket to reimburse customers following security breach
Prediction market operator Polymarket has committed to reimbursing customers approximately $3.9 million following a security breach that allowed attackers to access trading accounts through a compromised third-party service.
The incident occurred on October 29 and affected the company’s international trading platform, with Polymarket confirming the following day that approximately $2.7 million had been taken from customer wallets.
A further $1.2 million will be paid to compensate traders affected by losses associated with the temporary suspension of trading.
The company said attackers had compromised a third-party performance-monitoring script used on its website.
Malicious code subsequently exploited active customer sessions to sell trading positions and transfer funds without authorisation.
Polymarket temporarily suspended trading, removed the compromised software and reset active login sessions.
The company confirmed that 95% of affected wallets had been fully reimbursed as of its October 30 update.
Polymarket said it was strengthening security controls around third-party software, including additional monitoring and verification measures.
The incident has also been referred to law enforcement.
Reuters identified website monitoring company DebugBear as the third-party provider involved.
The breach affected Polymarket’s international cryptocurrency-based platform, rather than its separately operated US-regulated exchange.
The incident raises further questions about cybersecurity protections at prediction market platforms as their popularity continues to increase.
