Polymarket Refunds $3.9 Million After a Rogue Script Sold User Positions

Polymarket has put a price on its October 29 mess. Total refunds land at $3.9 million, split between $2.7 million tied directly to the attack and another $1.2 million for losses caused by the trading pause. As of the afternoon of October 30, the company says 95% of affected wallets had been made whole.

Here's what matters: the entry point wasn't the chain. A third-party performance-monitoring script, the kind of thing that loads on half the internet, got compromised and used live user sessions to sell positions and move funds. Polymarket's response was blunt and fast. Pull the script, clear caches, reset sessions, halt trading and relayer activity.

That 95% is a timestamp, not a live rate. Treat it as a company report from a specific moment, not proof that every disputed balance is settled.

The $1.2 million pause bucket deserves more attention than it's getting. In a market tied to a time-sensitive outcome, freezing trades creates a second class of victim. Your wallet never got drained, but your position settled or repriced while you couldn't touch it. Paying those people requires a defined reference point. Which timestamp, which size, which valuation method. Without that discipline, a refund headline quietly hides an argument.

What the street is missing: subresource integrity checks help, and browsers can refuse a script whose hash doesn't match. But that only tells you the file wasn't swapped. It says nothing about whether the approved code was safe to run with session access in the first place.

So the durable test isn't the refund. It's the replacement control system. Which scripts still hold privileges, how code changes get reviewed, how fast abnormal flows get flagged. Refunds fix the ledger. Controls fix the next incident.

Until Polymarket publishes verified, wallet-by-wallet reconciliation and a clear account of who retains script access, I'd keep my conviction on the controls, not the check.