Polymarket Completes 95% Refund for Affected Wallets Following Security Breach
Written with artificial intelligence.
Polymarket has announced that it has fully refunded 95% of the wallets impacted by a recent security breach involving external scripts. The total compensation amount is projected to be $3.9 million, covering both direct losses and trading interruptions.
Overview of the Incident
Polymarket has reported that it has completed full refunds for 95% of the wallets affected by a breach involving external scripts. The total compensation expected, which accounts for both direct losses and trading interruptions, is approximately $3.9 million.
Compensation Breakdown
The compensation includes $2.7 million for the amount stolen and an additional $1.2 million for losses related to the trading interruption. Polymarket clarified that these two figures represent separate categories of compensation: direct losses and losses due to the trading halt.
Refund Process
The affected wallets were identified using on-chain records and the company's trading data. Polymarket stated that no separate application is required for refunds. The 95% figure refers to the percentage of wallets that have received full refunds, not the percentage of total victims or total losses.
Security Measures Taken
The breach occurred by exploiting active login sessions of users who had kept the Polymarket website open. This was facilitated by a third-party performance monitoring script that had been compromised. In response, Polymarket removed the problematic script and temporarily halted trading and relay services, subsequently resetting login sessions before resuming operations. According to Bitquery, around $2.73 million was withdrawn from 737 accounts during the attack, which occurred between 2:10 AM and 3:10 AM on October 30.
Context of the Breach
While Polymarket dealt with this incident, Binance reported a separate, large-scale asset theft on the same day, with estimates of around $6.3 billion affected. The FBI has linked the Binance incident to North Korean cyber activities. However, no evidence suggests a connection between the two breaches.