Developing Polymarket Repaid the Median Victim's $171 by Friday. The Four Accounts That Lost 43 Percent Have to Sign a Release First

Editor's note: TrueEdge builds odds tools that display prediction-market prices, including Polymarket's, and earns affiliate commissions from licensed sportsbooks that compete with it.

The theft took less than an hour, and most of it is already back. On Thursday afternoon, October 29, users of Polymarket's international exchange began posting about withdrawals they had not made. Polymarket switched the platform to cancel-only, suspended its transaction relayer and said that "one of our 3rd party providers was compromised." Trading came back at 3 p.m. Eastern. By Friday morning, according to Polymarket's own post, 689 of the 726 wallets that were hit had been repaid in full.

The company's total is $3.9 million: "the $2.7M plus $1.2M to cover pause-related losses," as it told CNBC, the second figure going to roughly 5,500 wallets that lost out while trading was frozen. That is more than a lot of exchanges would have paid, and faster.

The fine print is in a Discord message. Users who had less than $10,000 taken "will have funds restored by Oct. 30." Anyone who lost more "will have to sign a release form to receive their restoration."

Who the release form is for

The loss was not spread evenly. Bitquery's analysis, cited by William M. Peaster, puts the median victim's loss at $171. Four accounts that each lost more than $100,000 made up 43 percent of the total. So the threshold does something specific: it repays hundreds of small accounts unconditionally, and attaches conditions to the handful of accounts that hold almost half the money at stake.

Those are not random users. On a market that trades about $200 million a day, by NBC's count, accounts large enough to lose six figures in an hour are the liquidity: the market makers, the size traders, the people whose resting orders make the prices on the screen worth quoting. They are also the users most likely to have a lawyer, and the most likely to say something publicly about what happened.

Our argument is that the repayment is real, and that the release form turns it into a negotiation with exactly the customers Polymarket can least afford to lose. A user made whole after a vendor failure the exchange itself introduced should not have to sign anything beyond proof of identity. Users who shared the terms overnight described ID checks and, reportedly, a broad non-disparagement clause. Polymarket has not addressed that publicly. We have not seen the document, and only one outlet has described the clause, so treat it as unconfirmed. If it is in there, the exchange is buying silence with money it already owed.

Self-custody did not help, because the attack ran through the website

Polymarket's international exchange runs on the Polygon blockchain, and its pitch has always included the idea that users hold their own assets. Thursday showed where that idea stops. According to Hudson Rock's analysis, reported by SecurityWeek, the malicious code came from a DebugBear address that Polymarket's site loaded. DebugBear is a UK company that sells website performance monitoring. The script looked for a logged-in user's trading tools and portfolio. Depending on the account type, it either sold positions and moved the proceeds, or sent position tokens straight to an address the attacker controlled.

The line in Hudson Rock's report that matters most is this one: "Its central approach is to reuse authority already available in the authenticated application." No password was stolen and no seed phrase leaked. The attacker did not need to break the blockchain. It only needed to run inside a page the user had already trusted. A Polymarket build timestamped 17:59 UTC on Thursday carries a change note removing the DebugBear script.

And this has happened before. In June, Polymarket disclosed another third-party compromise that injected a malicious script into its front end, with losses CoinDesk put at $3.1 million. Two incidents, the same kind of attack, about $5.8 million drained in four months. That is not a freak event. It is a failure mode.

The case that this is a non-story

The best version of the other side goes like this. Polymarket identified the problem within the hour, pulled the script, referred the matter to UK police, and paid back more than was stolen, including people who were not hacked but lost money in the pause. The median victim lost $171 and has it back. Release forms are normal whenever a company pays a large sum it is not legally required to pay, and asking a six-figure claimant for identification is basic anti-fraud practice, not a gag. CNBC reported that the U.S. platform, the one regulated by the CFTC, "was not compromised." And licensed sportsbooks have their own account-security problems; nobody calls them unfit for it.

Most of that is fair, and we would not tell anyone a centralised book is immune to account takeover. But the "not legally required" point cuts the other way. If the payment is voluntary, Polymarket gets to set the terms, which is exactly the problem for a user who did nothing wrong. A sportsbook licensed in a U.S. state answers to a state regulator for how it handles customer funds. Polymarket's international exchange, by CNBC's description, is not regulated in the United States at all. And the US-platform point is the strongest argument for regulation, not against this criticism: the part of Polymarket that has a federal overseer was not the part that got drained.

Why the timing matters

This happened five days before the November 3 midterms, when both Polymarket and Kalshi expect their heaviest volume of the year. Polymarket's head of global intelligence and investigations, Shana Bautista, told NBC the company is also investigating "dozens" of midterm-related bets. Dan Zimmermann of Betting Intelligence told CNBC the breach was "certainly a wake up call for folks."

Here is what we do not know. We do not know how DebugBear's script was altered; Hudson Rock says it has not determined that. We do not know whether the 37 wallets still unpaid on Friday morning include the four large ones, or whether any of their owners have refused to sign. And we do not know the release's wording.

What would change our view is simple. If Polymarket publishes the release and it is limited to identity checks and a waiver of claims over this incident, the criticism above shrinks to a quibble. If it includes a non-disparagement clause, the users who were hurt most will have been paid to stop talking about it, days before the exchange's biggest week.

Betting involves risk of loss. If gambling stops being fun, the National Problem Gambling Helpline is 1-800-522-4700.