Polymarket to Refund $3.9 Million After Security Breach, Offers Additional Downtime Compensation

Prediction‑market platform Polymarket announced on Tuesday that it will return roughly $3.9 million to users who suffered losses during a security breach on Oct. 29, and will also provide supplemental payments to cover the period the site was offline.

The incident, which the company described as a “site compromise,” resulted in unauthorized access to user accounts and the temporary suspension of trading activity. Polymarket said the breach was detected quickly, but the attackers were able to move funds before the platform could lock down the affected wallets.

In a detailed post‑mortem released to the public, Polymarket’s technical team traced the root cause to a misconfigured API endpoint that allowed malicious actors to bypass authentication checks. The company has since patched the vulnerability, engaged external security auditors, and begun a comprehensive review of its infrastructure to prevent a repeat.

Under the remediation plan, every user whose balance was diminished will receive a full reimbursement of the exact amount lost. In addition, Polymarket will credit a “downtime compensation” equal to a proportion of the average daily trading volume for each affected account, aiming to offset any opportunity cost incurred while the platform was inaccessible.

Polymarket operates a decentralized prediction‑market model that lets participants wager on the outcomes of real‑world events, ranging from elections to public‑health data. The sector has attracted both enthusiastic users and regulatory scrutiny, with authorities in several jurisdictions questioning the line between gambling and financial speculation. A breach of this magnitude threatens user confidence, a critical asset for any platform that relies on trust to attract liquidity.

Looking ahead, Polymarket said it will begin processing refunds within the next two weeks, with full payouts expected within 30 days. The firm also pledged to publish regular security updates and to implement multi‑factor authentication for all accounts. Industry observers note that the company’s swift restitution effort could set a benchmark for how emerging fintech services respond to cyber‑risk, while also underscoring the growing need for robust safeguards in the rapidly expanding prediction‑market space.