# Polymarket reports refunds after a vendor compromise.

> Polymarket removed the script, paused trading and the relayer, reset sessions, and reopened trading.

- URL: https://riadefi.com/on-chain/2026-10-30-polymarket-vendor-compromise/
- Type: Security incident
- Stage: Postmortem
- Evidence: confirmed
- Materiality: material
- Event date: 2026-10-30
- Version: 1, published 2026-10-31 (first published 2026-10-31)
- Follow-up: 2026-11-02
- Advisor-relevant: yes
- Affects: Polymarket International (protocol)

## What happened

Polymarket reported on October 30, 2026, that an attacker replaced a vendor’s script and used active sessions to sell positions and withdraw funds.

## What changed

Polymarket removed the script, paused trading and the relayer, reset sessions, and reopened trading.

## What did not change

Polymarket’s reimbursement announcement establishes no change to settlement or redemption terms.

## Confirmed

- Polymarket reported full refunds for 95% of affected wallets.
- Polymarket announced $3.9M in refunds, including $1.2M for losses related to the pause.

## Still open

- Completion of all refunds remains unconfirmed.

## What it means for an advisor

- Ketju should review the Polymarket memo’s account-security findings and confirm reimbursement for any affected holding.

## Sources

1. [Security incident - 3rd party vendor compromised](https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj) · Polymarket · 2026-10-30


---

Published by Ketju Research on RIADeFi (https://riadefi.com). Educational research for financial professionals; not investment, legal, tax, or compliance advice.