Polymarket users who had the site open during a short window on October 29 watched their positions get sold and their funds leave their wallets without doing anything themselves. The Polymarket hack did not start inside Polymarket.

It came through a small piece of code from an outside company that loaded on every visit to polymarket.com. The cryptocurrency-based prediction market now says it is returning $3.9 million to affected traders.

How the Polymarket Hack Worked

In a post-mortem published on October 31, Polymarket said a third-party vendor whose performance-monitoring script ran on polymarket.com had been compromised. The attacker swapped the vendor’s legitimate code for a compromised script built specifically to target Polymarket users.

The attacker did not need anyone’s password. For users who had the site open at the time, the malicious script used their active session to sell positions and move funds out of their wallets. Anyone logged in and browsing during that window was exposed. The vendor has publicly confirmed the compromise.

Polymarket’s status page first reported “unauthorized activity affecting user wallets” on October 29 and marked the incident as resolved later that day.

Who Was the Vendor Behind the Polymarket Hack?

Performance-monitoring company DebugBear released its own update on the incident. It said its initial findings point to its domain registrar as the point of entry.

“Our DNS records were compromised through our domain registrar,” the company said on X. “We are currently unable to receive emails sent to our domain. Based on our initial investigation this attack targeted the website of a specific customer.”

[caption id="attachment_115172" align="aligncenter" width="538"] Source- Twitter[/caption]

DebugBear added that it has “not seen any indication of a compromise of our internal systems,” though it is continuing to investigate.

This is the part of the story that should worry other website operators. According to the statements from both companies, the attacker appears to have gone after a vendor’s domain setup rather than Polymarket’s own systems, and used that position to put malicious code in front of Polymarket’s users. DebugBear’s own internal systems, by its account, show no sign of being breached.

How Polymarket Responded

Polymarket listed the steps it took once the attack was identified:

• Removed the vendor’s compromised script and cleared every cache.
• Paused trading and its relayer to stop further drains, then reopened once the site was clean.
• Reset all active login sessions.
• Began redeploying third-party scripts with added integrity controls and continuous monitoring, including a stronger content security policy, explicit version pinning and sandboxing.
• Referred the case to law enforcement while running its own investigation into the threat actor.

The trading pause stopped the bleeding, but it created a second set of losses for traders who were not directly hit by the script.

Where the Polymarket Hack Refunds Stand

Polymarket is returning $3.9 million in total. Of that, $2.7 million covers the initial losses from the attack, and $1.2 million covers losses tied to the hours-long shutdown.

As of its post-mortem, the company said 95% of affected wallets had been refunded in full, through a mix of reimbursements for drained wallets and goodwill payments.

The refunds cover more than drained wallets. Polymarket said it also made goodwill payments in two cases:

• Positions taken during the attack. If the script moved or force-sold a user’s positions, Polymarket will pay what they were worth when they were taken, including any slippage from the sale.
• Losses during the trading pause. If a user held a position when trading paused and it lost value because the market ended during the pause, or the user sold right after trading reopened, Polymarket covered the difference from its value at the pause.

Users do not need to file claims or tickets. Polymarket said it identified eligible wallets using on-chain and trading data. Anyone who thinks their amount is wrong, or believes they should have received a payment, can submit a form for the company to recheck.

What Remains Unanswered

Some questions are still open. Neither company has named the threat actor. DebugBear has said the attack targeted a single customer, but its investigation is ongoing, and it still cannot receive email sent to its domain. Polymarket has also not said exactly how many wallets were affected, only that 95% have been made whole.

The incident shows how much trust a website places in every outside script it loads. Polymarket’s own systems were not the entry point, yet its users still lost money, and it took a trading halt, a session reset and a removal of the vendor’s code to stop it.

Every federal bankruptcy court in the United States has lost access to the system it uses to send out bankruptcy notices. A BAE Systems cyberattack has disrupted the Bankruptcy Noticing Center (BNC), the platform that produces and transmits notices for all federal bankruptcy courts across the country.

The Administrative Office of the U.S. Courts confirmed the incident in a statement on Thursday afternoon. BAE Systems, a British multinational, operates BNC systems and websites on behalf of the Federal Judiciary. The Cybersecurity and Infrastructure Security Agency (CISA), which typically handles cyberattacks on federal agencies, referred questions to the U.S. Courts.

What the BAE Systems Cyberattack Has Taken Offline

According to the U.S. Courts, BAE Systems IT and websites that support BNC operations have been impacted by a cybersecurity incident. As a result, all access to the BNC systems and websites that BAE operates for the judiciary is currently unavailable. That includes:

• bnc.uscourts.gov
• bankruptcynotices.uscourts.gov
• notices.uscourts.gov
• the National Creditor Registration Service

The incident has also halted the BNC’s production and distribution of bankruptcy notices for the courts.

The Administrative Office said it has been in contact with the affected courts and is coordinating with BAE Systems. BAE is investigating the incident and working to restore operations. No timeline for recovery has been shared, and the nature of the attack has not been disclosed.

A Government Contractor Target, Again

The BNC disruption is the latest in a series of incidents where an attack on a government contractor or third-party vendor has spilled over into public services.

Last week, a contact center for the Federal Motor Carrier Safety Administration (FMCSA), a Department of Transportation safety agency, was temporarily taken offline after a government contractor was targeted by a cyberattack, according to two people with knowledge of the situation who were granted anonymity because they were not authorized to speak on the record.

The contact center is run by support provider Senture. The FMCSA first reported technical difficulties on social media on October 6. It remains unclear when that attack began or whether it is ongoing.

Courts Have Been Hit Through Vendors Before

In September 2026, the Kentucky Administrative Office of the Courts (AOC) confirmed that Kentucky Appellate Court data was compromised in a breach traced to a third-party vendor.

West Publishing Corporation, operating as Thomson Reuters Court Management Solutions (Thomson Reuters CMS), told the AOC that the incident originated in file systems tied to its C-Track case management platform. C-Track is used by the Kentucky Supreme Court and the Kentucky Court of Appeals to manage case records.

According to Thomson Reuters CMS, an unauthorized third party accessed and obtained court data from C-Track systems across several states, not just Kentucky. In Kentucky’s case, exposure was limited to appellate court data stored within the C-Track infrastructure.

Trial-level records that were never part of an appeal were not affected, since Kentucky does not use third-party vendors for trial court e-filing. The AOC said its appellate courts continued to operate normally throughout the incident.

Why the BAE Systems Cyberattack Matters

Taken together, the three incidents show a common thread. Courts and federal agencies increasingly depend on outside contractors to run critical systems, and when those contractors are hit, the impact lands directly on public services.

In the BNC case, a single compromised contractor has stopped a core function for every federal bankruptcy court at once. How quickly BAE Systems can restore the platform, and whether any data was accessed, remain the key open questions.

site-verification-ok