Polymarket's post-mortem of last week's wallet-draining compromise commits US$3.9 million to victims — US$2.7 million covering the initial theft of positions and funds, plus US$1.2 million for losses tied to the platform's hours-long shutdown — with the company saying "no claims or tickets needed" because eligible wallets were identified from on-chain and trading data; 95 per cent of affected wallets were refunded in full as of Saturday. The incident stemmed from a compromised performance-monitoring script loaded from vendor DebugBear, which used users' active sessions to sell positions and move funds before Polymarket removed it, paused trading and reset all sessions. DebugBear's own follow-up says the compromise began at its domain registrar and targeted a specific customer's website. The restitution total is an escalation of the US$2.7 million figure reported on 31 October–2 November, and lands the same day ASIC warned Australians that offshore prediction-market products carry no Australian legal protections — a sector now worth a reported US$40 billion at Kalshi's latest valuation.

• Source article