Polymarket promises full compensation after $2.7 million theft: victims with losses over $10,000 must sign a release agreement and complete KYC

Author: TechFlow

TechFlow Editor's Note:The leading decentralized prediction market platform Polymarket has just faced a severe security and public-relations test. On October 30, the platform's international site was breached due to a third-party service provider vulnerability, causing more than 710 wallets and approximately $2.7 million in funds to be stolen, forcing the platform to suspend trading and initiate post-incident response.

Although the platform publicly promised full compensation for victims, the subsequent execution details stirred significant controversy in the community. Retail users with losses below $10,000 can receive refunds directly through the original path, while large-loss victims must first sign a legal release document and submit verified identity proof to recover assets.

The gap between verbal full compensation and written release agreements exposed the compliance defense instinct of Web3 flagship projects when responding to sudden crises. The tug-of-war over settlement terms and privacy concessions is subjecting the decentralized prediction giant's credibility to the market's harshest scrutiny.

International site hacked, assets stolen: abnormal transfer of $2.7 million in funds

Asreported by CNBC, it was disclosed that the world's largest decentralized prediction platform Polymarket's international site suffered a sudden outage after a malicious hacker breached its cooperating third-party technology service provider, causing some liquidity and accounts to be illegally accessed.

On-chain security monitoring data showed that the attack affected more than 710 trader wallets, with approximately $2.7 million in token assets transferred without authorization. The platform immediately suspended trading on the international site, filed a report with law enforcement, and specifically clarified that the US domestic compliance site was unaffected.

As a phenomenal protocol this year alongside global political elections and macro events, Polymarket's sudden crisis instantly triggered market turbulence. Facing impaired liquidity and a trust crisis, the platform quickly issued a statement publicly promising to use its own reserves to ensure full recovery of losses for affected users.

Compensation plan draws a line: instant small refunds and high thresholds for large claims

However, as specific execution details leaked, the so-called full compensation was not an indiscriminate one-click restoration. Sources and affected traders revealed that the platform set a clear $10,000 threshold based on loss amount, implementing two very different dual-track compensation strategies.

For the large base of small retail users with per-account losses below $10,000, Polymarket plans to return funds directly to accounts through backend verification before October 30, with a very simple process. But for large victims with losses exceeding $10,000, the compensation process is attached with strict legal preconditions.

The platform requires large traders to fully sign a settlement and release agreement (Release Agreement), explicitly waiving all future legal rights to seek civil compensation or file lawsuits against the platform over the incident before entering the fund return channel, creating a clear tiered disparity.

KYC threshold and release controversy: victims question unfair legal terms

This conditional compensation mechanism quickly ignited strong dissatisfaction in the crypto community. Multiple large traders shared screenshots of signing the agreement on social media, accusing the platform of verbally promoting full compensation while actually using contracts to coerce victims into surrendering legal recourse rights, which is equivalent to signing a forced settlement receipt.

Even harder for users to accept is that some large holders were also forced to upload passports or personal identity documents (KYC) when signing the agreement. For traders accustomed to non-custodial on-chain anonymity, being forced to surrender privacy data after suffering fund losses constitutes a double psychological blow.

So far, Polymarket's official Twitter account has only maintained a verbal reassurance tone and has not disclosed the full legal contract text to the public. This lack of transparency in information disclosure has further intensified widespread doubts about hidden clauses in the agreement that favor platform liability waivers and exculpation.

Rebuilding trust and compliance boundaries: a governance test for the prediction market leader

Polymarket's response strategy vividly reflects the typical legal defense pattern of fast-expanding crypto giants when facing external attacks. Confronting potential class-action lawsuits and regulatory accountability, the company prioritizes direct small refunds to stabilize the vast majority of retail users while building legal firewalls to block large-claim loopholes.

But such commercial defense operations are causing irreversible erosion of its decentralized brand consensus. When an on-chain prediction market that touts trustlessness faces a black swan event, it still displays the traditional Wall Street-style blame-shifting and liability-waiving logic, making grassroots users' faith inevitably suffer a severe blow.

As the election-trading frenzy moves into deeper waters, striking a balance between protecting the platform's commercial security and honoring the spirit of pure on-chain contracts has become an unavoidable issue for Polymarket. This $2.7 million controversy may serve as a stern warning before it moves toward mature compliance.

Source: TechFlow