{
  "curatedUTC": "2026-10-31T02:55:18.578930+00:00",
  "claim": "Polymarket publishes two distinct notices for the October29attack, covering different service components. Their timing must not be collapsed into a single attack-duration claim.",
  "notices": [
    {
      "source": {
        "name": "polymarket-incident-primary",
        "URL": "https://status.polymarket.com/cmvtuswgi00221bkzps7w21pt",
        "UTC": "2026-10-31T02:52:25.566520+00:00",
        "HTTP": 200,
        "finalURL": "https://status.polymarket.com/cmvtuswgi00221bkzps7w21pt",
        "bytes": 135514,
        "SHA256": "12e4acf872f2627c63eff24318d3461ab4d693884f739ae1254df91d673a6b4c",
        "file": "polymarket-incident-primary.source"
      },
      "title": "Exchange cancel-only / relayer actions paused",
      "affectedComponents": [
        "Predictions",
        "Predictions Trading API (CLOB)"
      ],
      "noticeWindowUTC": {
        "start": "2026-10-29T18:05:00Z",
        "end": "2026-10-29T19:05:00Z"
      },
      "updatesUTC": {
        "investigating": "2026-10-29T18:05:00Z",
        "identified": "2026-10-29T18:37:00Z",
        "monitoring": "2026-10-29T18:55:00Z",
        "resolved": "2026-10-29T19:05:00Z"
      },
      "paraphrase": "Trading and relayer actions were paused. The18:37update reports a compromised third-party provider, a fix, referral to law enforcement and planned reimbursement. The19:05update closes this service incident."
    },
    {
      "source": {
        "name": "polymarket-oct30-postmortem-primary",
        "URL": "https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj",
        "UTC": "2026-10-31T02:52:53.181954+00:00",
        "HTTP": 200,
        "finalURL": "https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj",
        "bytes": 149555,
        "SHA256": "9ab54a72a6ea7c93c34384bdf06c8cfbc82edcc3991c403d22b19335be28ec65",
        "file": "polymarket-oct30-postmortem-primary.source"
      },
      "title": "Security incident - 3rd party vendor compromised",
      "affectedComponents": [
        "Polymarket Web App",
        "Account Access & Authentication"
      ],
      "headerWindowUTC": {
        "start": "2026-10-29T17:38:00Z",
        "end": "2026-10-29T18:15:00Z"
      },
      "componentOutageWindowUTC": {
        "start": "2026-10-29T17:38:00Z",
        "end": "2026-10-29T18:06:00Z"
      },
      "componentOperationalTailUTC": {
        "start": "2026-10-29T18:06:00Z",
        "end": "2026-10-29T18:15:00Z"
      },
      "updatesUTC": {
        "identified": "2026-10-29T17:38:00Z",
        "resolved": "2026-10-29T18:06:00Z",
        "postmortem": "2026-10-30T20:07:00Z"
      },
      "postmortemParaphrase": "Polymarket attributes the attack to a replaced performance-monitoring script that used active sessions to sell positions and transfer funds. It says it removed the script, cleared caches, paused trading and relayer actions, reset active sessions, and is adding script-integrity controls. The vendor is not named in this notice. Polymarket says95%of affected wallets across drained and goodwill categories were fully refunded as of that afternoon. It reports$3.9Mreturned:$2.7Mplus$1.2Mfor pause-related losses, with eligibility identified automatically from chain and trading data. The notice supplies no recipient wallet list, reimbursement transaction hashes or attacker identity."
    }
  ],
  "interpretationLimits": [
    "Different component notices can have different outage windows. These records do not themselves explain every timeline discrepancy or establish a last malicious transaction timestamp.",
    "A later transfer into a tracked attacker address is not by itself evidence that the original website compromise remained active.",
    "The primary postmortem does not publish726affectedwallets or689repaidwallets. Those numbers appeared in secondary reporting and are not imported here.",
    "No Car-to-attacker relationship is identified in either notice."
  ],
  "verbatimWordsReproduced": 0
}