Polymarket Hack Refund Tax: Is the Refund or Forced Sale Taxable?

On October 29, 2026, a compromised third-party script on polymarket.com used traders' logged-in sessions to sell positions and move funds out of their wallets. Polymarket's postmortem says it "is returning $3.9M total." Each affected wallet now shows three things: sells the owner never placed, an outflow to the attacker, and a refund coming back in. That is the Polymarket hack refund tax problem victims are trying to sort out before year end.

I'm Chris Herbst, Managing Director at CountDeFi, a global crypto tax reporting firm specializing in complex cryptocurrency and DeFi reconciliations. I am a Chartered Business Accountant in Practice, CBAP (CIBA), with the Chartered Institute for Business Accountants, and a General Tax Practitioner, GTP (SAIT), with the South African Institute of Taxation. Since 2017, our team has rebuilt wallet histories after drains and exploits and has reconciled prediction-market activity, including Polymarket smart-wallet data, for clients' returns.

This guide is for anyone whose Polymarket wallet was drained, or who received pause compensation, after the October 29 incident and needs to report it correctly.

What happened in the Polymarket hack on October 29, 2026?

On October 29, 2026, someone replaced a third-party vendor script on Polymarket's international site with a malicious version. It used active login sessions to sell positions and move funds out of the wallets of users who had the site open during a short window. Polymarket says its smart contracts were not exploited. The status page posted "unauthorized activity affecting user wallets" at 5:38 PM UTC and marked the incident resolved at 6:06 PM UTC. Polymarket has not named the vendor. This was its second vendor-script breach of 2026: in the June 25 incident, about $3M was drained from fewer than 15 accounts.

• Scale. The postmortem puts the drain at $2.7M. Polymarket counts 726 affected wallets. Betting Intelligence and Polysights estimated 710. Bitquery counted 737 accounts and 985 withdrawal transactions between 17:10 and 18:10 UTC.
• Collateral. Polymarket's docs say it "uses pUSD (Polymarket USD) on Polygon as collateral for all trading," so the drained balances were pUSD, not USDC.
• Scope. Polymarket US, the separately operated US product, was reported as unaffected.

What does Polymarket say the refund covers?

Positions sold or moved are paid "at their value when taken, including slippage." Traders who lost value during the trading pause get the difference from their value at the pause. The $3.9M is "the $2.7M plus $1.2M to cover pause-related losses," and no claim is needed. Polymarket also posted on X, as reported by Crypto Economy:

• $1.19M went to 5.5K wallets for the downtime.
• 689 of 726 wallets were refunded in full by the morning of October 30.
• Payments go "directly on-chain to original user addresses."

Bigger losses follow a different process. TokenPost and CNBC reported a Polymarket Discord message saying that users who lost more than $10,000 must sign a release before they are reimbursed. That threshold is not on Polymarket's status page.

Is the Polymarket hack refund taxable?

For a US taxpayer, the refund is generally a tax-free recovery of stolen property up to your basis in what was taken. Only the part above that basis is a taxable gain. IRS Publication 547 states it directly: "If your reimbursement is more than your adjusted basis in the property, you have a gain." The refund replaces property you already owned, either the stolen pUSD or the positions, so it is not new income. Our guide to crypto taxable events explains the difference.

When does part of the refund become a gain?

Part of the refund is a gain when it exceeds your basis in the stolen property. The slippage top-up is the most likely source.

• If the stolen asset is pUSD, its basis is roughly what the forced sale produced. The refund pays "value when taken, including slippage," which can be a little more than that.
• If the stolen asset is the outcome tokens, the gain is the refund minus what you paid for the shares.

Polymarket has not published a per-wallet breakdown of position value versus slippage.

Did the attacker's sale of your Polymarket positions count as your own disposal?

No IRS ruling or court case addresses whether a sale made by an attacker through a hijacked Polymarket session counts as your own disposal. That leaves two defensible positions, and the total gain comes out similar under both. They differ in three ways:

• how many reporting events you have,
• whether you can elect to defer the gain,
• whether your return shows a sale you never placed.

Position 1: the sale was yours, then the pUSD was stolen

The sell order ran in your own wallet, against your own outcome tokens, and pUSD landed in your wallet before it was withdrawn. On this view you realize gain or loss on the sale: proceeds minus your basis in the shares. Then the pUSD, with a basis close to those proceeds, was stolen. The refund reimburses that pUSD, so the only extra gain is any slippage top-up.

Position 2: the whole sequence was one theft of your positions

You never chose to sell; the thief did. Publication 547 defines theft as "the taking and removing of money or property with the intent to deprive the owner of it." On this view the outcome tokens are what was stolen, and your gain is the refund minus your basis in them.

• Where it goes. Report it in Form 4684 Section B, which covers income-producing property "held for investment, such as stocks, notes, bonds." A net long-term gain carries to Schedule D, line 11.
• Deferral. Section 1033(a) lets you elect not to recognize gain if you replace the property with property "similar or related in service or use" within the replacement period. The IRS has not said whether new prediction-market positions pass that test.

What if your outcome tokens were moved rather than sold?

If the attacker moved your outcome tokens out without selling them, there was no sale, so only Position 2 fits. Polymarket describes the affected holdings as "positions sold or moved." Moved positions leave no TRADE row in your activity history; they show up only as ERC-1155 transfers on Polygonscan.

Can you claim a theft loss for the Polymarket hack if you were refunded?

No. You generally cannot deduct any part of a Polymarket hack loss that was refunded, because the tax rules treat a loss covered by a likely reimbursement as never having happened. Section 165(a) allows a deduction only for losses "not compensated for by insurance or otherwise."

Why is there nothing to deduct?

Under Treasury Regulation 1.165-1(d)(2)(i), when a reimbursement claim has a reasonable prospect of recovery, "no portion of the loss with respect to which reimbursement may be received is sustained" until the outcome is reasonably certain. Regulation 1.165-1(d)(3) applies that rule to theft losses, which Section 165(e) otherwise places in the year you discover them. Here the theft and the refund fall in the same tax year, and the refund claim existed from day one. So the covered portion never becomes a deduction, and the refund has nothing to reverse. Regulation 1.165-1(d)(2)(iii), which treats a later reimbursement as income "subject to the provisions of section 111," only comes into play if someone took the deduction first. For a theft with no refund, where the deduction question is live, see our Coldcard hack guide.

Is it a casualty loss or an investment theft loss?

It is an investment theft loss under Section 165(c)(2), which covers losses "incurred in any transaction entered into for profit."

• In CCA 202511015, released March 14, 2025, IRS Chief Counsel put profit-motivated scam losses under that section and measured the loss as the victim's basis in the stolen property.
• Personal losses under Section 165(h)(5)(A) are allowed only if they come from a declared disaster. Pub. L. 119-21 made that limit permanent for taxable years beginning after December 31, 2025.
• Form 4684 Section C does not apply. It is reserved for the Ponzi safe harbor under Rev. Proc. 2009-20.

What if your refund fell short of what was taken?

A shortfall below your basis can become a deductible investment theft loss, but only in the year it becomes reasonably certain that no more reimbursement is coming. A settlement, a court decision or abandoning the claim establishes that. A shortfall you are still disputing through Polymarket's dispute form is not a loss yet.

How is Polymarket's pause compensation taxed?

No published guidance addresses the pause compensation paid to the 5.5K wallets that were not drained. The strongest reading treats it as extra proceeds on the affected position, with the same character as that position. The origin-of-the-claim test asks what a payment replaces, and here that is value lost while the market was frozen. Polymarket calls these payments "goodwill refunds," which leads some practitioners to treat them as ordinary income. Under the gambling view they could be a wagering gain instead.

What if your market resolved during the pause?

If your market resolved while trading was halted, or you sold right after it reopened, treat the payment as extra redemption or sale proceeds on that position. Polymarket has not published its per-position "value at the pause" figures. Keep the payment's transaction hash with the resolution or sale record.

Does signing the Polymarket release form change the hack refund?

Signing Polymarket's release for losses above $10,000 generally does not change the refund's character, because a payment for releasing claims takes the character of what it replaces, here stolen property. The release does settle the timing, though.

What does the release reportedly say?

According to KuCoin News, citing BitPush, it is a "Release Agreement" that "explicitly waives all legal rights to pursue civil compensation." It also reports that Polymarket "has not disclosed the full contract to the public." Users who shared the terms reportedly saw a broad non-disparagement clause.

Could a non-disparagement clause make part of the refund taxable?

In theory, yes. The IRS could argue that part of the payment buys the promise not to disparage, and that part would be ordinary income. Secondary summaries of Amos v. Commissioner, T.C. Memo. 2003-329 say the Tax Court assigned $80,000 of a $200,000 injury settlement to a confidentiality provision and taxed that portion. That reasoning has never been applied to a refund of stolen property. If the release assigns any amount to the clause, talk to a specialist before you sign.

What if you have not signed or are still waiting?

While your claim is open, no loss is sustained, so there is no 2026 deduction for the covered amount even if payment slips past December 31, 2026. Signing the release settles the claim. Refusing to sign and abandoning the claim makes the loss deductible in the year you abandon it. The same rules apply to the 37 wallets Polymarket said it is paying as each one is verified.

Do prediction-market rules change the Polymarket hack refund tax answer?

They can. Thomson Reuters Checkpoint reported on June 16, 2026 that the IRS "has not addressed prediction market contracts," and how your positions are classified affects everything above. This guide assumes they are capital assets. Our guide to prediction market taxes covers the alternatives.

What changes under the gambling view?

If the positions are wagers, the forced sale may be a wagering transaction. OBBBA Section 70114 amended Section 165(d) so that, for tax years beginning after December 31, 2025, only 90% of wagering losses are deductible, and only against wagering gains. No rule says how the theft of a wager position is treated.

Does Section 1256 apply?

Secondary sources call Section 1256 the weakest case for the international site, since it is not a designated contract market. The CFTC's January 3, 2022 order found that Blockratize, Inc. d/b/a Polymarket offered event-based binary options without DCM or SEF registration and imposed a $1.4 million civil monetary penalty. Our Section 1256 explainer covers why that designation matters.

Where does Polymarket reporting break down after the hack?

Polymarket reporting breaks down because the forced sells look like ordinary trades, a default export leaves out the theft, and the refund comes with no tax form. You have to rebuild the record from the API and Polygon chain data.

Does Polymarket issue tax forms?

Polymarket has not said it will issue Form 1099-B, 1099-DA or W-2G for the international site, and third-party guides such as Polymarket Index say it issues none. Under the Form 1099-DA instructions, brokers must report gross proceeds from 2025 and basis for covered securities from 2026. Here, though, nothing reported to the IRS will match your figures automatically.

Why do the forced sells look like your own trades?

In the Data API's /activity feed, the attacker's sells show up as TRADE rows with side SELL and a transactionHash. Nothing marks them as the attacker's. You have to match them to the 17:10 to 18:10 UTC window and to the WITHDRAWAL rows that followed. The documentation does not say what activity type the refund transfers use.

What does the API leave out by default?

• excludeDepositsWithdrawals defaults to true, so a default export leaves out the theft. Set it to false.
• limit maxes out at 500 and offset at 5000, which can cut off a heavy trader's history.
• /closed-positions does not return initialValue, so basis has to come from the original BUY rows or from grossInitialValue in /positions. See our guide to missing cost basis.
• Outcome tokens have no public price feed. Polymarket's "value when taken" is its own calculation.

Which address holds the records?

Your Polymarket records sit on the trading address, which is a smart wallet, not the MetaMask, Rabby or Magic signer you log in with. According to Polymarket's wallet docs, the trading address is one of these:

• a Deposit Wallet, the default for wallets deployed on or after May 4, 2026,
• a legacy Proxy Wallet,
• a legacy Safe.

Polymarket has not said which wallet types were affected.

How do you rebuild your Polymarket records so the hack isn't reported twice?

To avoid double reporting, choose one position on the forced sales and tag the sell, the outflow and the refund as one linked event. Wallet-sync tools import the sell as a disposal, the pUSD outflow as a transfer and the refund as possible income, which counts the same event more than once.

1. Find your smart-wallet trading address, not your signer.
2. Export /activity with excludeDepositsWithdrawals set to false, paging through the limit and offset caps.
3. Isolate the October 29 rows between 17:10 and 18:10 UTC and pair each SELL with the attacker WITHDRAWAL it funded.
4. Check Polygonscan for ERC-1155 transfers out, to catch positions that were moved rather than sold.
5. Pull basis from the BUY rows or grossInitialValue.
6. Find the refund inflow and any pause compensation, and save the postmortem and your correspondence with Polymarket.

How do you tag it under Position 1?

Keep the forced sell as a disposal. Tag the pUSD outflow as theft and the refund as a reimbursement, not income. Only a refund above the stolen pUSD's basis shows as gain.

How do you tag it under Position 2?

Ignore the forced sell and the matching outflow. Report one theft conversion of the outcome tokens, with the refund as proceeds and your original cost as basis. A Koinly accountant review can confirm that ignoring those rows did not leave stray balances.

How is the Polymarket hack refund taxed outside the US?

Outside the US, the refund is more likely than the theft to be the taxable event. The UK and Canada treat compensation for stolen property as disposal proceeds, and Australia requires compensation to reduce any capital loss. Polymarket's geoblocking FAQ lists the UK, Germany, Australia, British Columbia, Ontario, Alberta and Quebec as "close-only," so affected residents there were typically closing older positions.

United Kingdom

HMRC's CRYPTO22450 says "HMRC does not consider theft to be a disposal" and "Victims of theft cannot claim a loss for Capital Gains Tax." But under CG12948, receiving a capital sum as compensation is a deemed disposal under section 22(1)(a) of the Taxation of Chargeable Gains Act 1992. That makes the refund the likely chargeable event. If you use the money to replace the asset, section 23 relief may apply on a claim. HMRC has not said whether prediction-market positions count as bets outside Capital Gains Tax. Our SA108 guide shows where the figures go.

Canada

Section 54 of the Income Tax Act defines proceeds of disposition to include "compensation for property unlawfully taken." So the refund counts as proceeds from disposing of the stolen positions or pUSD, measured against your adjusted cost base. CRA has not published guidance on a hack refund paid by the platform itself. See our guide to choosing a crypto tax accountant in Canada.

Australia

The ATO's loss or theft page allows a capital loss on stolen crypto "if you can provide evidence of ownership," and says compensation means "you must reduce your capital loss by the amount you receive." A full refund leaves no loss. An Australian crypto tax agent can help with how the positions themselves are classified.

Germany

The BMF letter of March 6, 2025 (IV C 1 - S 2256/00042/064/043) treats crypto as "andere Wirtschaftsgüter" under Section 23(1) sentence 1 no. 2 EStG. No published BMF, BFH or FG source addresses whether a hack is a "Veräußerung" (sale), and NWB commentary notes the term is read narrowly. Guides such as Blockpit's put Polymarket winnings under Section 22 no. 3 EStG but describe that as unsettled. A German crypto tax specialist should confirm your position.

What are the most common Polymarket hack refund tax mistakes?

The most common mistake is accepting the wallet-sync import as it is, which reports the forced sale and then taxes the refund as income on top of it.

Reporting the refund as income

Up to your basis, the refund is a recovery. Tagging it as a reward adds income for a loss you were already made whole on.

Deducting a loss that was refunded

Claiming the drained amount on Form 4684 contradicts Regulation 1.165-1(d), because the covered portion was never sustained.

Mixing the two positions

Keeping the forced sell as your disposal while also reporting the refund as theft proceeds counts the gain twice. Pick one position per wallet.

Working from the wrong address or a default export

Pulling records from the signer address, or exporting without withdrawals, drops the theft and leaves a sale in your records with no explanation.

Do You Need Help With Polymarket Hack Refund Tax?

Help is worth it if your Polymarket wallet shows forced sells, moved tokens, pause compensation or a release claim, because each one has to be matched to chain data and reported under one consistent position. A prediction market tax accountant starts from the smart-wallet address, not the signer.

CountDeFi Is Your Polymarket Hack Reporting Solution

We are not just accountants at CountDeFi, we are data scientists who work exclusively on crypto. We have worked with more than 1,000 clients globally since 2017. We rebuild Polymarket histories from the Data API and Polygon and link each forced sell to the attacker withdrawal and the refund, so the event is counted once. If the October 29 incident hit your wallet, book a free call with one of CountDeFi's crypto tax specialists.