The company said the attack began at 2:07 a.m. ET on Oct. 26. The compromised wallet normally created and resolved some markets automatically; the attacker used it to buy positions, declare those positions winners and claim payouts. Myriad said it revoked the wallet’s administrative rights within minutes of being notified of suspicious activity.
The distinction matters because Myriad’s normal settlement rules value winning shares at $1 and losing shares at zero. Control over resolution therefore determines which traders can redeem their positions.
BscScan records show repeated purchases, administrative resolutions and winnings claims from the wallet beginning `0xAE7B` and ending `Ed773Ed9D`. For example, a successful administrative transaction resolved market 105144, which Myriad’s API identifies as the OpenAI-versus-Anthropic IPO market. A subsequent winnings claim transferred about 11,609 $USDT from the market contract to that wallet.
Later, a sale transaction returned about 11,715 $USDT to the same wallet, followed by a transfer of that amount to another address. Myriad said it unwound the attacker’s final large purchase and moved funds to wallets it controlled.
The company attributed the key exposure to a vulnerability in an unnamed third-party library used by a backend service, saying the exposure occurred several weeks earlier. It said the compromised wallet no longer has any privileges.
Refunds Replace the Forced Outcomes
The affected markets include bets on Base launching a token in 2026, the U.S. midterm elections, crypto and commodity prices, and George Russell winning the 2026 Formula One drivers’ championship.
Loading post from X…
View post on X
Myriad said refunds would come from recovered funds and the market pools, and that other markets were unaffected. Users do not need to submit a claim: payments will be deposited automatically into their wallets.
At disclosure, the company said it would process refunds “shortly” and correct affected portfolios that still displayed the wrong outcome or profit and loss.
