MYRIAD@MyriadMarkets
Incident Report: AMM Market Resolution Exploit (Oct 26)
Yesterday morning, an attacker forced incorrect resolutions on 10 Myriad AMM markets on the BNB Chain. We caught it within minutes, shut it down, and the attacker left with nothing. Here’s what happened and what we’re doing about it.
What happened
At 06:07 UTC, an attacker used a compromised internal wallet, one we used to create and resolve some markets automatically, to build positions on unlikely outcomes, resolve markets in their own favor, and claim the payouts. Within minutes of being notified of suspicious activity, the team revoked the wallet’s admin rights and stopped the attack.
The attacker got no funds
The attacker’s last move was a large buy that never paid out. We unwound the position and moved the funds from the compromised wallet to Myriad-controlled wallets. The attacker withdrew nothing.
How it happened
The wallet’s key was exposed several weeks ago through a vulnerability in a third-party library used by one of our backend services. As the team ran a series of security updates last week in the wake of the severe disclosures, we believe the attacker decided to act before this wallet was rotated. The compromised wallet no longer has any privileges and we continue to tighten the platform’s security.
The 10 markets will be voided
The resolutions on these markets were not legitimate, so we’re treating all 10 as voided:
• Will George Russell win the F1 Drivers Championship 2026?
• Will Base TGE in 2026?
• ETH flipped on CMC Historicals in 2026?
• Crude Oil’s next move: Pump to $120 or Dump to $55?
• Will Democrats sweep the 2026 U.S. Midterm Elections?
• GOLD Price: Pump to $4,900 or Dump to $3,700?
• ETH at three digits when Bitcoin goes below 50K?
• ETH above 4K when Bitcoin goes above 100K?
• Will Brian Armstrong appear in the first episode of UpOnly?
• Who IPOs first? (OpenAI or Anthropic)
Every holder, on either side, will be refunded at fair value: your shares times that outcome’s last price before the attack. Anyone who already claimed winnings from a forced resolution will have that amount deducted from their refund. No action is required on your end. The funds will be automatically deposited into your wallet, no claim necessary.
Refunds come from recovered funds and the market pools, so no user funds are at risk. Other markets were not affected and continue to operate normally.
What’s next
If you have positions in these markets, we’ll process your refund shortly. These markets may still show the wrong outcome and PnL in your portfolio, which we’ll correct.
Questions? DM us or ask in our Telegram group.
91363.4K