$2.65 million worth of POL in the attacker’s wallet. A third-party Polymarket vendor was compromised, and a crypto-stealing script was injected into the front end. Assets were transferred without authorization; trading was paused, with only order cancellations allowed. The official statement says the issue has been fixed and all affected users will be reimbursed in full. In June, the same trick stole about $3 million. The contracts weren’t breached—the website was.