Polymarket halted new trading and entered cancel-only mode on its international platform after malicious code distributed through a supply-chain compromise involving external performance-monitoring firm DebugBear’s RUM script targeted users’ trading and signing permissions. The incident liquidated positions and transferred collateral to an attacker-controlled wallet, with security firms tracing 28.6 million POL tokens through a central wallet before funds were divided among three wallets. GoPlus linked the main attack paths to 710 deposit wallets and 731 addresses, while estimating losses at about $2.71 million; the address count does not represent the number of unique users. Polymarket said it fixed the issue, restored service, referred the incident to law enforcement and would fully reimburse affected traders, but users seeking more than $10,000 must sign an agreement restricting public criticism of the platform. The incident follows reported May and June security events involving about $700,000 and $3 million, respectively.