Polymarket hit by $2.9M theft, users to be refunded

Polymarket said it contained the compromise and removed the affected dependency after attackers injected a malicious script into its frontend.