The company said one of its third-party providers had been compromised, that it had fixed the problem, and that it referred the matter to law enforcement.
The exchange went into cancel-only mode (existing orders can be canceled, but new ones stop processing) at 2:05 p.m. ET.
A fix was announced at 2:37 p.m., and the incident was marked resolved at 3:05 p.m. Polymarket said trading is fully back online and that affected users will be made whole.
Its US platform was reportedly unaffected.
Security firm Hudson Rock and BleepingComputer examined a malicious JavaScript file that tried to hijack logged-in sessions, sell positions and move the proceeds, or send position tokens to an attacker-controlled wallet.
Researchers linked the code to DebugBear, a UK-based service that helps websites monitor loading speed.
DebugBear said it was affected by an ongoing security incident, brought in specialist responders and urged customers using its real user monitoring product to remove the embed code.
Reuters, citing a person familiar with the matter, identified DebugBear as the provider involved, though Polymarket has not named it.
Loss estimates vary: Hudson Rock saw about $2.19 million at the script's fallback address and said this was not a verified tally, while GoPlus put losses at roughly $2.71 million.
One trader, using the name Car, said about $800,000 vanished from his account and all his positions were sold.
Polymarket has not confirmed individual claims.
Several questions remain open. Polymarket has not disclosed total losses, how many users were affected or how reimbursement will work, including how positions sold without approval will be valued. Hudson Rock found build metadata showing a change that removed the DebugBear script and said its findings do not indicate other DebugBear customers were targeted, but it has not determined how the script was tampered with. This is also not Polymarket's first such incident: in June it disclosed another third-party compromise that injected a malicious script into its frontend, with reported losses of around $3 million, and it promised refunds then as well. The company has not said the two cases share a supplier or attacker.