Polymarket confirms third-party vendor compromise hit under 15 accounts with $3M losses fully refunded after malicious script injection.