Polymarket suspended its trades for about an hour after the diversion of at least $2.6 million belonging to its users. The attack did not target the blockchain itself, but a performance measurement tool integrated into the site, revealing a often overlooked weakness of non-custodial platforms.