Protocols desk
Who Audits Polymarket’s Browser?
The 15‑Kilobyte Window
On October 29, a 15‑kilobyte file on Polymarket stopped measuring page speed and started draining wallets. The blockchain processed every stolen dollar without error. Every smart contract on the platform had been audited. Who checked the third‑party script running in users’ browsers? Nobody.
How the drain ran
Attackers hijacked DNS records belonging to DebugBear, a UK‑based website monitoring vendor, and swapped its harmless script for a wallet drainer on Polymarket, the largest crypto prediction market. The malicious code read trading API keys that Polymarket stores in the browser, then pushed withdrawals through the platform’s own transaction pipeline. Think of a thief using the building’s own elevator and key card. Roughly $2.5M moved out of hundreds of wallets in 55 minutes.
|
Audit the contract or audit the browser?
This was not a one‑off. It was the second browser‑layer breach on Polymarket in under a year. In May, a leaked private key emptied an internal wallet. In June, a different compromised vendor injected a drainer script targeting high‑balance wallets. Each time, smart contracts went untouched. The attack surface was the unaudited code running inside traders’ browsers.
The lock nobody turned
Scott Helme, founder of security firm Report URI, pointed out that a free, browser‑native defense called Subresource Integrity would have stopped the October attack cold. SRI lets a site pin any third‑party script to a cryptographic fingerprint. If the file changes by a single byte, the browser refuses to run it. Polymarket’s security policy allowlisted every domain the drainer touched. The lock was on the shelf. Nobody installed it.
$9 billion riding on an open tab
Intercontinental Exchange, the company that owns the New York Stock Exchange, committed $2B to Polymarket at a $9B valuation. The platform it bought into lets any third‑party script run with full access to the page. No fingerprint check. No kill switch. The owner of the New York Stock Exchange placed a two‑billion‑dollar bet on a trading floor where anyone can swap the wiring.
Read the flows, not the headlines
Institutional investors are repricing crypto security, but their money is aimed at the wrong layer. Ernst & Young’s 2026 institutional survey tells the story in one number. The share of investors who rank security as a top factor in choosing a custodian jumped from 8% to 66% in a single year. That spending flows into custody vaults and smart‑contract audits. The browser layer barely registers.
Investors ranking security a top factor in choosing a custodian Previous year: 8% 2026: 66% EY 2026 institutional survey |
SlowMist, a blockchain security auditor, tagged supply‑chain attacks as the largest single loss category in H1 2026, at roughly $298M. The pipeline carrying the most risk is the one nobody is inspecting.
Traditional finance already treats the browser as the front door. Island, an enterprise‑browser startup, raised $400M in September from Sequoia, J.P. Morgan, and Evolution Equity Partners to harden that entry point. Crypto has not found the hinges.
The wrapper breaks. The protocol survives.
Our read: this pattern has a dated precedent. In February 2014, Mt. Gox, then the world’s largest Bitcoin exchange, collapsed because a trusted wrapper around Bitcoin’s protocol carried an unaudited vulnerability. The exchange was the weak layer. Bitcoin kept producing blocks. In 2026, the trusted wrapper is a browser tab running a third‑party script nobody hashed, nobody pinned, and nobody questioned until it drained millions. The protocol survived both times. The wrapper didn’t.
If you hold assets on any platform that loads third‑party scripts into your browser session, the October 29 breach is not an abstraction. It is your risk, in an open tab, right now.
|
The vault is reinforced. The window is still open.
Crypto Compass holds no position in Polymarket or any asset mentioned above.
|