Polymarket will price the odds on almost anything. Nobody opened a market on the website speed tracker.
Today a compromised script from DebugBear, a page-performance monitoring vendor, loaded on Polymarket's international site. It didn't need your seed phrase. It found your logged-in trading session, sold positions, and shipped the funds to a hard-coded address.
~$2.7M out, mostly swapped into POL. Trading paused about an hour. US platform untouched. Polymarket says everyone hit gets made whole.
Follow the Value: The attacker got the liquidity. Polymarket's balance sheet gets the bill. Users got a free lesson in what "self-custody" means when the frontend can sign for you.
Your keys, your coins. Their analytics vendor, your problem.
How many third-party scripts are running in the tab where you trade right now?