Episode 51

full
Published on:

30th Oct 2026

Ep51: Polymarket Had a CSP. Here's Why It Didn't Help

Episode Summary:

On October 29, 2026, a performance-monitoring script Polymarket loaded from an outside vendor was swapped for code that used logged-in traders' open sessions to sell positions and move funds out. Researchers traced the file to DebugBear, which confirmed a security incident, but Polymarket hasn't named DebugBear and the root cause is unconfirmed. Marc uses the attack to explain one thing: any outside script on your site runs with your users' full access, and a Content Security Policy is the browser rule built to limit that. He covers what a Content Security Policy is, why Polymarket's own policy still let this attack through, and why so few sites use one at all, or use it well.

Key Topics Covered:

  • How a page-speed script on Polymarket was swapped and used open sessions to move funds
  • Why a third party script runs with the same access as your own code
  • Why two-factor authentication doesn't stop code running inside an open session
  • What a Content Security Policy is, and what it can and can't block
  • Why Polymarket's policy allowed every server the malicious script used
  • How few sites deploy a Content Security Policy, and how many policies have gaps

Main Takeaways:

  • Every outside script on your page runs with your users' full access.
  • A Content Security Policy blocks code and connections to servers not on your list. It trusts every server that is on the list, so keep the list short.
  • Per the HTTP Archive Web Almanac 2025, Content Security Policy adoption reached 21.9%, and about 92% of policies that set script rules include unsafe-inline, which weakens them.
  • Start in report-only mode, list what your site loads today, cut what nobody uses, and keep outside scripts off login, donation, and checkout pages.

Timestamps:

  • [0:00] Cold open
  • [0:32] Intro
  • [0:55] What happened at Polymarket
  • [1:56] Why an outside script gets full access
  • [2:49] What a Content Security Policy is
  • [3:28] Would it have stopped this one?
  • [4:19] Few sites use it, fewer use it well
  • [5:12] Your homework
  • [5:59] Outro

Loss Estimates by Source (each measured something different):

  • Hudson Rock: about $2.19 million at the script's recipient wallet, from a screenshot, "not a verified total of stolen funds."
  • BleepingComputer: about 28.6 million POL, "valued at roughly $2.57 million," moved to three other wallets.
  • The Record: blockchain firms traced "more than $2.1 million."
  • Polymarket postmortem: returning $3.9M to traders, "the $2.7M plus $1.2M to cover pause-related losses."

Tools & Resources Mentioned:

This episode's audio was produced with an AI voice clone of Marc, from a script Marc reviewed and approved.

---

I do hope you enjoyed this episode of the podcast. Here are some helpful resources including any sites that were mentioned in this episode.

--

Listen and subscribe: https://bytesizedsecurity.show/listen

--

Support ByteSizedSecurity (501(c)(3)): Donate via GiveLively

--

Questions or tips: email [email protected] (subject: Byte-Sized Security). TikTok: @bytesizedsecurity

All Episodes Previous Episode

Support the Podcast with a Tip

If you're enjoying Byte-Sized Security and finding these practical tips useful, please consider supporting the podcast with a small contribution. It costs $17 per month just to cover podcast hosting fees, and your support helps offset the costs of producing this security resource and keeping episodes free. Even a tip of $1-5 per month from loyal listeners adds up and allows me to continue providing great cybersecurity info. Please considering a donation. I appreciate you helping sustain Byte-Sized Security! Now back to the security tips..
Support the Podcast
A
We haven’t had any Tips yet :( Maybe you could be the first!

Listen for free

Show artwork for Byte Sized Security

About the Podcast

Byte Sized Security
Snackable advice on cyber security best practices tailored for professionals on the go
In a world where cyberattacks are becoming more commonplace, we all need to be vigilant about protecting our digital lives, whether at home or at work. Byte Sized Security is the podcast that provides snackable advice on cybersecurity best practices tailored for professionals on the go.

Hosted by information security expert, Marc David, each 15-20 minute episode provides actionable guidance to help listeners safeguard their devices, data, and organizations against online threats. With new episodes released every Monday, Byte Sized Security covers topics like social engineering, password management, multi-factor authentication, security awareness training, regulatory compliance, incident response, and more.

Whether you're an IT professional, small business owner, developer, or just someone interested in learning more about cybersecurity, Byte Sized Security is the quick, easy way to pick up useful tips and insights you can immediately put into practice. The clear, jargon-free advice is perfect for listening on your commute, during a lunch break, or working out.

Visit bytesizedsecurity.com to access episodes and show notes with key takeaways and links to useful resources mentioned in each episode. Don't let cybercriminals catch you off guard - get smart, fast with Byte Sized Security! Tune in to boost your cybersecurity knowledge and help secure your part of cyberspace.
Support This Show

About your host

Profile picture for Marc David

Marc David

Marc David is a CISSP-certified Staff Security Engineer with 8+ years in dedicated security roles inside regulated healthcare, and the host of Byte-Sized Security. He describes his work in one line: "I get security tooling adopted by engineering teams who do not report to me." Most security programs fail at adoption, not at tool selection. Marc has driven API security monitoring, device trust, browser-based data loss prevention, and continuous mobile penetration testing to full coverage across engineering, IT, and platform groups where he holds no authority over anyone. His background spans HIPAA, HITRUST, and SOC 2 compliance, security automation, and awareness training built for people who never wanted training. Marc lives in the San Francisco Bay Area and speaks on security adoption, healthcare compliance, and automation.