BrainResearchHub
Independent research on prediction markets, perpetual futures, and trading infrastructure
After October 29, 2026 — free community check

Is your wallet safe
after the October breaches?

One compromised script drained $2.64M from 726 Polymarket accounts in under an hour. Binance lost $6.3B the same day. Both attacks used permissions your wallet had already granted. See what yours has granted — in 30 seconds, read-only.

▼ Connect your wallet below — it's free

Read-only · No signatures · No seed phrase · Nothing stored

✓ Can't move funds✓ Can't sign anything✓ Open methodology
$2.64M
drained from Polymarket users on Oct 29 via one hijacked script
726
wallets hit in under one hour — most had no idea they were exposed
1 in 5
active wallets carries a standing approval or delegation it forgot about

The 3 things we check — and what they catch

01

EIP-7702 delegation

Your account quietly pointing at a stranger's contract — the exact mechanism behind the October drainer chains. If it's set and you didn't set it, every deposit is at risk.

How to revoke →
02

Token approvals

Unlimited allowances you signed months ago for apps you no longer use. The Oct 29 drainer reused exactly these. Each one is a standing invitation.

How to clear →
03

Live session hygiene

Stale connected sessions that survived a frontend breach — they stay valid until you kill them, breach or no breach.

First 24h playbook →

How it works

  1. Connect — the official WalletConnect modal, the same one your wallet app trusts. Read-only session.
  2. Review — three results: delegation, approvals, sessions. Anything risky is flagged red with a fix link.
  3. Fix — each red flag links to a step-by-step guide. Most fixes take under two minutes.

No wallet? Run theaddress-only delegation checker — paste an address, no connection at all.

Straight answers

Can this check steal my funds?
No. A read-only connection cannot move, swap, or sign anything. The only wallet action ever requested is "connect". If any popup asks for a signature or your seed phrase — that's the follow-up scam wave, close it andread how the October scam worked.

Why connect at all if I could just use revoke.cash?
You could — and for deep audits you should. This check is the fast lane: three answers in 30 seconds, each flagged with the exact fix guide, written for people who don't audit wallets for a living.

I traded on Polymarket before October 29. Am I affected?
Possibly — approvals signed long before the breach stayed valid through it. 726 accounts were drained; thousands more carried the same exposure. That's exactly what this check surfaces.

My funds are on Binance — do I need this?
The Binance breach hit exchange hot wallets, not your connected wallet. But if you're moving funds to self-custody after $6.3B vanished, run the check on thedestination wallet before you fund it.

What do I do after a clean result?
Set a monthly cadence. The10-step hardening guide covers the full routine in about 20 minutes a month.

30 seconds now beats $2.64M later

The 726 drained wallets had one thing in common: exposure they didn't know about. Yours takes half a minute to see.

Scroll up to Connect your wallet — read-only, no signatures.

↑ Back to the check

Sources

Independent community tool by Polymarket Research Collective. Not financial or security advice. Not affiliated with Polymarket, Binance, or the Ethereum Foundation.