ZachXBT

Verus

Polygon (Old)

Polymarket

<p><strong>Polymarket’s UMA CTF Adapter contract on Polygon has reportedly been targeted in a suspected exploit, with onchain analysts warning users to pause activity.</strong></p>
<div id="cn-block-summary-block_635c235ea5130f9fcb7f1c7330ffa758" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>ZachXBT flagged a suspected UMA CTF Adapter exploit on Polygon with losses above $520K reported.</li>
   <li>PeckShield said two addresses were drained and some stolen funds were deposited into ChangeNOW already.</li>
   <li>Bubblemaps warned attackers were removing 5,000 POL every 30 seconds as losses kept rising quickly.</li>
  </ul>
 </div>
</div>
<p>A ZachXBT community <a href="https://t.co/EXNfXHMbVr" rel="noopener noreferrer nofollow">alert</a> said Polymarket’s UMA CTF Adapter contract on Polygon was suspected of being attacked. The alert listed losses above $520,000 and named the attacker address as 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91.</p>
<p>PeckShield later said ZachXBT had reported that the contract had “potentially been exploited.” The security firm said two addresses, 0x871D…9082 and 0xf61e…4805, were drained of about $520,000. It also said part of the stolen funds had already moved to ChangeNOW.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p><a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#PeckShieldAlert</a><a href="https://twitter.com/hashtag/ZachXBT?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#ZachXBT</a> reports that the Polymarket UMA CTF Adapter contract on <a href="https://twitter.com/hashtag/Polygon?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Polygon</a> has potentially been exploited. <br><br>2 addresses (0x871D…9082 and 0xf61e…4805) have been drained of approximately $520K.<br><br>The attacker has already deposited a portion of the stolen funds… <a href="https://t.co/ogne5K58mC" rel="noopener noreferrer nofollow">pic.twitter.com/ogne5K58mC</a></p>— PeckShield <a href="https://twitter.com/PeckShieldAlert/status/2057745696674218049?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 22, 2026</a>
  </blockquote>
 </div>
</figure>
<p>You might also like: <a href="https://crypto.news/will-bitcoin-price-revisit-76k-as-bullish-trendline-support-collapses/" rel="noopener noreferrer nofollow"> Will Bitcoin price revisit $76K as bullish trendline support collapses? </a></p>
<p>Polymarket protocol contributor Shantikiran Chanal said the security reports were linked to rewards payout activity. He said user funds and market resolution are safe, adding that early findings point to “a private key compromise of a wallet used for internal operations, not contracts or core infrastructure.”</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>We’re aware of the security reports linked to rewards payout. User funds and market resolution are safe. <br><br>Findings point to a private key compromise of a wallet used for internal operations, not contracts or core infrastructure.<br><br>More updates to follow.</p>— Shantikiran Chanal (@ShantikiranC) <a href="https://twitter.com/ShantikiranC/status/2057754616230514957?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 22, 2026</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="strong-bubblemaps-warns-users-to-pause-activity-strong"><strong>Bubblemaps warns users to pause activity</strong></h2>
<p>Bubblemaps also <a href="https://x.com/bubblemaps/status/2057746068885082371?s=20" rel="noopener noreferrer nofollow">warned</a> that a Polymarket contract had been exploited. The firm said attackers were removing 5,000 POL every 30 seconds and estimated losses at about $600,000 at the time of its alert.</p>
<p>PolygonScan data for 0x871D…9082 shows repeated outgoing transfers of 5,000 POL to an address tagged as Polymarket’s UMA CTF Adapter Admin. Several transfers occurred about 30 seconds apart, matching the pattern flagged by Bubblemaps.</p>
<figure class="wp-block-image size-large"><img width="1024" height="512" src="https://media.crypto.news/2026/05/image-174-1024x512.webp" alt="Source: PolygonScan">
 <figcaption>
  Source: <a href="https://polygonscan.com/address/0x871D7c0f9E19001fC01E04e6cdFa7fA20f929082" rel="noopener noreferrer nofollow">PolygonScan</a>
 </figcaption>
</figure>
<p>Meanwhile, Polymarket’s <a href="https://legacy-docs.polymarket.com/polymarket-+-uma" rel="noopener noreferrer nofollow">documentation</a> says the UMA CTF Adapter connects markets to UMA’s Optimistic Oracle. The adapter is used to request and retrieve resolution data for prediction markets built on the Conditional Tokens Framework.</p>
<p>Polymarket’s newer documentation says all outcomes on the platform are tokenized through CTF, with outcome tokens backed by locked pUSD. That makes the affected contract area relevant to how markets are created, resolved, and redeemed onchain.</p>
<p>This is not Polymarket’s first UMA-related controversy. Earlier coverage <a href="https://crypto.news/polymarket-suffers-governance-attack-due-to-uma-whale-intervention/" rel="noopener noreferrer nofollow">noted</a> that a UMA whale allegedly influenced a Polymarket market outcome tied to a Trump-Ukraine mineral deal, raising questions over oracle voting power and market resolution trust.</p>
<h2 class="wp-block-heading" id="strong-attack-comes-as-polymarket-expands-strong"><strong>Attack comes as Polymarket expands</strong></h2>
<p>The incident comes as Polymarket has been moving from a crypto-native prediction platform into a larger market structure debate. Recent crypto.news coverage <a href="https://crypto.news/prediction-markets-sprint-from-crypto-niche-to-mainstream-finance/" rel="noopener noreferrer nofollow">said</a> prediction markets led by Polymarket and Kalshi have grown into one of finance’s fastest-moving sectors.</p>
<p>The platform has also faced regulatory and market-design pressure. Earlier coverage <a href="https://crypto.news/wisconsin-sues-kalshi-coinbase-polymarket-calls-prediction-markets-illegal-bets/" rel="noopener noreferrer nofollow">noted</a> Wisconsin’s lawsuit against Polymarket, Kalshi, Coinbase, Robinhood, and Crypto.com-linked entities, arguing some prediction markets function as unlicensed gambling products.</p>
<p>The suspected exploit adds a new technical risk layer to that debate. Polymarket is already watched for questions around regulation, resolution rules, and market integrity. A contract-level incident now puts user safety and smart contract controls back in focus.</p>
<p>The latest alert also follows a wider run of DeFi security incidents. Recent reports covered Echo Protocol’s <a href="https://crypto.news/echo-protocol-pauses-bridge-after-attacker-mints-76m-ebtc/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">paused</a> bridge after unauthorized eBTC minting, while the Verus Ethereum bridge case took a different turn after the exploiter <a href="https://crypto.news/verus-bridge-attacker-sends-back-8-5m-keeps-bounty/" rel="noopener noreferrer nofollow">returned</a> 4,052 ETH, following an $11.5 million forged-transfer attack.</p>
<p>Read more: <a href="https://crypto.news/verus-bridge-attacker-sends-back-8-5m-keeps-bounty/" rel="noopener noreferrer nofollow"> Verus bridge attacker sends back $8.5M, keeps bounty </a></p>

Polymarket UMA alert: are user funds safe after $520K loss?

Table of Contents

crypto.news

Other articles published on May 22, 2026

Join our free newsletter for daily crypto updates!