Bubblemaps

ZachXBT

Polygon (Old)

Polymarket

Polymarket confirmed a security exploit affected part of its infrastructure, pointing to a possible private key compromise involving a wallet used for top-up operations, while saying user funds and market resolution were safe.
In a Friday X <a href="https://x.com/PolymarketDevs/status/2057755280641814769" rel="noopener noreferrer nofollow">post</a>, Polymarket developers said contracts and core infrastructure were unaffected. Polymarket product lead Akanshu Jain and multiple other Polymarket employees also <a href="https://x.com/kakujain/status/2057754969667993863" rel="noopener noreferrer nofollow">said</a> user funds and market resolution are safe.
Blockchain investigator ZachXBT first <a href="https://t.me/investigations/327" rel="noopener noreferrer nofollow">flagged</a> the exploit as a compromise to the Polymarket-linked UMA Conditional Tokens Framework (CTF) Adapter contract on Polygon, with the exploiter draining at least $520,000.
However, Josh Stevens, Polymarket’s vice president of engineering, <a href="https://x.com/devjoshstevens/status/2057768173915484505" rel="noopener noreferrer nofollow">said</a> the contracts were safe and that the exploit was limited to a six-year-old private key used for internal top-up operations. All permissions tied to the key have been revoked, he said.
The UMA CTF adapter is an oracle contract used to help resolve Polymarket prediction markets through UMA’s Optimistic Oracle. Polymarket is the world’s second-largest prediction market with $3.7 billion in monthly trading volume, <a href="https://defillama.com/protocols/prediction-market" rel="noopener noreferrer nofollow">according</a> to DefiLlama.&nbsp;
Polyscan <a href="https://polygonscan.com/txs?a=0x91430CaD2d3975766499717fA0D66A78D814E5c5&amp;ps=100" rel="noopener noreferrer nofollow">data</a> reviewed by Cointelegraph showed more than 100 small transfers into the alleged attacker wallet. Most were worth up to 5,000 Polygon (POL) tokens.
<img alt="Polymarket team says user funds safe as exploit losses climb above $600K" height="720" src="https://s3-images.ctmedia.io/media/content/pasted-image-893.png" width="1822">
Address of the alleged Polymarket adapter contract attacker. Source: Polygonscan
<h2 id="exploit-losses-climb-past-600-000">Exploit losses climb past $600,000</h2>
Multiple blockchain data platforms reported similar onchain activity tied to the suspected exploit.
Blockchain data visualization platform Bubblemaps <a href="https://x.com/bubblemaps/status/2057746068885082371" rel="noopener noreferrer nofollow">said</a> in a Friday X post that the attacker continues to remove about 5,000 POL tokens every 30 seconds, amassing about $600,000 in stolen funds at the time of writing.
<img alt="Polymarket team says user funds safe as exploit losses climb above $600K" height="705" src="https://s3-images.ctmedia.io/media/content/pasted-image-896.png" width="817">
Source: <a href="https://x.com/bubblemaps/status/2057746068885082371" rel="noopener noreferrer nofollow">Bubblemaps</a>
Blockchain data platform Lookonchain <a href="https://x.com/lookonchain/status/2057748590806892802" rel="noopener noreferrer nofollow">estimated</a> that about $660,000 was drained from the Polymarket-linked contract as of 9:01 am UTC on Friday.
Related: <a href="https://cointelegraph.com/news/crypto-vc-funding-plunges-to-659m-in-april-to-2024-lows" rel="noopener noreferrer nofollow">Crypto VC funding plunges to $659M in April, hits near two-year low</a>
Polymarket <a href="https://medium.com/uma-project/polymarket-integrates-umas-optimistic-oracle-7fa89cae493e" rel="noopener noreferrer nofollow">integrated</a> UMA’s optimistic oracle solution on Feb. 3, 2022, enabling automated and decentralized resolution for its prediction market contracts.
Cointelegraph contacted Polymarket and UMA for comment but had not received a response by publication.
Magazine: <a href="https://cointelegraph-magazine.com/legal-battle-over-who-defis-stolen-millions/" rel="noopener noreferrer nofollow">The legal battle over who can claim DeFi’s stolen millions</a>&nbsp;

Polymarket team says user funds safe as exploit losses climb above $600K

Table of Contents

Cointelegraph

Other articles published on May 22, 2026

Join our free newsletter for daily crypto updates!