Bubblemaps

DeFi

ZachXBT

Polygon

Polymarket

<h2 id="b-tldr-b">TLDR:</h2>
<ul>
 <li>Polymarket lost over $600K after attackers exploited an outdated backend operational key.</li>
 <li>Blockchain investigators tracked stolen funds moving through 16 wallets and ChangeNOW.</li>
 <li>User funds and market resolution contracts remained secure despite the Polygon wallet breach.</li>
 <li>The exploit exposed how legacy permissions and weak key rotation create major security risks.</li>
</ul>
A private key compromise hit Polymarket on May 22, 2026, draining over $600,000 in internal operational funds. The incident affected a wallet tied to backend infrastructure on the Polygon network. 
<a href="https://blockonomi.com/polymarket-faces-u-s-probe-over-possible-insider-trading-activity/" rel="noopener noreferrer nofollow">Polymarket</a> later confirmed that user funds remained safe and that market resolution was not disrupted. The breach traced back to an old private key that still held too much operational access, raising questions about internal key management practices across decentralized platforms.
<h2 id="b-how-the-drain-unfolded-b">How the Drain Unfolded</h2>
On-chain activity first flagged unusual fund movements from Polymarket-linked infrastructure on Polygon. Blockchain investigator ZachXBT identified the movement as a possible exploit early on. 
Shortly after, PeckShieldAlert confirmed that two attacker addresses had drained roughly $520,000. Part of those funds was then routed to the exchange service ChangeNOW.
On-chain analytics platform Bubblemaps tracked the attacker pulling approximately 5,000 POL tokens every 30 seconds. The speed of the drain pushed loss estimates upward throughout the day. 
Figures moved from $520,000 to $600,000, then approached $700,000 across different trackers. The stolen funds were split across 16 separate addresses and funneled through centralized exchanges and other services.
<div class="embed-twitter">
 <blockquote class="twitter-tweet">
 Here's the play-by-play of what happened with <a href="https://twitter.com/Polymarket?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@Polymarket</a> ↓
 May 22, 2026: First alerts
 Funds started moving out of Polymarket-linked infra on <a href="https://twitter.com/0xPolygon?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@0xPolygon</a>.
 People initially thought it might be an exploit tied to Polymarket's market-resolution setup, but the team later clarified… <a href="https://t.co/SvhhXJd65O" rel="noopener noreferrer nofollow">https://t.co/SvhhXJd65O</a><a href="https://t.co/AtPBAVdgxF" rel="noopener noreferrer nofollow">pic.twitter.com/AtPBAVdgxF</a>
 — DeFi Warhol (@Defi_Warhol) <a href="https://twitter.com/Defi_Warhol/status/2058129720487936465?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 23, 2026</a>
 </blockquote>
</div>
Early confusion arose because the affected wallet had ties to <a href="https://parameter.io/polymarket-teams-up-with-nasdaq-to-offer-private-company-prediction-trading/" rel="noopener noreferrer nofollow">Polymarket’s</a> market-resolution setup. Many observers initially suspected something had gone wrong with the platform’s outcome contracts. Those concerns turned out to be unfounded, as the contracts themselves were not involved.
Polymarket team member ShantikiranC clarified that the issue stemmed from an old private key used for internal reward payouts. 
The key was not linked to core contracts or user-facing infrastructure. However, it still carried enough access to allow the attacker to drain a significant amount of funds.
<h2 id="b-containment-steps-and-key-management-review-b">Containment Steps and Key Management Review</h2>
Following the breach, Polymarket began rotating backend service keys immediately. ShantikiranC confirmed the team was also auditing other internal secrets to check for further exposure. The response followed a standard protocol for private key and backend secret leaks.
Developer Josh Stevens noted that the affected wallet’s permissions had been revoked. He added that the team was migrating keys to a Key Management System, commonly known as KMS. A KMS provides a more secure environment for storing and handling sensitive cryptographic keys.
The incident raised a broader question about how an outdated internal key retained that level of access for so long. 
In decentralized platforms, operational keys often accumulate permissions over time without regular audits. This case showed how legacy access can become a liability even when core contracts are secure.
The <a href="https://moneycheck.com/polymarket-eyes-japanese-market-entry-with-new-regional-leadership/" rel="noopener noreferrer nofollow">Polymarket</a> incident serves as a reminder that internal operational security requires the same level of attention as smart contract audits. 
Key rotation, permission scoping, and secure storage are not optional steps. For platforms handling large volumes of on-chain activity, these practices are a basic operational requirement.
The post <a href="https://blockonomi.com/polymarket-private-key-breach-drains-600k-as-legacy-wallet-access-exposed/" rel="noopener noreferrer nofollow">Polymarket Private Key Breach Drains $600K as Legacy Wallet Access Exposed</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Polymarket Private Key Breach Drains $600K as Legacy Wallet Access Exposed

Table of Contents

Blockonomi

Other articles published on May 23, 2026

Join our free newsletter for daily crypto updates!