Greed

Security

Polygon

Polymarket

Polymarket suffered a security breach on May 22, 2026, after an attacker compromised a private key tied to an internal operations wallet and drained approximately $700,000 in POL tokens. The prediction market platform confirmed that user funds and core smart contracts were not affected.
<h2 id="what-to-know">What to Know</h2>
<ul>
 <li>The breach targeted an internal "top-up" wallet used for rewards distribution, not user accounts or Polymarket's core smart contracts. A 6-year-old private key was compromised, allowing the attacker to siphon POL tokens across 16 addresses.</li>
 <li>User funds are confirmed safe. Polymarket has rotated the compromised key, revoked all production permissions, and is migrating all private keys to KMS (Key Management Service) infrastructure.</li>
</ul>
<h2 id="what-happened-polymarket-s-internal-wallet-compromised">What Happened: Polymarket's Internal Wallet Compromised</h2>
On-chain investigator ZachXBT first flagged the exploit on May 22, with initial losses estimated at <a href="https://www.coindesk.com/markets/2026/05/22/zachxbt-flags-usd520k-polymarket-exploit-on-polygon-team-says-funds-are-safe" rel="noopener noreferrer nofollow">$520,000</a> drained from two Polygon smart contracts linked to Polymarket's UMA CTF Adapter system. The two affected contracts, <a href="https://polygonscan.com/address/0x871D7c0f9E19001fC01E04e6cdFa7fA20f929082" rel="noopener noreferrer nofollow">0x871D...9082</a> and 0x9143...E5c5, were tied to the platform's rewards payout infrastructure.
The total estimated loss ultimately reached approximately $700,000 in POL tokens, <a href="https://decrypt.co/368740/polymarket-hit-by-internal-top-up-wallet-exploit-700k-drained" rel="noopener noreferrer nofollow">according to Decrypt</a>. The attacker dispersed the stolen funds across 16 addresses to complicate tracing and recovery efforts.
<figure>
 Total Funds Drained
 ~$700,000
 POL tokens stolen from Polymarket internal ops wallet — May 22, 2026. Source: Decrypt
</figure>
Polymarket VP of Engineering Josh Stevens confirmed that the breach stemmed from a 6-year-old private key: "We had a 6-year-old private key that was compromised. This was in the internal top-up config... We have rotated this key, revoked all prod permissions and are moving all PKs to KMS keys from now on."
The attacker's wallet, <a href="https://polygonscan.com/address/0x8F98075db5d6C620e8D420A8c516E2F2059d9B91" rel="noopener noreferrer nofollow">0x8F98...9B91</a>, methodically drained POL tokens from the two contracts. The incident underscores a pattern seen across DeFi platforms where backend operational security lags behind smart contract security, even as protocols invest heavily in on-chain code audits.
<h2 id="what-this-means-for-polymarket-users-and-funds">What This Means for Polymarket Users and Funds</h2>
Polygon Labs CTO Mudit Gupta moved quickly to reassure users, confirming on X that the exploit was limited to a market initializer compromise with no impact on user funds or contracts.
<blockquote class="twitter-tweet">
 Polymarket contracts are safe. User funds are safe. Looks like their market initializer was compromised. No impact to the users or the contracts. <a href="https://t.co/nvR82cY6SN" rel="noopener noreferrer nofollow">https://t.co/nvR82cY6SN</a>— Mudit Gupta (@Mudit__Gupta) <a href="https://twitter.com/Mudit__Gupta/status/2057749582575202570?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 22, 2026</a>
</blockquote>
Source: @Mudit__Gupta on X
ZachXBT, BitcoinVN, and ChangeNOW coordinated to freeze approximately <a href="https://www.cryptotimes.io/2026/05/22/polymarket-ops-wallet-drained-700k-user-funds-unaffected/" rel="noopener noreferrer nofollow">$164,000</a> of the stolen funds. The recovery effort represents roughly 23% of total losses, with the remainder still dispersed across the attacker's wallet network.
The UMA token, which underpins Polymarket's oracle resolution system, fell 3.3% during the exploit window, dropping from $0.477 to $0.462 between 07:00 and 09:00 UTC on May 22. The sell-off was brief, and broader crypto markets were already under pressure with the <a rel="noopener noreferrer nofollow">Fear &amp; Greed Index at 28</a>, firmly in "Fear" territory.
<figure>
 UMA Price Drop — Exploit Window
 -3.3%
 $0.477 → $0.462 between 07:00–09:00 UTC on May 22, 2026. Source: CryptoTimes
</figure>
Hakan Unal, Senior Security Operations Lead at Cyvers, underscored the systemic risk: "Even when prediction market protocols are secure at the smart contract level, privileged adapter or admin wallets remain a critical attack surface if key management or operational security is compromised."
The breach also carries regulatory implications. Polymarket reached a settlement with the CFTC in January 2022, paying $1.4 million and agreeing to block U.S. users. A high-profile internal wallet compromise could attract renewed scrutiny over operational security standards at prediction market platforms, particularly as lawmakers continue to shape <a rel="noopener noreferrer nofollow">crypto-related fintech policy</a> in the U.S.
For now, Polymarket's core prediction markets remain operational. The platform's migration to KMS-based key management would address the root cause. But the incident is a reminder that operational security failures in backend infrastructure can be just as damaging as smart contract vulnerabilities, even as the industry moves toward <a rel="noopener noreferrer nofollow">institutional-grade security standards</a>.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
<a href="https://bitcoininfonews.com/" rel="noopener noreferrer nofollow">Bitcoininfonews</a> first published the article titled <a href="https://bitcoininfonews.com/?p=37048" rel="noopener noreferrer nofollow">Polymarket Security Breach: Attacker Drains Internal Wallet</a>.

Polymarket Security Breach: Attacker Drains Internal Wallet

Table of Contents

BitcoinInfoNews.Com

Other articles published on May 23, 2026

Join our free newsletter for daily crypto updates!