Polymarket Exploit: $600K+ Drained, Team Says Funds Safe

The update

Polymarket confirmed a security incident affecting its infrastructure on Polygon. A blockchain investigator flagged the breach, which drained over $600,000 in Polygon (POL) tokens from a smart contract linked to the platform. The team identified the issue as a compromise of a private key used for internal top-up operations, a wallet that had been dormant for six years. Polymarket’s engineering team stated that all permissions tied to the compromised key have been revoked. They emphasized that user funds and market resolution mechanisms remain safe.

Why it matters

This incident highlights the persistent security risks in decentralized finance, even for platforms with high trading volumes. Polymarket, a major player in prediction markets, relies on oracle solutions like UMA’s Optimistic Oracle to resolve markets. The exploit targeted the UMA Conditional Tokens Framework (CTF) Adapter contract, which processes these resolutions. While the team asserts that user assets are secure, the breach raises questions about the long-term security of legacy keys and internal operational wallets.

What to watch

On-chain data shows the attacker continues to move approximately 5,000 POL tokens every 30 seconds. The total amount stolen is currently estimated at over $600,000, with some reports suggesting figures may rise. Independent verification of the team’s claims is ongoing. The broader DeFi community will be watching for any updates on the attacker’s identity and whether this incident will lead to stricter security protocols for internal wallets.

Sources

• Cointelegraph — Details on the exploit, UMA adapter role, and on-chain activity.
• CoinDesk — Confirmation of the private key compromise and quotes from Polymarket engineering.