Polymarket confirms user funds are safe after $600,000 exploit

Traders Union
All News
Crypto News
Polymarket confirms user funds are safe

Highlights

Polymarket confirmed a security incident but said its contracts and core infrastructure were not affected.
ZachXBT first flagged a possible exploit involving the UMA CTF Adapter linked to Polymarket.
Lookonchain estimated the amount drained at roughly $660,000.

What happened

Polymarket said part of its infrastructure was attacked, likely because of a compromised private key for a wallet used in top-up operations. The platform’s developers said the core contracts and main infrastructure were not affected, while user funds and the market resolution process remain safe. Polymarket product lead Akanshu Jain also confirmed that position.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Blockchain investigator ZachXBT was the first to draw attention to the incident. He described it as a compromise of the UMA Conditional Tokens Framework Adapter connected to Polymarket on Polygon. According to his estimate, the attacker drained at least $520,000. Cointelegraph noted at the time that it could not independently confirm whether user funds, active markets or withdrawals had been affected.

How the loss estimate grew

Later, several blockchain analytics platforms reported similar on-chain activity tied to the suspected exploit. Bubblemaps said the attacker continued draining about 5,000 POL every 30 seconds, bringing the total stolen amount to roughly $600,000. Lookonchain estimated the drained funds at around $660,000 as of 9:01 UTC on Friday.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The UMA CTF Adapter is used to connect Polymarket’s prediction markets with UMA’s Optimistic Oracle. This mechanism helps resolve outcomes on prediction markets. According to DefiLlama, Polymarket is the world’s second-largest prediction market, with monthly trading volume of about $3.7 billion.

Infrastructure trust remains the key issue

The incident does not appear to be a direct hack of user wallets, but it affects an important layer of Polymarket’s infrastructure. For a prediction market platform, trust in contracts, oracles and internal operational keys is critical: users are not only betting on events, but also relying on markets to close and settle correctly.

Polymarket said permissions tied to the six-year-old private key have already been revoked. Still, the compromise of an old operational key again raises questions about how often DeFi projects review internal permissions and outdated components. With monthly trading volume of $3.7 billion, even a relatively small exploit becomes a reputational test for the platform.

Earlier, we reported that Polymarket rejects claims of major user data leak.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.