Polymarket Exploit Reported As Above $600K Losses Traced To Private Key Issue

By Zagham Abbas | Edited By Ammar Raza,May 23, 2026, 3:57 AM

Polymarket has verified the existence of a security breach affecting some components of its internal system following reports of a suspected breach of one of its private keys, which was used in topping up its wallet. However, it has been clarified that no customers’ funds have been compromised.

As mentioned by Polymarket developers in an announcement posted on X on Friday, there was no breach of the platform’s smart contracts or its core infrastructure. Product lead Akanshu Jain, along with other team members, reiterated that the funds and settlements are still safe.

We’re aware of the security reports linked to rewards payout. User funds and market resolution are safe.

Findings point to a private key compromise of a wallet used for internal top-up operations, not contracts or core infrastructure.

More updates to follow.

— Polymarket Developers (@PolymarketDevs) May 22, 2026

Also Read | Trump Media Bitcoin Losses Explode After $205M Transfer

Security Incident Under Investigation

This issue initially came to attention due to blockchain researcher ZachXBT identifying suspicious behavior within a contract connected to Polymarket on the Polygon network. From ZachXBT’s analysis, it seems that a bug within the CTF adapter contract for the UMA framework had been exploited, leading to losses amounting to roughly $520,000.

Nevertheless, according to the vice-president of engineering of Polymarket, Josh Stevens, the smart contracts at the core did not have any problems. Apparently, the problem was related to a six-year-old private key that had been used internally for funding purposes only. As soon as the problem was identified, all access to the key was terminated.

No polymarket or UMA contracts have been exploited. All user funds are safe, and using https://t.co/7bOD8pgjQC is safe, so business as usual.

We had a 6-year-old private key that was compromised. This was in the internal top-up config, which is why funds were being sent to it.…

— Josh (@devjoshstevens) May 22, 2026

The UMA CTF Adapter serves as an oracle mechanism that helps to settle the prediction market using UMA. This mechanism is important in deciding the results of markets within the Polymarket ecosystem.

The on-chain analysis data revealed a series of smaller transactions being sent to the address of the hacker, with a significant number of them comprising a sum that is just under 5,000 POL.

Source: Polygonscan

Polymarket Incident Raises Security Concerns

As events unfolded, more losses were reported by various blockchain analytics firms. Bubblemaps revealed consistent draining of 5,000 POL coins every 30 seconds with estimated losses nearing the mark of $600,000. The amount, according to Lookonchain, was about $660,000.

Source: Lookonchain

Polymarket is currently one of the biggest prediction market exchanges around the world. According to industry statistics, the platform handles billions of trading volumes on a monthly basis. Polymarket introduced the use of UMA’s oracle mechanism on the platform in February 2022.

Even as investigations are still ongoing, the biggest prediction market argues that the impact of the breach was limited, and no user-owned assets were compromised.

This article contains market analysis and price predictions. These are not guarantees. Crypto markets are volatile. Always DYOR. Not financial advice.

Also Read | FET Price Prediction: Bull Flag Pattern Points to Possible Breakout to $0.2350