Polymarket suffers live POL drain as team rules out feared contract exploit

De-fi

Polymarket private key compromise turns feared exploit into internal wallet breach – Crypto News

Published

2 months ago

May 23, 2026

Dripp

Make preferred on

Polymarket faced what many users interpreted as a possible hack on May 22 after public alerts described a rapid POL drain on the prediction market platform. Polymarket-linked accounts later said the incident was not a smart-contract exploit and did not affect user funds or market resolution.

The first wave of concern came from on-chain investigator ZachXBT and blockchain analytics firm Bubblemaps. ZachXBT said a Polymarket admin address appeared to have been compromised on Polygon, with more than $520,000 drained at the time of his Telegram alert.

Bubblemaps then warned that attackers were removing 5,000 POL roughly every 30 seconds and that about $600,000 had been stolen so far, while advising users to pause Polymarket activity.

Polymarket’s later explanation shifted the issue away from core-market failure and toward an internal operational security breach. Findings pointed to a private-key compromise of a wallet used for “internal top-up operations,” according to Polymarket Developers, rather than “contracts or core infrastructure.”

Polymarket software engineer Shantikiran Chanal similarly said, “User funds and market resolution are safe,” adding that the issue was linked to rewards payout reports.

That implies different risks. A contract or resolution failure would raise questions about whether markets could settle correctly or whether user positions were exposed. An internal funding-wallet compromise, while still serious, points instead to key management, refiller services, and operational controls around wallets that support the platform.

Crypto finds $64B product market fit in 2025 but reliance on centralized logins has created a critical security flaw

Mainstream adoption of prediction markets raises systemic trust challenges and highlights ambiguities in resolution mechanisms for crypto platforms.

Feb 11, 2026 · Oluwapelumi Adejumo

The public alert moved faster than the private key compromise explanation

The timeline moved quickly. ZachXBT’s Telegram post at 08:22 UTC described a Polymarket admin address as apparently compromised on Polygon and identified the attacker address as 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91.

The same post listed related and drained addresses, giving on-chain analysts a trail to follow.

Bubblemaps amplified the warning at 08:51 UTC, describing the situation as a Polymarket contract exploit, the kind of Polymarket exploit alert that would raise immediate concern about core infrastructure, and saying the attacker was removing 5,000 POL every 30 seconds.

On-chain data show why the warning drew attention. A PolygonScan transaction at 09:01:19 UTC shows 5,000 POL moving into a Polymarket-labeled UMA CTF Adapter Admin address.

Seven seconds later, another PolygonScan transaction shows 4,999.994 POL moving from that labeled admin address to the labeled attacker address. The attacker address page is tagged by PolygonScan as “Polymarket Adapter Exploiter 1” and shows repeated transfers around the alert window.

That transaction pair supports the visible drain pattern that triggered the public alarm and gives a concrete example of the kind of transfer flow that Polymarket team members later described as involving an internal refiller, while leaving root cause to the team’s statements.

Question	Initial alert	Polymarket-linked explanation
What was happening?	Bubblemaps warned that 5,000 POL was being removed roughly every 30 seconds.	Team statements linked the reports to rewards payout or internal top-up activity.
Was it a contract exploit?	Bubblemaps initially described it as a Polymarket contract exploit.	Polymarket-linked accounts said findings pointed away from contracts or core infrastructure.
Were user funds affected?	The first alert advised users to pause activity.	Shantikiran Chanal and Polymarket Developers said user funds and market resolution were safe.
What remains unresolved?	The live loss estimate was about $600,000 at Bubblemaps’ alert.	The final loss amount, full affected-address set, and remediation details were still unsettled.

Polymarket’s stablecoin launch looks bearish for USDC, but the real shift runs deeper

Polymarket’s new token may not cut USDC demand, but it could make that demand harder to see and easier to misread.

Apr 7, 2026 · Andjela Radmilac

Team statements pointed to a Polymarket private key compromise

The clearest official wording came from the Polymarket Developers account, which framed the incident as a Polymarket private key compromise involving a wallet used for internal top-up operations.

That phrasing moves the incident out of the category of a direct smart-contract vulnerability and into a more operational question: who controlled the key, how it was exposed, and why the affected process kept sending POL into an address that could be drained.

Chanal’s statement used similar language, saying the reports were linked to rewards payout and that findings pointed to a private-key compromise of a wallet used for internal operations. In replies to users, Chanal said wallets were “completely safe” and said the team was investigating backend systems and secrets while rotating keys.

Mustafa, another Polymarket-linked source, gave the most direct explanation of the contract distinction. He said “The CTF contract is not exploited,” adding that the issue involved an internal ops address used by a service that checks and refills balances every few seconds.

He also said all user funds were safe and that the address was being rotated.

Polymarket’s own documentation helps explain the stakes behind that distinction. The platform says markets use UMA for resolution and that winning positions are redeemed after resolution through CTF-related mechanics.