decrypt.co Polymarket Exploit: $700K Drained from Internal Wallet
Article Content
- •Polymarket confirmed a $700,000 loss from an internal wallet exploit.
- •User funds and market outcomes are reported to be safe.
- •The incident is linked to a private key compromise.
On October 29, 2026, Polymarket reported a security incident involving the compromise of an internal top-up wallet, resulting in the drain of approximately $700,000 across 16 addresses. On-chain investigator ZachXBT flagged the incident, noting that over $520,000 had been taken from addresses linked to Polymarket's Polygon infrastructure. Polymarket developers confirmed that user funds and market outcomes remain safe, attributing the incident to a private key compromise of the internal wallet rather than a breach of core infrastructure. The exact method of the attack and the total number of affected users have not been disclosed. The incident is under investigation, with further updates expected from Polymarket.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track Polymarket in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
How much was drained?
Are user funds affected?
What caused the exploit?
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
KeyDrift Malware Exploits Cisco SD-WAN Flaw CVE-2026-20127 Cisco Talos reported that the advanced persistent threat group UAT-11473 exploited a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controllers. This flaw, which has a CVSS score of 10.0, allows unauthorized remote access to administrative privileges. The group deployed a custom…