Polymarket Suffers $520K Loss from Private Key Compromise

• •Polymarket lost over $520,000 due to a private key compromise, not a smart contract exploit.
• •The attacker drained funds at a rate of 5,000 POL tokens every 30 seconds from an internal wallet.
• •Polymarket confirmed that user funds and core infrastructure remain secure despite the breach.

On May 22, 2026, Polymarket experienced a security incident resulting in over $520,000 drained from its UMA Conditional Token Framework (CTF) Adapter on the Polygon network. Blockchain investigator ZachXBT flagged suspicious outflows, leading to the discovery that an internal operations wallet's private key had been compromised. The attacker siphoned approximately 5,000 POL tokens every 30 seconds, but Polymarket confirmed that no user funds or core smart contracts were affected. The breach highlights operational security vulnerabilities rather than technical flaws in the smart contracts. Polymarket is currently investigating the incident and has initiated key rotation procedures to enhance security. The exploit has raised concerns about the overall safety of decentralized finance (DeFi) platforms, particularly regarding private key management.