Polymarket probes suspected private key compromise of internal top-up wallet on Polygon

Suspicious outflows tied to Polymarket's UMA CTF Adapter infrastructure on Polygon prompted an internal investigation on Friday after onchain investigator ZachXBT flagged funds being drained from two related addresses.

Polymarket confirmed awareness of the incident in a Discord message, saying findings point to a possible private key compromise of a wallet used for internal top-up operations rather than any breach of contracts or core infrastructure. "User funds and market resolution are safe," the message read. Josh Stevens, VP of Engineering for DeFi at Polymarket, separately wrote on X that the incident was not a contract hack and appeared to involve a compromised private key, adding that user funds on the platform are safe.

The UMA CTF Adapter connects UMA's Optimistic Oracle with the Gnosis Conditional Tokens framework used for market resolution on Polymarket.

ZachXBT identified an address tied to the suspected exploit on Polygon as 0x8F980...d9B91. PolygonScan labels one related address as "Polymarket Adapter Exploiter 1." The contract referenced in the alert is “0x91430...4E5c5.” According to ZachXBT, two related addresses appear to have been drained, including “0x871D7...29082” and “0xf61e3...94805.”

Blockchain analysts Lookonchain put the total drained at more than $500,000 as of Friday morning, up from the $520,000 initially flagged by ZachXBT. PeckShield said a portion of the funds was later deposited into ChangeNOW, a non-custodial exchange, as the security firm independently corroborated ZachXBT's analysis.

Stevens later wrote on X that ZachXBT, crypto exchange Bitcoin Vietnam, and ChangeNOW coordinated to freeze $164,000 of the $573,200 transferred from the compromised private key. "Really was a team effort, and it was amazing how quickly everyone reacted," Stevens wrote.

Polymarket is a prediction market platform that lets users wager on the outcome of real-world events using cryptocurrency.

Expand Chart

The company was in talks as recently as April 2026 to raise approximately $400 million at a valuation of roughly $15 billion, following a $600 million strategic investment from Intercontinental Exchange, the parent company of the New York Stock Exchange.

The incident is not the first time Polymarket's underlying infrastructure has drawn scrutiny.

In March 2025, a single actor controlling roughly 25% of UMA's voting power allegedly forced the resolution of a $7 million prediction market to "Yes" despite the underlying event not occurring — what Polymarket reportedly called an "unprecedented" governance attack on the protocol. In December 2025, Polymarket confirmed that several users had lost funds after a vulnerability was discovered in a third-party authentication provider.

Updated with additional details throughout.