Polymarket Security Breach Drains $520K–$700K via UMA/Polygon Key Leak

Polymarket security breach: investigators reported that suspicious outflows from Polymarket-linked contracts on Polygon (POL) led to crypto losses estimated at about $520,000–$700,000. Blockchain investigator ZachXBT flagged the issue after a highly regular pattern of withdrawals from addresses tied to Polymarket’s UMA CTF Adapter. The attacker reportedly removed roughly 5,000 POL every 30 seconds, with funds mainly in USDC and POL moving to an attacker-controlled address. Polymarket said the Polymarket security breach did not compromise its core smart contracts and did not affect user funds. The root cause was an exposed private key from an internal operations wallet (around six years old) used for rewards payouts and system top-ups. The team rotated keys, revoked permissions, and worked with ZachXBT and exchanges to trace and attempt recovery, including freezing about $164,000 of the drained value. For traders, the key takeaway is that UMA/Optimistic Oracle settlement integrations can add smart-contract and key-management attack surfaces. While Polymarket’s market operations and resolutions reportedly continued without interruption, the incident can still raise short-term sentiment volatility around prediction-market infrastructure and POL-linked activity.