Polymarket Exploit Drains 5,000 POL Every 30s via UMA CTF Adapter on Polygon

A Polymarket exploit has reportedly drained about $520,000–$600,000 worth of POL on Polygon after an attacker targeted the Polymarket UMA CTF Adapter smart contract. On-chain monitoring cited by ZachXBT and Bubblemaps shows the attacker extracted roughly 5,000 POL every ~30 seconds during the active drain. The targeted adapter is Polymarket’s project-specific integration layer that connects prediction-market settlement to UMA’s Optimistic Oracle. UMA notes that these “adapter” contracts fall outside UMA’s audited core security model, shifting the focus from UMA’s base protocol to integration-layer risk. The report references a ChainSecurity audit of Polymarket’s core exchange contracts (2021–2022), but says the UMA CTF Adapter was not covered. After the drain, stolen funds were dispersed across 15 wallets to slow tracing and recovery; the latest account says there was no confirmed movement to mixers or cross-chain bridges. For traders, this Polymarket exploit is a near-term sentiment catalyst for oracle-adjacent DeFi. Expect heightened attention to Polygon activity around UMA/oracle adapter calls, and faster liquidity reactions on any follow-up advisories—especially if similar integration risks surface.