Polymarket’s UMA CTF adapter contract for Polygon was exploited for over $520,000

• ZachXBT mentioned Polymarket’s UMA CTF contract on Polygon was misused for greater than $520,000.
• The attacker compromised an outdated non-public key belonging to an inner Polymarket operations pockets.
• This incident raises new considerations in regards to the safety of prediction markets and should have an effect on customers’ belief in Polymarket.

On Might 22, 2026, distinguished on-chain researcher ZachXBT warned that Polymarket’s Common Market Entry (UMA) Conditional Token Framework (CTF) adapter contract on Polygon was probably exploited in an enormous safety breach, with attackers exfiltrating greater than $520,000 so removed from linked addresses, primarily POL tokens and USDC.e.

ZachXBT Studies Alleged Abuse of Polymarket UMA Contract of Over $520,000

ZachXBT flagged suspicious exercise associated to Polymarket’s UMA CTF adapter contract deployed to Polygon. Based on neighborhood reviews and on-chain knowledge, greater than $520,000 was leaked from the adapter, primarily in POL tokens and USDC.e, with some trackers later reporting the overall exceeded $600,000.

The drain exercise included repeated transfers involving roughly 5,000 POLs each 30 seconds from the affected contract addresses, particularly 0x871D7-082 and 0xf61e3-805. The stolen funds are then more likely to stream quickly by means of a sequence of middleman wallets, obscuring the path of transactions and complicating tracing efforts.

Reason for Polymarket UMA adapter exploit

This incident was not the results of a vulnerability or bug within the Stay UMA CTF Adapter good contract code. As an alternative, the perpetrator was a compromise of an outdated non-public key belonging to an inner Polymarket operational pockets.

This pockets had administrator privileges related to the UMA CTF adapter initializer on Polygon. Beforehand, it was used for inner operations corresponding to reward distribution, liquidity replenishment, and associated upkeep work. The attacker at deal with 0x8F980…B91, which controls the compromised keys, signed in and carried out professional transactions, exfiltrating funds immediately from the adapter contract deal with, a few of which had already been deposited into companies corresponding to ChangeNOW, a non-custodian crypto change platform.

Polymarket’s engineering staff confirmed this incident shortly after ZachXBT alerted us. The staff additionally mentioned that consumer stability and positions on the core Polymarket platform won’t be affected, because the adapter’s function is restricted to oracle-related capabilities.

What are the safety implications of Polymarket and prediction markets?

This incident has renewed considerations in regards to the safety of infrastructure throughout decentralized prediction markets, significantly protocols that depend on oracle adapters and sophisticated cross-contract integration. Safety consultants anticipate the breach to speed up calls for for stricter good contract audits, expanded bug bounty packages, stronger pockets controls, and steady on-chain monitoring of Polymarket and related platforms.

Regardless of the exploit, market decision and settlement operations continued with out interruption. It’s because the breach was associated to conventional managed non-public keys on Polygon deployments, quite than vulnerabilities in dwell contract logic or core buying and selling infrastructure.

Nevertheless, this exploit highlights the broader dangers dealing with the prediction markets sector. Even non-custodial infrastructure elements, corresponding to Oracle adapters, can turn into a big assault floor if privileged keys are poorly managed, poorly rotated, or stay energetic after manufacturing use.

Because of this, this incident reinforces the necessity for stronger operational safety requirements, together with multi-signature authentication, {hardware} safety modules, time-lock safety, common credential rotation, and steady safety auditing throughout DeFi oracle programs.

Associated: Polymarket rejects 300,000 knowledge breach claims