Polymarket, the largest web3-based prediction market platform, reported a compromise of its 6-year-old internal private key used for top-ups and rewards on May 22, 2026.
As of press time, Polymarket had lost roughly $700,000, drained through the Polygon (POL) network, according to on-chain metrics from Polygonscan analyzed by Finbold. The stolen funds were split across 16 addresses and routed through several crypto exchanges, including HTX, KuCoin, and ChangeNow.
The incident was first reported by ZachXBT, an on-chain sleuth, who raised the alarm that Polymarket’s Universal Market Access (UMA) Conditional Token Framework (CTF) Adapter contract on Polygon was likely exploited.
However, Josh Stevens, Polymarket’s Vice President of Engineering, confirmed that no internal contracts were exploited, but rather an old private key. As such, Stevens stated that users’ funds remain safe and the platform can be used as usual.
“This was in the internal top-up config, which is why funds were being sent to it. We have rotated this key, revoked all prod permissions, and are moving all PKs to KMS keys from now on,” Stevens noted.
What’s the market implication of the Polymarket attack?
The successful attack on Polymarket, which managed to siphon funds for the first time, raised concerns among users. Moreover, Polymarket is heavily used by automated trading bots, which could lead to significant fund losses if the contracts were compromised.
Additionally, the notable security risk could be an advantageous edge for its competitors, led by the Kalshi prediction platform. Furthermore, this platform has amassed a significant user base in the recent past due to its deep on-chain liquidity backed by institutional investors. However, the severity of the recent attack may be minimal, as no user funds were stolen.
