Onchain investigator ZachXBT flagged suspicious outflows from Polymarket's UMA CTF Adapter infrastructure on Polygon, with approximately $573,200 reportedly drained from two addresses as of early Friday. According to reports from The Block, Polymarket confirmed the incident in a Discord message, stating that findings point to a possible private key compromise of a wallet used for internal top-up operations rather than any breach of contracts or core infrastructure. The company emphasized that user funds and market resolution are safe during the investigation. Analytics firm Bubblemaps later warned users to pause activity as the attacker steadily pulled roughly 5,000 POL tokens every 30 seconds, with the stolen assets moving across 16 wallets before reaching crypto exchanges.
As reported by The Block, ZachXBT identified the address tied to the suspected exploit on Polygon as 0x8F980...d9B91, with PolygonScan labeling one related address as "Polymarket Adapter Exploiter 1." The contract referenced in the alert is 0x91430...4E5c5. According to ZachXBT's analysis, two related addresses appear to have been drained, including 0x871D7...29082 and 0xf61e3...94805. Blockchain analysts Lookonchain put the total drained at more than $500,000 as of Friday morning, up from the $520,000 initially flagged by ZachXBT. The compromised wallet sat near Polymarket's UMA CTF Adapter, the layer that settles prediction markets through an oracle, though Josh Stevens, VP of Engineering for DeFi at Polymarket, stressed that the administrative reward wallet operates separately from that resolution machinery.
According to The Block, Josh Stevens, VP of Engineering for DeFi at Polymarket, separately confirmed that the incident was not a contract hack and appeared to involve a compromised private key. PeckShield independently corroborated ZachXBT's analysis, noting that a portion of the funds was later deposited into ChangeNOW, a non-custodial exchange. Stevens later wrote on X that ZachXBT, crypto exchange Bitcoin Vietnam, and ChangeNOW coordinated to freeze $164,000 of the $573,200 transferred from the compromised private key. As reported by The Block, Stevens described the coordination as "a really was a team effort, and it was amazing how quickly everyone reacted." Researchers note that the adapter is custom code that sits outside the audited core protocol, representing a recurring weak point for prediction markets.
The breach coincided with fresh regulatory scrutiny as South Korea's Korea Communications Standards Commission opened a formal review into whether Polymarket hosts illegal gambling content under national law. A commission official confirmed the review followed a recent complaint against the platform. This adds to Polymarket's ongoing enforcement challenges in 2026, including shutdown orders in Portugal and Hungary, civil action in Nevada, and cease-and-desist notices from Tennessee. The platform secured U.S. approval from the Commodity Futures Trading Commission in late 2025, yet state regulators have continued pressing their own claims. Analysts note the timing matters because South Korea could move to block access, mirroring steps already taken by France, Germany and Italy, leaving Polymarket expanding and contracting simultaneously while banned in dozens of jurisdictions.
