Polymarket said a six-year-old leaked private key caused a $573,200 unauthorized outflow from an internal operations wallet tied to top-up or rewards functions, not from customer accounts or core platform systems. The company said user funds remained safe, no smart contract exploit was found, and its oracle system and UMA contracts were unaffected. As part of its response, Polymarket said it rotated the compromised key, revoked all production access, and plans to migrate all keys to KMS. As of May 22, $164,000 had been frozen or recovered, though public reporting has not fully clarified that distinction. Earlier reports cited varying loss figures ranging from more than $520,000 to roughly $700,000, but Polymarket’s latest disclosed amount was $573,200.