Polymarket Recovers $164,000 After Private Key Compromise Hit Internal Wallet, Not Core Systems

Polymarket Recovers $164,000 After Private Key Compromise Hit Internal Wallet, Not Core Systems

Polymarket said a compromised old private key affected an internal rewards and top-up wallet, while user funds and core systems remained unaffected; reported losses ranged from about $573,200 to roughly $700,000.

BTC
POL

Fact Check
The core claim — that ZachXBT reported an exploit of the Polymarket UMA CTF Adapter contract on Polygon, with losses rising from over $520,000 to over $660,000 — is strongly corroborated by multiple independent sources published on May 22, 2026. PANews and Odaily (both credible Chinese crypto news outlets) directly cite ZachXBT's Telegram channel as the primary source and confirm the $520,000+ initial figure. BeInCrypto's official X account independently corroborates the $520K figure and the attacker address. The $660,000 upper figure is explicitly cited in the X post by @cryptothedoggy, consistent with the claim's framing of losses escalating over time as the exploit was ongoing. The attacker address (0x8F98075db5d6C620e8D420A8c516E2F2059d9B91) and two affected contract addresses are cited consistently across sources. No source contradicts the claim. The slight uncertainty (0.09 false probability) reflects that the $660K figure is less widely corroborated than $520K, and ZachXBT's original Telegram post could not be directly fetched to verify the exact wording.
Summary

Polymarket said suspicious Polygon activity and a live POL drain were caused by a compromised old private key affecting an internal operations wallet used for rewards distribution and top-up functions, not by a flaw in its smart contracts or core market infrastructure. The platform said user funds remained safe and that contracts, market resolution, settlement systems, and core infrastructure were unaffected. Reported loss figures varied across updates and reports, ranging from more than $520,000 to over $660,000, about $600,000, $573,200, and roughly $700,000. Polymarket vice president of engineering Josh Stevens said $164,000 in funds had been recovered or frozen with help from ZachXBT, Bitcoin Vietnam, and ChangeNOW.

Terms & Concepts
  • Private key: A secret cryptographic credential that controls access to a blockchain wallet and authorizes transactions.
  • POL: The native token of the Polygon network, used for transactions, gas fees, and related on-chain transfers.
  • Exploit: The use of a security weakness or system flaw to gain unauthorized access or extract funds.