Polymarket is dealing with a security scare after suspicious on-chain activity was flagged on Polygon, revealing that a compromised private key allowed unauthorized outflows from an internal operations wallet. The damage: somewhere between $520,000 and $700,000 in POL tokens, siphoned off and scattered across more than a dozen wallet addresses.
The good news, if you can call it that, is this wasn’t a smart contract exploit. The bad news is that the key in question was reportedly six years old, which raises a different kind of question entirely.
What happened and how it was caught
On-chain investigator ZachXBT was the first to flag the suspicious activity. He spotted unusual outflows from Polygon addresses tied to Polymarket’s UMA Conditional Tokens Framework adapter infrastructure. In English: these were internal wallets the platform uses for backend operations and top-ups, not the contracts that handle user bets or market settlements.
At the initial stage, roughly 5,000 POL tokens were being drained every 30 seconds. That’s the kind of pace that doesn’t exactly scream “authorized transaction.”
