Polymarket exploited for $700K in private key hack

Attackers have exploited prediction market platform Polymarket and stolen roughly $700K worth of crypto in a presumed private key hack. The post Polymarket exploited for $700K in private key hack…

Jacob Lyon · 22 May 2026 · 3 min read

Wire content from Protos

Attackers have reportedly hit prediction market platform Polymarket with a private key hack and stolen roughly $700,000 worth of crypto.

Crypto sleuth ZachXBT first flagged the attack earlier today, noting, “A Polymarket deployer address appears to have been compromised on Polygon.”

Crypto security firm Bubblemaps later confirmed that an exploit was underway and that the hacker was stealing 5,000 POL ($460) every 30 seconds.

It added that the stolen funds were split across 16 addresses before being moved to centralised crypto exchanges, and that ~$700,000 has been stolen so far.

Polymarket’s developer X account said it is aware of the incident “linked to rewards payout,” and claimed, “user funds and market resolution are safe.”

It claimed, “Findings point to a private key compromise of a wallet used for internal top-up operations, not contracts or core infrastructure.”

We’re aware of the security reports linked to rewards payout. User funds and market resolution are safe.

Findings point to a private key compromise of a wallet used for internal top-up operations, not contracts or core infrastructure.

More updates to follow.

— Polymarket Developers (@PolymarketDevs) May 22, 2026

The response from Polymarket’s developer X account.

Polymarket developer Josh Stevens also noted that the incident is “not a contract hack,” and that it’s likely a compromise of an old private key.

The funds were taken from a crypto address associated with Polymarket’s UMA system, the platform’s oracle system that relies on tokenholders to resolve disputes on disputed outcomes.

The attacker’s last transaction from this UMA address was at 09:00 UTC, roughly 40 minutes before time of writing.

Week of hacks, insider trading, and inquiries for Polymarket

It’s been a turbulent week for Polymarket, with the firm also being the subject of an inquiry in South Korea over potential gambling violations.

The country’s Korea Communications Standards Commission wants to know if the platform’s services constitute gambling.

Bubblemaps also suspects that a large case of insider trading has been taking place on the platform that involves the leaking of US military secrets.

“We spotted nine Polymarket accounts, all connected, who made, collectively,$2.4 million betting almost exclusively on U.S. military operations,” says Nicolas Vaiman, co-founder of the small data analytics firm Bubblemaps.

“And now here's the crazy part: 98% win rate.”… pic.twitter.com/YQmRSn30UW

— 60 Minutes (@60Minutes) May 17, 2026

Bubblemap’s findings were shared on the interview show 60 Minutes.

Bubblemaps claims that nine accounts were able to make over $2.4 million betting on military markets with a 98% win rate.

The firm has repeatedly drawn criticism over insider trading, and has witnessed suspicious trades on markets involving Israeli strikes against Iran and the US’s kidnapping of Venezuelan President Nicolás Maduro.

Polymarket launched a new type of trading this week that allows users to bet on future valuations, IPO timings, and secondary share price action involving private companies such as OpenAI, SpaceX, and Anthropic.

Polymarket also reportedly appointed a Japanese representative as it lobbies for regulatory approval within Japan.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

This article originally appeared on Protos. Read the full article at the source: https://protos.com/polymarket-exploited-for-700k-in-private-key-hack/