Overview
- Polymarket disclosed on May 22, 2026 that a compromised private key tied to an internal ‘top‑up’ or rewards wallet allowed attackers to siphon POL tokens without affecting core contracts or market resolution.
- On‑chain investigators first flagged rapid outflows and a pattern of roughly 5,000 POL transferred about every 30 seconds, with public loss estimates updating from roughly $520,000 to about $600,000–$700,000 as funds moved into many addresses.
- Security firms and Polymarket engineers say this appears to be an operational key‑management failure rather than a smart‑contract exploit, pointing to shortcomings in credential rotation and access controls for admin wallets.
- The stolen POL was split across roughly 15–16 addresses and routed through exchange and swap services, including ChangeNOW, which complicates tracing and makes recovery dependent on cooperation from those services.
- Polymarket has paused withdrawals as a precaution, rotated affected keys, started a review of internal secrets, and said a full post‑mortem and definitive loss accounting will follow as on‑chain analysts continue tracing the flows.