According to prominent onchain sleuth ZachXBT, bad actors compromised a Polymarket admin address deployed on the Polygon network. The attacker swiftly emptied the balances and began routing the liquidity into their own wallets. The project team has already owned up to the incident and deployed an emergency audit of their backend systems.
Scale of the exploit
Blockchain analysts initially suspected a vulnerable flaw within the smart contracts themselves. However, later reports confirmed a total takeover of an operational wallet instead. By the time the exploit was caught, the hacker had already managed to siphon off roughly $520,000.
The malicious activity targeted an internal address utilized by the team for technical operations. The hacker struck two operational wallets before funneling the stolen digital dollars into their main stash.
The team responds
The Polymarket crew reacted swiftly to the breach, shedding light on the vulnerability. Project developer Shantikiran Chanal confirmed that the attack specifically targeted the rewards payout segment.
"Findings point to a private key compromise of a wallet used for internal operations, not contracts or core infrastructure. User funds and market resolution are safe," Chanal stated.
The developer added that team engineers are currently in the middle of an emergency key rotation across backend services while hunting for any other internal secrets that might have been exposed. The code updates are expected to wrap up "very soon."
