Polymarket Drained: $600K Exploit—What is Happening?
Polymarket Drained: $600K Exploit—What is Happening?
A Polymarket smart contract hack has just exploited more than $520,000, puncturing confidence in one of DeFi’s most trusted prediction market platforms.
On-chain investigator ZachXBT flagged the exploit live on Telegram, identifying the attacker’s wallet 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91 and confirming losses of north of $520,000. Bubblemaps placed the figure closer to $600,000 as the drain was still active.
This Polymarket exploit has cracked the blue-chip perception that surrounded the protocol.
Explore: High-Potential Low Caps Hitting New ATHs
Polymarket Exploit Drains $520K as Unaudited Smart Contract Vulnerability Shakes Prediction Market Confidence
The technical failure here is specific and instructive. Polymarket’s core exchange contracts received a formal ChainSecurity audit in 2021–2022, but the UMA CTF Adapter was never included in that review. This is the contract the attacker hit.
As on-chain alert source ProMint noted, the adapter “acts as a bridge between the platform and the UMA oracle,” and it was via that bridge that the attacker manipulated the system to extract funds.
The withdrawal cadence tells the story clearly: 5,000 POL tokens removed every 30 seconds via an automated script. The stolen proceeds were then dispersed across 15 separate wallet addresses in a fragmentation pattern designed to slow chain-of-custody tracing.
PeckShield subsequently flagged a portion of the funds routing toward non-KYC exchange ChangeNOW, an early off-ramp attempt before any confirmed mixer or cross-chain bridge movement.
Discover: Institutional Buy Signals for April
Follow CoinNews on X and Telegram for the Latest Crypto Market Updates and Professional Market Analysis.
