Polymarket suffers live POL drain as team rules out feared contract exploit

Here is the latest from the digital-asset markets: Polymarket faced what many users interpreted as a possible hack on May 22 after public alerts described a rapid POL drain on the prediction market platform. Polymarket-linked accounts later said the incident was not a smart-contract exploit and did not affect user funds or market resolution. The first wave of concern came from on-chain investigator ZachXBT and blockchain analytics firm Bubblemaps.

ZachXBT said a Polymarket admin address appeared to have been compromised on Polygon, with more than $520,000 drained at the time of his Telegram alert. Bubblemaps then warned that attackers were removing 5,000 POL roughly every 30 seconds and that about $600,000 had been stolen so far, while advising users to pause Polymarket activity. Polymarket's later explanation shifted the issue away from core-market failure and toward an internal operational security breach.

Market Dynamics

Findings pointed to a private-key compromise of a wallet used for “internal top-up operations,” according to Polymarket Developers, rather than “contracts or core infrastructure. ” Polymarket software engineer Shantikiran Chanal similarly said, “User funds and market resolution are safe,” adding that the issue was linked to rewards payout reports. That implies different risks.

A contract or resolution failure would raise questions about whether markets could settle correctly or whether user positions were exposed. An internal funding-wallet compromise, while still serious, points instead to key management, refiller services, and operational controls around wallets that support the platform. Related Reading Crypto finds $64B product market fit in 2025 but reliance on centralized logins has created a critical security flaw Mainstream adoption of prediction markets raises systemic trust challenges and highlights ambiguities in resolution mechanisms for crypto platforms.

Feb 11, 2026 Oluwapelumi Adejumo The public alert moved faster than the private key compromise explanation The timeline moved quickly. ZachXBT's Telegram post at 08:22 UTC described a Polymarket admin address as apparently compromised on Polygon and identified the attacker address as 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91. The same post listed related and drained addresses, giving on-chain analysts a trail to follow.

Market Impact

Bubblemaps amplified the warning at 08:51 UTC, describing the situation as a Polymarket contract exploit, the kind of Polymarket exploit alert that would raise immediate concern about core infrastructure, and saying the attacker was removing 5,000 POL every 30 seconds. On-chain data show why the warning drew attention. A PolygonScan transaction at 09:01:19 UTC shows 5,000 POL moving into a Polymarket-labeled UMA CTF Adapter Admin address.

Seven seconds later, another PolygonScan transaction shows 4,999. 994 POL moving from that labeled admin address to the labeled attacker address. The attacker address page is tagged by PolygonScan as “Polymarket Adapter Exploiter 1” and shows repeated transfers around the alert window.

That transaction pair supports the visible drain pattern that triggered the public alarm and gives a concrete example of the kind of transfer flow that Polymarket team members later described as involving an internal refiller, while leaving root cause to the team's statements. Bubblemaps warned that 5,000 POL was being removed roughly every 30 seconds. Team statements linked the reports to rewards payout or internal top-up activity.

This shift continues to shape the digital-asset landscape, with analysts examining its near-term effects.