Polymarket confirms a private key compromise affecting funds on its UMA CTF Adapter contract, with losses estimated at $700,000.
Polymarket has confirmed a security incident involving the UMA CTF Adapter contract on the Polygon network, which has raised alarms among on-chain investigators, including ZachXBT. The platform's team acknowledged the situation and is currently investigating the matter.
Initial findings indicate that the compromise may have stemmed from a leak of a private key associated with a wallet used for internal funding, rather than a vulnerability in the contract or core infrastructure.
Security firm PeckShield reported that approximately $520,000 was withdrawn from two wallets linked to the incident. Some of the stolen assets were transferred through the non-custodial exchange ChangeNOW, complicating tracking efforts.
#PeckShieldAlert reports that the Polymarket UMA CTF Adapter contract has potentially been exploited. Two addresses have been drained of funds.
According to Bubblemaps, hackers were reportedly extracting around 5,000 POL tokens every 30 seconds, leading to an estimated total loss of $700,000. They noted an end to the suspected withdrawals and confirmed that the stolen funds were distributed across 16 different addresses using various centralized exchanges and services.
Polymarket’s representative, Shantikiran Chanal, emphasized that the incident pertains to reward payouts. He reassured users that their funds and market resolutions remain secure.
Chanal stated, "Findings point to a private key compromise of a wallet used for internal operations, not contracts or core infrastructure. More updates will follow." The UMA CTF Adapter is designed to facilitate market resolution through UMA's Optimistic Oracle.
This incident is part of a troubling trend, as several platforms, including Ekubo and THORChain, have also experienced hacking attempts in recent months.
