Polymarket Rewards Wallet Drained of About $700K in Private Key Compromise
Polymarket said a compromised private key tied to an internal rewards top-up wallet led to losses estimated at $520,000 to $700,000, depending on the source. The company said user funds, market outcomes and core contracts were not affected.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Happened
An internal Polymarket rewards wallet was drained on Friday after a private key was compromised, according to the company's developers. On-chain investigator ZachXBT first flagged the suspected drain, citing losses above $520,000 from addresses linked to the prediction market's Polygon infrastructure.
The loss estimate has since risen. Bubblemaps put the total at about $700,000 more than an hour after the initial disclosure, saying the funds were split across 16 addresses and routed through centralized exchanges and other services. Crypto Briefing reported the same roughly $700,000 figure and said the outflows initially ran at 5,000 POL tokens every 30 seconds, a pattern it described as consistent with automation. The sources differ on the timeline and the mechanics of the exit, and no single source has published a fully reconciled ledger.
Scope of the Breach
Polymarket's developers said the incident involved a wallet used for internal top-up operations, and that the compromise was of a private key rather than of contracts or core infrastructure. The company stated that user funds and market resolution are safe. Crypto Briefing described the wallet as a legacy administration address used to distribute user engagement rewards, and said the private key dated back six years.
Prediction markets on Polymarket rely on contracts that record bets and pay winners after an outside service confirms the result. Based on the reporting available, the affected wallet was separate from those contracts and from the settlement process.
Security Researchers' Assessment
Andy Yajin Zhou, associate professor at the Chinese University of Hong Kong and co-founder of on-chain security firm BlockSec, told Decrypt that his initial review was consistent with the company's account. He said the team had not identified evidence of a protocol-level exploit, oracle manipulation or a generalized vulnerability in adapter-based market infrastructure.
Blockchain security firm Cyvers reached a similar conclusion that the incident affected operational or admin wallets rather than core contracts. Cyvers senior security operation lead Hakan Unal said that even secure smart contracts leave privileged adapter or admin wallets as a critical attack surface when key management is compromised.
Recovery Efforts and Industry Context
Crypto Briefing reported that roughly $164,000 of a $573,000 portion was frozen, meaning most of the stolen value had already moved through exchanges and mixing services. Decrypt reported that suspected withdrawals had stopped. Neither outlet has published a final figure for recovered funds.
Dan Dadybayo, strategy lead at Horizontal Systems, told Decrypt that the incident looks more like a key management failure than a smart contract exploit, and that attackers are increasingly targeting admin wallets, permissions and infrastructure around protocols. Polymarket has said it is investigating and has not yet disclosed how the key was stored, who had access, or what rotation policies applied. Decrypt said it had requested comment from Polymarket and that the story is developing.
Why It Matters
For Traders
Traders with positions on Polymarket should note that the company says market settlement and user balances were untouched, though the final loss figure and recovery status remain unresolved.
For Investors
The incident highlights operational security risk around privileged wallets, a governance and risk-management question that may matter as prediction markets scale.
For Builders
Teams running legacy admin or rewards wallets should audit key age, rotation policy and signing controls, since privileged keys remain a weak point even in secure contracts.
This article is for information only and is not financial advice. Read the full disclaimer.
