A wallet linked to Polymarket’s UMA CTF Adapter was caught in an active exploit, with onchain analytics firm Bubblemaps saying the attacker was pulling 5,000 POL every 30 seconds. At the time of its alert on May 22, the reported loss had already climbed to more than $600,000, and the drain was still underway.
Onchain investigator ZachXBT issued a matching warning as the incident unfolded. Polymarket later said the compromised wallet was used for internal deposit purposes, was separated from user funds, and was not related to market settlement. That clarification narrowed the direct exposure, but it did not change the fact that the exploit was live.
Stolen funds moved across 15 addresses
According to the source material and onchain traces, the main attacker address was flagged as 0x8F98…9B91. ZachXBT said the stolen assets had already been split across 15 separate wallets. Rapid fragmentation of funds is a common early step before laundering, especially when attackers want to reduce traceability before moving assets again.
The report describes the UMA CTF Adapter as a core settlement component for Polymarket’s prediction markets. It handles result verification and settlement through UMA’s Optimistic Oracle. Based on that role, Bubblemaps urged users to stop all Polymarket activity immediately while the attack was still in progress.
Another security incident for Polymarket in a heavy month for DeFi
The article says this was the third recent security-related issue involving Polymarket. Earlier incidents included account takeovers tied to a third-party login provider vulnerability, along with data leak allegations that the company later denied. The latest exploit puts the platform back under security scrutiny.
The same source said DeFi saw a concentrated wave of attacks in May, with five separate hacking incidents in one week and 19 incidents for the month, bringing total losses to about $38.2 million. One day earlier, THORChain had introduced its ADR028 recovery plan following a $10.7 million hack. The Polymarket exploit adds to that running tally.