Polymarket internal top-up wallet (May 2026) hack — May 2026

On the morning of 22 May 2026 the investigator ZachXBT reported that a Polymarket admin address on Polygon appeared to have been compromised, with more than $520,000 drained at the time. At 08:51 UTC Bubblemaps warned that attackers were removing 5,000 POL roughly every 30 seconds and that about $600,000 had gone; at 09:46 UTC it said withdrawals had stopped at about $700,000, split across 16 addresses and routed through ChangeNOW and deposit addresses at HTX and KuCoin.

Polymarket’s developer account said at 09:27 UTC that the findings pointed to a private-key compromise of a wallet used for internal top-up operations, linked to rewards payouts, and not to its contracts or core infrastructure, and that user funds and market resolution were safe. Polymarket developer Josh Stevens called it a very old key. According to later coverage the company rotated the key, revoked production permissions and moved its keys to a managed key-management system.

The loss fell on Polymarket rather than its users. No final figure and no recovery of the funds have been published.