Polymarket Exploit Exceeds $520,000 as DeFi Hacks Rise in May

Polymarket Smart-Contract Exploit Drains Over $520,000 – On-Chain Analysts Urge Users to Pause Activity

Key Takeaways

• An apparent exploit of Polymarket’s UMA CTF Adapter smart contract has resulted in losses exceeding $520,000.
• On-chain investigator ZachXBT publicly flagged the incident and identified the attacker address as 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91.
• According to Bubblemaps, the stolen funds have been dispersed across 15 separate addresses.
• DeFiLlama data shows 19 DeFi-related hacks in May so far, with total monthly losses of approximately $38.2 million.

Exploit Targets Polymarket’s UMA CTF Adapter Smart Contract

On-chain investigator ZachXBT has issued a public alert regarding an apparent exploit affecting Polymarket. The incident involves the platform’s UMA CTF Adapter, a smart contract that enables Polymarket’s prediction markets to settle outcomes using UMA’s Optimistic Oracle.

According to the alert, attackers have drained more than $520,000 so far. The activity was flagged in real time, with monitoring accounts reporting that 5,000 POL tokens were being removed approximately every 30 seconds at one stage of the exploit. Bubblemaps, an on-chain analytics platform, reported that around $600,000 had been stolen at the time of its alert.

ZachXBT identified the address allegedly associated with the exploit as 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91. Publicly naming blockchain addresses is a common practice in on-chain investigations, as transactions can be independently verified on distributed ledgers.

At the time of reporting, the full scope of the exploit had not been officially confirmed by Polymarket. BeInCrypto stated that it had contacted the company for comment, but no formal response had been published.

Stolen Funds Dispersed Across 15 Addresses

Blockchain data cited by Bubblemaps indicates that the proceeds from the exploit were distributed across 15 separate wallet addresses. This pattern is frequently observed in the early stages of on-chain laundering attempts, where funds are split and moved through multiple wallets to complicate tracking efforts.

Such dispersal techniques can make recovery more difficult, particularly in decentralized finance environments where transactions are irreversible once confirmed on-chain. For users of decentralized platforms, this highlights the operational risks associated with smart-contract vulnerabilities and the speed at which funds can be moved once an exploit is executed.

The alerts circulating on social media included warnings to pause Polymarket activity until further clarification. However, as of the latest available information, there has been no official statement detailing whether contracts were paused, patched, or otherwise modified.

Role of the UMA CTF Adapter in Market Settlement

The exploited contract, the UMA CTF Adapter, plays a specific role within Polymarket’s infrastructure. It connects prediction markets to UMA’s Optimistic Oracle, which is used to resolve outcomes.

In prediction markets, accurate and tamper-resistant settlement mechanisms are critical. Smart contracts automate payouts based on oracle-reported outcomes. If a contract responsible for interfacing with an oracle is compromised, it can directly affect the integrity of market resolution and user funds.

For users who rely on decentralized prediction markets for event-based trading or hedging, the incident underlines the importance of understanding which smart contracts govern deposits, settlement, and withdrawals. Even when core market logic remains intact, vulnerabilities in adapter or bridge contracts can expose funds to risk.

May Records 19 DeFi Hacks With $38.2 Million in Losses

The Polymarket incident occurs during a broader increase in decentralized finance exploits this month. According to DeFiLlama data cited in the report, May has already seen 19 separate hacks.

Five of those incidents reportedly occurred within the past week alone. Cumulative losses across the 19 cases have reached approximately $38.2 million.

This data places the Polymarket exploit within a wider pattern of elevated security incidents in DeFi protocols. While each exploit typically involves distinct technical vulnerabilities, the aggregate figures illustrate the continued exposure of smart-contract based platforms to code-level and integration risks.

For users who interact with decentralized protocols, including prediction markets and other blockchain-based applications, monthly hack statistics provide a measurable indicator of ecosystem risk. Even when individual losses vary in size, repeated incidents can influence user behavior, liquidity levels, and platform activity.

Implications for Crypto-Based Market Participants

Polymarket operates in the crypto-native prediction market segment, where users deposit digital assets into smart contracts to trade on event outcomes. In such systems, trust is placed in audited code and decentralized settlement mechanisms rather than traditional intermediaries.

When a smart contract exploit occurs, users may face temporary uncertainty regarding withdrawals, market settlement, or token value stability. Although no official platform-wide measures have been confirmed in this case, on-chain alerts advising users to pause activity reflect common risk management behavior in decentralized communities during active incidents.

The identification of the attacker address and the tracking of fund dispersal demonstrate the transparency of public blockchains. At the same time, the speed of fund movement illustrates the operational challenges involved in mitigation and recovery once an exploit has begun.

Our Assessment

The reported exploit of Polymarket’s UMA CTF Adapter has resulted in losses exceeding $520,000, with stolen funds distributed across 15 wallet addresses. The incident was flagged by on-chain investigator ZachXBT, and no official response from Polymarket had been confirmed at the time of reporting. Occurring amid 19 DeFi hacks in May totaling approximately $38.2 million in losses, the event forms part of a broader pattern of smart-contract related security incidents in decentralized finance this month.