Polymarket Smart Contract Exploited for Over $600,000 on Polygon

An attacker exploited Polymarket's UMA CTF Adapter smart contract on Polygon on May 22, 2026, draining over $600,000 as the attack continued. Blockchain investigator ZachXBT flagged the ongoing exploit, which targeted the world's largest prediction market platform. The attacker removed approximately 5,000 POL tokens every 30 seconds, with losses climbing from an initial $520,000 to more than $660,000.

Polymarket smart contract exploit

• ▪The Polymarket exploit resulted in losses exceeding $600,000.
• ▪An attacker exploited Polymarket's UMA CTF Adapter contract on Polygon on May 22, 2026.

UMA CTF Adapter vulnerability

• ▪The attacker drained funds from Polymarket's UMA CTF Adapter contract on Polygon.
• ▪The UMA CTF Adapter contract on Polygon was the target of the Polymarket exploit.

Live attack draining funds

• ▪The attacker removed approximately 5,000 POL tokens every 30 seconds during the Polymarket exploit.
• ▪The Polymarket exploit was actively ongoing as of May 22, 2026.

Loss escalation to $660,000

• ▪Losses from the Polymarket exploit climbed from an initial $520,000 to more than $660,000.
• ▪The Polymarket exploit losses exceeded $660,000 as the attack continued.

Security investigator alerts

• ▪Onchain investigator ZachXBT first identified the Polymarket exploit.
• ▪Bubblemaps, Lookonchain, and PeckShield reported on the Polymarket exploit.

6 sources