A critical security breach has hit the prediction market platform Polymarket, as an attacker drained approximately $520,000 from a UMA CTF adapter contract deployed on the Polygon network. On-chain analyst ZachXBT first reported the incident through his Telegram channel, triggering swift attention from the crypto security community.
The exploited contract serves as a bridge between Polymarket’s conditional token markets and UMA’s Optimistic Oracle, which is responsible for verifying real-world event outcomes and settling bets. According to PolygonScan data, the suspicious activity involved a wallet identified as 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91, which interacted with several contracts before consolidating funds through intermediary transactions. Another related contract (0x91430CaD2d3975766499717fA0D66A78D814E5c5) and a depleted wallet (0x871D7c0f9E19001fC01E04e6cdFa7fA20f929082) were also linked to the exploit.
Neither Polymarket nor UMA has issued an official statement or clarified whether user funds were directly affected. The lack of immediate disclosure has left the community on edge, especially as the adapter architecture is crucial for market settlement and dispute resolution. This incident adds to a growing list of smart contract exploits on Layer 2 networks and underscores the risks of complex cross-protocol dependencies. Security experts are calling for more rigorous auditing of adapter contracts, and the DeFi space now awaits a post-mortem from the teams involved.
