The cryptocurrency community has expressed concern over a potential security incident involving infrastructure related to Polymarket on Polygon, after on-chain analysts noticed unusual contract activity. Large outflows of funds.
Related wallet exposure
According to browser alerts and blockchain monitoring channels, over $520,000 in assets appear to have been stolen from addresses associated with the Polymarket UMA CTF adapter system. This system connects Polymarket’s conditional token markets to UMA’s oracle to enable payments on Polygon.
As of press time, neither Polymarket nor UMA has disclosed the nature of the incident or whether user funds were directly affected.
This wallet has been identified as a potential attacker: 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91.
PolygonScan's blockchain records show that the address interacted with multiple contracts and received funds through a series of transactions detected by on-chain observers shortly before the reported fund loss. Additionally, researchers identified the following related contract potentially connected to the incident: 0x91430CaD2d3975766499717fA0D66A78D814E5c5.
Meanwhile, we have found that the wallet at the following address has been depleted in connection with this event: 0x871D7c0f9E19001fC01E04e6cdFa7fA20f929082.
Infrastructure risk has emerged
Polymarket’s settlement infrastructure on Polygon appears to be connected to the UMA CTF adapter architecture. This adapter system is critical for market settlement and dispute resolution procedures, as it enables the connection between conditional token markets and UMA oracle outcomes.
The attack vector is currently unclear.
After independent investigators and traders began tracking on-chain fund flows, this suspected vulnerability quickly drew attention from the cryptocurrency security community.
Shortly after the initial illegal activity was detected, the attackers used intermediate transactions to consolidate their assets.
The Polymarket team has not yet released an official post-mortem or incident response report. The investigation is still ongoing.
