Odaily Planet Daily reports: Josh, Vice President of Engineering and DeFi at the prediction market Polymarket, posted on X that the security incident was caused by a private key that had been compromised for six years; this key was used for internal top-up configurations, which is why some funds were sent to that address.
Josh added that the Polymarket team has completed private key rotation, revoked all production environment permissions, and plans to migrate all private keys to a Key Management Service (KMS) rather than continuing to store them traditionally. Additionally, neither Polymarket nor its UMA contracts have been compromised; all user funds are secure, and the platform remains fully operational.