Polymarket UMA CTF Adapter, a contract used to resolve markets, has reportedly been hit by a suspected attack worth more than $520,000.
One of the largest prediction markets, Polymarket, is facing a suspected contract incident tied to its market-resolution system.
Blockchain sleuth ZachXBT wrote in a Telegram channel that Polymarket’s UMA CTF Adapter contract on Polygon is suspected of being attacked, with losses exceeding $520,000.
The incident appears to concern resolution infrastructure, not user balances, since the UMA adapter is used to resolve Polymarket markets. But it’s still unclear how exactly the attack was carried out.
The official Polymarket Developers account on X wrote in a post shortly after the news broke that the team is “aware of the security reports linked to rewards payout,” reassuring that “user funds and market resolution are safe.” The team added:
“Findings point to a private key compromise of a wallet used for internal top-up operations, not contracts or core infrastructure.”
Read also: Polymarket Launches Markets on IPO Timing and Valuations
Polymarket UMA Adapter Under the Spotlight
According to blockchain analytics X account PeckShield, the attacker has already deposited a portion of the stolen funds into ChangeNOW, a non-custodian crypto exchange platform.
Polymarket’s own developer materials describe the UMA CTF Adapter as the contract layer that lets Polymarket prediction markets resolve through UMA’s Optimistic Oracle, an outside oracle system used to settle disputed real-world outcomes.
Polygon’s chief technology officer Mudit Gupta commented the incident in an X post, saying that Polaymarket’s “market initializer was compromised,” adding further that “no impact to the users or the contracts.”
Polymarket’s product lead Mustafa Aljadery said in an X post that the CTF contract “is not exploited, it’s an internal address we use for ops.” Aljadery added:
“POL▲$0.0757 was being sent to that address because it was in an internal refiller service that checks and refills balances every couple of seconds. All user funds are safe and the address is being rotated.”
Practically speaking, the adapter is responsible for linking the market tokens of Polymarket to UMA’s oracle. According to Polymarket’s documentation, the platform’s outcome tokens are created using the Conditional Token Framework, which uses “Yes” and “No” tokens representing the potential outcome of any market.
09:30 UTC: Added comments from Polymarket Developers
09:54 UTC: Added comments from Mudit Gupta
10:16 UTC: Added comments from Mustafa Aljadery
Read more: Wallet Cluster Earned $2.4M on Polymarket With Iran Bets
