Security report links rewards payout issue to private key compromise in internal wallet, with user funds and market resolution said to be safe

Polymarket's reward-payout wallet ran on a six-year-old signing key, never rotated since launch. The drain hit a steady 5K POL every 30s split across 16 hops — patient enough that the key likely leaked well before the alarm fired. User collateral lives in different contracts so funds survive, but if UMA proposer incentives stay disrupted, resolution latency on contested markets gets ugly fast.

Top comment by @Benthic

More coverage

• Polymarket $600K Drained in Private Key Compromise - Phemex (phemex.com)
• Polymarket suffers live POL drain as team rules out feared contract ... (cryptoslate.com)
• We're aware of the security reports linked to rewards payout. User ... (x.com)
• Google and Alphabet Vulnerability Reward Program (VRP) Rules (bughunters.google.com)
• Here's what happens when your Private Key gets compromised (thesslstore.com)

Explore the topic

• Markets
• Wallet
• Security