Blockchain investigator ZachXBT sounded the alarm Thursday on a $520,000 exploit hitting Polymarket's platform over the Polygon network. The prediction market's team quickly confirmed that the incident did not compromise any user funds, saying the exploited mechanism was isolated from user wallets.
What ZachXBT found
ZachXBT flagged the exploit on social media, pointing to roughly $520,000 drained from Polymarket-related contracts on Polygon. The investigator didn't specify the exact vector — whether a smart contract bug, a price oracle manipulation, or something else — but the sum suggests a targeted attack rather than a broad sweep.
Polymarket's response
Polymarket's team acknowledged the exploit within hours, stating that user funds were not touched and remain secure. The company did not disclose the specific vulnerability or whether it has been fully patched. For a platform that handles real-money bets on event outcomes, the reassurance was critical — any hint of user losses could spook traders.
The broader picture
The incident is the latest reminder that even battle-tested DeFi apps on major chains like Polygon aren't immune to exploits. Polymarket has been one of the busiest prediction markets this year, especially around political and macroeconomic events. A $520,000 hole is relatively small by crypto standards, but the timing isn't great — the platform has been drawing more mainstream attention.
Neither ZachXBT nor Polymarket have said whether law enforcement or additional auditors have been brought in. The investigation, if any, appears to be ongoing.
