ZachXBT identifies a $520K security issue affecting Polymarket on Polygon, with the team assuring no funds are at risk.

Blockchain investigator ZachXBT has flagged a suspected security incident involving Polymarket, the world’s largest decentralized prediction market, after on-chain data showed more than $520,000 was drained from contracts on the Polygon network.

According to information shared by ZachXBT, two smart contracts appear to have been impacted, with funds reportedly transferred to an attacker-controlled address. The affected wallets include 0x871D7c0f9E19001fC01E04e6cdFa7fA20f929082 and 0x91430CaD2d3975766499717fA0D66A78D814E5c5, with assets allegedly sent to 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91.

Polymarket acknowledged reports of an issue tied to its rewards payout system in a post on X, saying it is investigating the matter. The platform stressed that user funds and market resolutions remain unaffected, characterizing the incident as a compromise of an internal operations wallet rather than an exploit of its core smart contracts or infrastructure.

Polygon Labs CTO Mudit Gupta also commented on the situation, stating that the core system and user assets were not impacted. “Polymarket contracts are safe. User funds are safe. Looks like their market initializer was compromised. No impact to the users or the contracts,” he said.

Polymarket has not yet released a detailed statement through its primary official channels. CoinDesk has reportedly reached out for further comment.

The incident highlights ongoing concerns around operational security in decentralized finance, where breaches of internal keys or supporting systems can still lead to meaningful losses even when core protocols remain secure