Svmuu reported that Josh, Vice President of Engineering and DeFi at prediction market Polymarket, stated on platform X that the security incident this time stemmed from the leakage of a 6-year-old private key. This private key was used for an internal top-up configuration, which is why some funds were sent to that address.
Josh added that the Polymarket team has now completed a private key rotation and revoked all production environment permissions. They plan to migrate all private keys to a Key Management Service (KMS) in the future, instead of continuing to store them using traditional methods. Furthermore, neither Polymarket nor its UMA contracts have been exploited, all user funds are secure, and the platform can be used normally.