Three exploits this week, and the lesson sits in the difference between them.
One was a compromised key, a reminder that security reaches beyond the contract itself. The other two were code-level bugs sitting in plain sight, the kind that surface when you test for them before you ship. That is $470K that never had to leave the building.
On May 21st, the Polymarket exploit on Polygon resulted in a $700K loss. The root cause of the exploit was a private key compromise affecting a wallet used for internal operations. The attacker gained access to the key and used it to execute unauthorized transfers of POL tokens. The Polymarket team confirmed that the exploit did not involve a smart contract vulnerability and they began rotating backend keys.
One of Many Transactions (on Polygon): 0x9faf63d96cab3ca02680452a4c66bdf7ae8a2901307ec27a180da47d96ef2dc7
On April 28th, the Judao exploit on the BSC resulted in a $228K loss. The root cause of the exploit was a flaw in the token’s sell logic (in _update() function) that allowed the liquidity pool reserves to be modified during a swap. When the attacker sold JUDAO tokens, the contract burned tokens from the pool and called sync() before the swap output was calculated. This caused the pool to calculate fewer JUDAO tokens in circulation, artificially increasing the token price. The attacker used a $2.3M USDT flash loan to purchase 5.5M JUDAO, then sold the tokens back into the manipulated pool to make a profit.
Exploited Contract (on BSC): 0xf55DFF7898930a2D28cDbC39D615b1624ac86888
Transaction: 0x956e38b8ddb40ba080c8042c685ae52ee5c1b096f1d7f0c4a6c59be3eb4265bd
On April 13th, the Hyperbridge exploit on the Ethereum mainnet resulted in a $242K loss. The root cause of the exploit was a missing bounds check on leaf_index in the handlePostRequests() function. The function accepted any arbitrary leaf_index and passed it to the MMR proof verifier without verifying that it was smaller than leafCount. The attacker submitted an out-of-bounds index and bypassed proof verification to get minting permissions. The attacker then minted bridged tokens, and sold them for profit.
Exploited Contract: 0x6c84edd2a018b1fe2fc93a56066b5c60da4e6d64
Transaction: 0x240aeb9a8b2aabf64ed8e1e480d3e7be140cf530dc1e5606cb16671029401109