The $50 Million Temptation: They Bribe a White-Hat Hacker to Attack Polymarket

Bitsfull2026/04/30 18:3715214

Summary:

UMA Market Cap $40M, Whale Could Make $50M on This Trade

On April 7, Trump announced a two-week ceasefire between the US and Iran. On April 21, the day before the ceasefire was set to expire, he posted a statement on Truth Social announcing an indefinite extension of the ceasefire.


Subsequently, Reuters, AP, BBC, Al Jazeera, and The Wall Street Journal all reported the news of the ceasefire extension. The Iranian Foreign Minister tweeted acknowledging the decision to extend the ceasefire.


In the real world, the ceasefire continued under a strict lockdown.


However, on Polymarket, the market "Will the US-Iran ceasefire be extended by April 22" currently has a probability of "Yes" at 0.1%.


It means that while the world knows the ceasefire has been extended, the largest global prediction market believes the ceasefire has not been extended.



At this juncture, markets with such controversies often see bets with expectations of hundredfold profits: some traders bet from one dollar to even hundreds of dollars, attempting to create a rags-to-riches myth.


And in the past 24 hours, an account purchased $100,000 worth of "Yes," with a potential return of over $50 million.



Official Ruling Changes Rules, Has the Ceasefire Indeed Been Extended?


The controversy in this market was embedded in the rules from the beginning.


Polymarket's definition of "ceasefire extension" requires explicit public statements from both the US and Iran, or reaching an "overwhelmingly credible media consensus." The US's public statement came from Trump himself on Truth Social.


The issue arose with Iran. The Iranian official statement used the word "acknowledged," rather than the required "mutually agreed" as per the rules.


It was this wording that led to a $150 million trading volume split in this market: "Yes" holders believed Trump's statement combined with global media's unanimous coverage constituted an "overwhelming consensus"; "No" holders believed that Iran did not explicitly confirm on its own behalf, a condition they felt was unmet.


On April 24, Polymarket made a definitive ruling, supplementing the market page with an explanation: as of 11:59 PM on April 22, there was no ceasefire extension meeting the criteria for a "Yes" outcome.



With the official endorsement, the market sentiment swiftly changed direction, and the probability quickly dropped below 1%.


Following this change, many traders well-versed in game rules and trading strategies emerged: buying "No" under the official qualification has become a nearly risk-free high-yield investment.


Among these individuals, the top three "No" holders include an account named NotBakerMcKenzie, with a wager of around $8.5 million. Baker McKenzie is a top global law firm headquartered in Chicago, specializing in providing legal compliance services to prediction market clients such as Polymarket, with a deep understanding of oracle settlement mechanisms and platform rules.



Interpreting the rules as a law firm and placing a substantial bet, this move seems to signal the final settlement direction of this market to the entire trading community.


However, the top "Yes" holder, Pedro, clearly has a different view: the Polymarket official statement can only serve as a reference for settlement, with the result determined solely by UMA's decentralized oracle voting. As long as the UMA token stakers' vote supports "Yes," it doesn't matter what the officials say.


This is exactly what Pedro is betting on: compared to a potential return of over $50 million, it's very cost-effective to use $100,000 to bet on a surprise upset in the oracle voting outcome.


A $50 Million Oracle Attack


On Pedro's Polymarket account page, there is a link that leads to a website for a token he issued—$pedros-coin. Although the website is filled with unfinished architecture and rough page design, the token's design rules are quite eye-catching.


$pedros-coin cannot be purchased through conventional meme rules at the moment; the only way to obtain it is through action-based rewards: earning 1 token per hour by watching live streams and receiving 20 tokens per social media post—all acquisition methods strongly tied to network propagation.


The value of this token depends entirely on the probability of "Extend the Ceasefire" in this market. If the probability is 100%, each token is worth $1; if the final settlement is "No," the token becomes worthless.



Pedro's holding in this market also happens to perfectly serve as the token's default insurance policy—he holds 50 million "yes" shares in the market, with a potential payout of over $50 million, ensuring that he only profits if he is correct.


When you combine these elements, the logic of this design becomes clear: Pedro leverages $pedros-coin to align the interests of hundreds of individuals with his own "yes" position in the market, enabling these individuals to collectively voice their opinions across the network with the aim of generating enough public pressure prior to the oracle vote to persuade as many stakers as possible that the market "should resolve to yes."


From a narrative perspective, this mobilization mechanism embodies a peculiar web3 spirit—Pedro, investing over $100,000 of his own money, leads a group of retail investors who have earned their tokens through action to unite against whales relying on capital efficiency as an established fact, with their bet aligning with an actual real-world ceasefire.


However, within Pedro's Discord channel, another layer emerges that complicates the matter.


Pedro Playing Dumb and the Oracle Whale Manipulating the Market in Plain Sight


On the morning of April 30th, a user named Euan posted a message in Pedro's personal webpage's Discord channel: "As you can see, I own the richest UMA wallet. Willing to accept bribes to steer the vote to yes. DMs open."


Accompanying the message were two screenshots: one displaying possession of 2.9 million UMA tokens and the other showing an account page under the name borntoolate.eth.



2.9 million UMA tokens, comprising approximately 16.4% of the current total staked amount of 17.71 million UMA.


Just this one screenshot is intimidating enough, and the name borntoolate carries significant weight for players who have long been involved in Polymarket, no less than the 16.4% figure.


In March 2025, the Polymarket market "Will Ukraine agree to Trump's mineral resource deal by the end of March" was settled as "yes" by the oracle despite ongoing negotiations and no formal signing taking place.


This is the infamous Polymarket Oracle Exploit that shook the community, with borntoolate at the center of it all. Taking advantage of a low overall voting participation rate, borntoolate, through holding and staking a significant amount of UMA tokens, used their relative weight to forcefully push the settlement outcome to “Yes,” causing the market to move in complete contradiction to reality.



The core assumption of UMA's security model is that the “cost of attack is higher than the benefit of attack” — attackers need to buy enough UMA tokens to control the vote, and this cost should outweigh the benefit they can gain from the attack. However, the total market capitalization of the entire UMA protocol is currently only $40 million.


We cannot confirm whether Euan is indeed borntoolate in person. But if this round's settlement result sees another overturn, Pedro's $100,000 bet will turn into over $50 million in returns.


As of now, the outcome of the UMA Oracle vote seems quite clear. Among the tokens with publicly disclosed voting results, the “No” votes exceed 10.27 million tokens, while there are only 25 “Yes” votes.



The only variable in this round of voting is the ownership of approximately 8.69 million UMA tokens whose votes have not yet been made public. If more than 2.33 million of these tokens vote “No,” this round of voting will be considered to have reached consensus, and the market will settle as “No.” If this threshold is not met, this round of voting will be deemed invalid, and the dispute will continue to the next round — which is what Pedro is truly waiting for.


At the time of writing, Pedro is still continuing to buy into the “Yes” side.



Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia