BTC24H Lock contract on Polygon was exploited in December 2024 for $85,700. The claim function failed to verify if msg.sender was an eligible claimant, allowing anyone to claim BTC24H tokens without authorization.