A hacker using the Polymarket comment section to scam users of more than $500k+ shows how much we need to build and educate CT more on security; so as to prevent or reduce these data breaches and financial losses.

A scam campaign on the decentralized prediction market Polymarket has used the platform’s comment section and phishing links to steal more than $500,000 from users, prompting renewed warnings about basic security hygiene in crypto trading communities. The issue was highlighted by prominent Polymarket trader @25usdc, who drew attention to how easily users were being tricked and called for better security practices and education across “Crypto Twitter” (CT). According to post-incident reporting, attackers posted obfuscated links in Polymarket’s market comment sections that led to phishing sites mimicking Polymarket’s interface. Users who logged in via email-based authentication on these fake sites were subjected to malicious script injections that compromised their wallets and allowed the attackers to drain funds, primarily from Ethereum wallets. The losses affected individual users rather than Polymarket’s core smart contracts or institutional liquidity, but the platform’s total value locked (TVL) reportedly fell by around 12% in 24 hours, underscoring diminished user confidence. Security researchers and community figures, including on-chain investigator @zachxbt, noted that the attack itself was technically simple—classic social engineering and phishing—but highly effective because many users trusted links in an “official-looking” context like a product’s own comment section. Comment-section phishing has been compared to similar scams on NFT and DeFi platforms such as OpenSea, suggesting a broader pattern of attackers targeting user interfaces and social features rather than protocol code. The incident has reinforced calls for more aggressive content moderation, clearer in-app warnings, and sustained user education about avoiding unsolicited links and verifying URLs, especially as on-chain prediction markets and other Web3 apps attract a wider retail audience. "entities":["Polymarket","@25usdc","@zachxbt","Ethereum","OpenSea"]}`

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Polymarket Phishing Scam Results in Over $500K in Losses | MEXC ... (mexc.co)
• Prediction markets are fair + reliable > Polymarket insiders didn't ... (x.com)

Explore the topic

• Polymarket
• Hacker
• BUILD
• Scam