According to a report by CryptoComLearn, hackers have exploited the comment section of Polymarket, a decentralized prediction market platform, to carry out a large-scale fraud operation resulting in losses exceeding $500,000. The disclosure was made by crypto trader @25usdc on November 11, revealing how cybercriminals use disguised links to infiltrate user systems, steal sensitive data, and drain digital assets.
How the Scam Works
Hackers posted seemingly normal links in Polymarket's comment section, but these URLs redirected users to malicious websites. The links were carefully crafted to blend in with regular comments. Once a user clicked on a link and was directed to a fake login page, they were prompted to enter their email and password. Upon submission, a malicious script activated, harvesting browser local storage data, cookies, and cryptocurrency wallet credentials. This allowed the attackers to transfer funds from victims' accounts. At least dozens of users have been affected, with cumulative losses exceeding half a million dollars, and the actual figure may be higher.
Platform Security and Industry Warnings
Polymarket's open comment system, while fostering community interaction, also provided an entry point for exploitation. Although the platform itself was not directly compromised, the trust mechanism between users was abused. Security experts advise users to avoid clicking any links in comment sections, especially those that ask for personal information or wallet passwords. Enabling two-factor authentication, using hardware wallets, and regularly reviewing authorized app permissions can significantly reduce risk. Notably, Polymarket has faced other security incidents recently, such as the $520,000 exploitation of its UMA CTF adapter, highlighting the broader challenges decentralized applications face in safeguarding user assets.
Market Impact and Reactions
Following the news, Polymarket's native token POLY dropped approximately 3.83% in 24 hours, while the stablecoin USDC saw a negligible decline of 0.01%. Although the market reaction was muted, the incident underscores the persistent security risks in decentralized finance. Without centralized oversight, users must bear the primary responsibility for their own safety. The scam also points to a design flaw in Polymarket's comment feature, prompting calls for the platform to introduce link moderation or disable clickable links entirely.
Conclusion and Recommendations
The exploitation of Polymarket's comment section for fraud not only causes direct financial harm to users but also erodes trust in the decentralized ecosystem. Users are urged to remain vigilant and avoid engaging with unverified links, especially those involving financial transactions. Platform operators should strengthen security measures, including smart contract audits, comment filtering, and user education initiatives. Only through collaborative efforts can such fraudulent schemes be effectively curbed.