Cybercriminals have devised a new scheme to exploit cryptocurrency users by creating counterfeit versions of Polymarket, a prominent prediction market platform. These fraudulent sites are designed to deceive users into believing they are engaging in legitimate trades, only to find their cryptocurrency stuck with no means of withdrawal.
How the Scheme Operates
Once users deposit funds into these fake platforms, the operators manipulate the outcomes of trades and effectively block any attempts to withdraw cryptocurrency. The scam is not limited to isolated incidents but is a sophisticated operation supported by organized groups. Three Russian-speaking teams, AtlasCore, PolyFucked, and Magnetic Team, offer pre-built fake platforms to affiliates, who then lure victims into the trap. These teams provide everything needed to run the scam, from website infrastructure to technical support.
Technical Strategies and Tools
Previous scams involved malware, but this new approach relies on rigged systems. Researchers from Recorded Future’s Insikt Group have been monitoring these groups since spring 2026. The fake sites are nearly identical to the original, displaying realistic betting options, charts, and activity. Some sites even import data from Polymarket’s API to make their numbers appear legitimate. Operators can set winning probabilities to ensure victims lose, while Magnetic Team’s ‘Boost’ tool fakes trading activity with bots.
Impact and Prevention Measures
The scams are alarmingly effective, with promises of high affiliate earnings drawing many participants. AtlasCore boasts considerable deposits, although these figures are likely exaggerated. AI is employed to enhance scam operations, from creating fake influencers to automated customer interactions. Victims are urged to be cautious and verify the legitimacy of any prediction market site, especially those requiring personal information before allowing withdrawals.
To mitigate risks, it is critical to recognize phishing tactics and be wary of sites promoted by influencers. Cybersecurity teams are advised to block known fraudulent domains and IP addresses to prevent further victimization. By staying informed and vigilant, users can better protect their assets from these evolving threats.
