Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com


Criminals are copying the look of Polymarket, one of the biggest prediction market sites. They use the copies to take cryptocurrency from people who think they are placing real bets.

Once a victim deposits money, the site decides every win and loss, and withdrawals stop working. The scams are not one-off websites.

Three Russian-speaking “traffer” teams, called AtlasCore, PolyFucked and Magnetic Team, sell ready-made fake prediction markets to affiliates.

Affiliates bring in the victims, and the team supplies the website, admin panel, crypto payment system and technical support.

Earlier cases such as fake Polymarket trading tools drained wallets with malware. This newer wave skips the malware and relies on a rigged platform instead.

Researchers at Recorded Future’s Insikt Group identified the three teams and the tools they sell. They have watched the groups adapt since spring 2026.

Their Insikt Group report says the teams copied established fraud methods and applied them to the growing interest in Polymarket and Kalshi.

Hackers Build Fake Polymarket Platforms

The fake sites copy the real thing closely. They show YES/NO bets, probability charts, trading volumes and live market activity. Some even import data from the public Polymarket API, so the numbers look real.

Behind the screen, the operator controls the result. Code from AtlasCore’s fake sites lets an operator set a “win chance” for each victim. A value of 0 means the victim always loses, and 100 means they always win. This can apply to every user or to one person.

Magnetic Team adds a “Boost” tool with a target win rate, a balance cap that holds back payouts once a victim’s balance grows, and a forced-loss pause after several wins in a row.

Magnetic Team also fakes the crowd. It claims more than 3,000 bots trading across more than 5,000 markets, each acting like a different kind of trader, so the order book looks busy and natural.

Advertisement posted by AtlasCore on a cybercrime forum (Source - Recorded Future)
Advertisement posted by AtlasCore on a cybercrime forum (Source – Recorded Future)

Withdrawals are where victims get stuck. The panels hold ready-made error messages and fee settings. Magnetic Team’s “withdrawal funnel” gives one excuse after another, such as identity checks, anti-money-laundering reviews, VIP upgrade fees, an “Account Protection Score” and withdrawal taxes. The aim is to keep the victim paying and never let them cash out.

The sites also collect personal data. Victims are asked for card numbers, CVV codes, passport or driver’s license photos and a selfie holding the document.

Magnetic Team can create up to 20,000 deposit wallets per blockchain. Their private keys are exposed and can be exported the moment money arrives, so funds can be swept out quickly.

This fits a wider pattern. The DCloud Uni-App scam network also shows victims fake trading activity before their money disappears.

AI and Affiliate Money Help the Scam Spread

The affiliate deals are attractive. AtlasCore advertises 70% to 80% of net profit, PolyFucked offers at least 60%, and Magnetic Team pays a base of 70% of victim deposits.

AtlasCore’s Telegram channel claimed about $10.97 million in deposits between May 2 and September 18, 2026. PolyFucked claims about $2.4 million in quarterly turnover. Both figures come from the criminals themselves and may be inflated.

AI lowers the effort needed to run these campaigns. AtlasCore’s manuals teach affiliates to build fake influencers by blending photos of two real people, then post short reaction videos on Instagram.

They also tell affiliates to strip metadata so the content is not labeled as AI-made. PolyFucked shares prompts for making logos with AI image tools.

AI also handles the chat with victims. Code from the fake sites shows operators connecting a language model to answer support messages and translate victim replies into Russian. If one model refuses a request, the system switches to a model from another provider.

Magnetic Team’s code also looks AI-assisted, with heavy English comments and notes about bug fixes, though Insikt says this is a judgment based on style and not confirmed.

This matches what OpenAI found in a scam networks using ChatGPT case, where fraud groups used AI for fake personas and translation.

Treat any prediction market that is not on the official Polymarket or Kalshi domain as suspect. Be careful with sites promoted by influencers on Instagram or Telegram.

A site that asks for ID documents or card details before you can withdraw should raise alarms. Watch for sudden fees or “verification” steps when you try to cash out.

Reviewing crypto phishing warning signs helps spot these tricks early. Security teams can block the domains and IPs below and watch for new lookalike domains.

Indicators of compromise (IoCs):-

Type Group Indicator
Domain AtlasCore atlascore-panel[.]net, polymarket[.]atlascore-panel[.]net, casino[.]atlascore-panel[.]net, docs[.]atlascore-panel[.]net, prdct[.]cc, event-x[.]cc, predicate[.]cc, predictedby[.]cc, predicate[.]world, predicate[.]live, predicate[.]club, speculor[.]net, rqwrujarser[.]icu, wettora[.]com, bravioar[.]com, winzo[.]live, predictum[.]app, predictum[.]pro, predictum[.]cc, egov-x[.]com, deltevent[.]cc, delevent[.]cc, uppulse[.]xyz, depredictor[.]com, plexocade[.]com, predictmex[.]com, gobeast[.]bet, testdomainatlas[.]com, vnite[.]pro
Domain AtlasCore polycore[.]club, winzo[.]cc, polyweb[.]cc, holymarket[.]guru, polyblink[.]com, vuefax[.]com, polywax[.]net, zevrix[.]pro, polym[.]cc, deltapredict[.]net, polyxmarket[.]com, polyxchange[.]net, polymusk[.]net, polymrkt[.]cc, polymeet[.]cc, x-predict[.]cc, futurecastx[.]com, polymarts[.]net, event-pick[.]com, predict[.]biz, polidex[.]cc, polymarket-labs[.]click, polyspace[.]cc, 4pred[.]cc, werexo[.]com, plmrkt[.]com, polix[.]cc, 7poly[.]icu, lootwox[.]com
Domain AtlasCore polycore[.]cc, zarama[.]xyz, govazex[.]com, trybet[.]cc, polora[.]top, premrkt[.]cc, prognozland[.]com, polytax[.]cc, polylook[.]cc, prdect[.]lat, polymak[.]cc, polydep[.]com, swapnux[.]com, eventmex[.]com, tonchange[.]cc, apexswap[.]top, gemchange[.]com, predictionmarket[.]help, exchangezone[.]xyz, valorewards[.]shop, huesos[.]shop, jetox[.]top, fnbox[.]top
Domain PolyFucked polyfucker[.]space, preds[.]co, resolve[.]bet, forutsagt[.]bet, kiro-cheap[.]pro, futaryx[.]com, fortvet[.]cc, fortexp[.]live, authmy[.]co, predxmarket[.]xyz, polyfucked[.]top, fortnitebeast[.]top, predictbase[.]site, predivo[.]trade, polydexy[.]com, pollymarket[.]world, polyrnarket[.]vip, oraculus[.]live, oraculus[.]bet, forelytic[.]com, poly-market[.]top
Domain Magnetic Team magnetic-panel[.]space, tradingai[.]fun, crossbook[.]xyz, btwoteam[.]xyz, predicton[.]org, polymarket[.]casino
IP address AtlasCore 192[.]162[.]199[.]243, 158[.]94[.]209[.]19
IP address PolyFucked 81[.]90[.]17[.]100, 83[.]217[.]208[.]78, 89[.]213[.]118[.]50
IP address Magnetic Team 31[.]76[.]10[.]48, 192[.]64[.]119[.]163, 91[.]195[.]240[.]19, 87[.]120[.]165[.]193, 31[.]77[.]159[.]194
Email AtlasCore / PolyFucked austinhenderson199962[@]quickblox[.]net, maedawyggertie[@]gmx[.]com, bvzfsderman[@]gmx[.]com
ETH wallet PolyFucked 0x2d71435b9bd26cb60fa874ce88d6b856f9a166d0
Telegram AtlasCore @AtlasCoreTeam_bot, @AtlasCorePolymarket_bot, @AtlasCoreCasino_bot, @AtlasCoreManage, @ajento
Telegram PolyFucked @PolyFuckedBot, @polyfuckr, @kasrador, @polyfuckers
Telegram Magnetic Team @magneticteam_bot, @MagneticCEO
JavaScript file AtlasCore /build/assets/app-Ch74MqWt.js, /build/assets/app-DwKjOmEK.js
JavaScript file Magnetic Team partner.js, partner-rigging.js, partner-extras.js, partner-push.js, partner-wallets.js, partner-seo.js

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals appeared first on Cyber Security News.