Scammers are cloning the appearance of Polymarket, one of the largest prediction-market platforms, to steal cryptocurrency from users who believe they are placing genuine bets.
After victims deposit funds, the fraudulent sites control outcomes, making wins and losses as the operator chooses, and they block withdrawals. These are not isolated one-off pages.
Recorded Future’s Insikt Group identified three Russian-speaking “traffer” teams—AtlasCore, PolyFucked and Magnetic Team—that sell turnkey fake prediction-market platforms to affiliates.
Affiliates recruit victims while the teams provide the fraudulent website, admin interface, cryptocurrency payment integration and technical support.
Earlier attacks used malware embedded in fake Polymarket tools to drain wallets; this newer wave abandons malware and instead relies on an inherently rigged platform.
Hackers Build Fake Polymarket Platforms
The counterfeit sites mimic the real Polymarket interface closely: YES/NO bets, probability charts, trading volumes and apparent live market activity. Some fake sites even pull public data from the Polymarket API so on-screen figures look authentic.
Behind the scenes, operators decide results. Code recovered from AtlasCore-built sites includes a per-victim “win chance” setting: 0 means the victim always loses, 100 means they always win. This control can be applied globally or targeted at individual users.
Magnetic Team offers a “Boost” feature that sets a target win rate, implements a balance cap that halts payouts when a victim’s balance grows, and forces losses after a string of wins. They also fabricate a bustling market by simulating more than 3,000 bots trading across over 5,000 markets, each with different trader behaviors to make order books look natural.
Victims are often trapped when attempting to withdraw. The admin panels include prebuilt error messages and configurable fee settings. Magnetic Team’s “withdrawal funnel” cycles through excuses—identity checks, anti-money-laundering reviews, VIP upgrade fees, an “Account Protection Score” and withdrawal taxes—designed to extract more money and prevent cashout.
These sites also collect sensitive personal information, requesting card numbers and CVV codes, passport or driver’s license images, and a selfie holding the document.
Magnetic Team can generate up to 20,000 deposit wallets per blockchain; private keys are exposed and can be exported as soon as funds arrive so money can be swept out immediately.
This pattern matches other scams, such as the DCloud Uni-App network, which similarly displays fake trading activity before victims’ funds vanish.
AI and Affiliate Money Help the Scam Spread
The affiliate economics are lucrative. AtlasCore advertises 70–80% of net profits to affiliates, PolyFucked offers at least 60%, and Magnetic Team pays a base of 70% of victim deposits.
AtlasCore’s Telegram channel claimed about $10.97 million in deposits between May 2 and September 18, 2026; PolyFucked reports roughly $2.4 million in quarterly turnover. These figures originate from the groups themselves and may be exaggerated.
AI tools reduce the effort required to operate these campaigns. AtlasCore’s manuals instruct affiliates to create fake influencers by merging photos of two real people and post short reaction videos on Instagram. Affiliates are also advised to strip metadata to avoid indicating AI generation. PolyFucked shares image-generation prompts for logos.
AI is also used to handle victim communications. Code from the fraudulent sites shows operators routing support messages through a language model to answer queries and translate replies into Russian. If one model refuses a request, the system automatically switches to another provider’s model. Magnetic Team’s code contains extensive English comments and notes about bug fixes, which Insikt characterizes as suggestive of AI assistance but not confirmed.
These findings echo prior observations—such as OpenAI’s analysis—of scam networks using AI for fake personas and translation.
Recommendations: Treat any prediction market not hosted on the official Polymarket or Kalshi domains with suspicion. Be especially cautious with platforms promoted by influencers on Instagram or Telegram. A site that demands ID documents or card details before allowing withdrawals is a red flag. Watch for sudden verification steps or unexpected fees when attempting to cash out.
Security teams should review common crypto-phishing indicators and consider blocking the domains and IP addresses listed below, while monitoring for new lookalike domains.
Indicators of compromise (IoCs)
| Type | Group | Indicator |
|---|---|---|
| Domain | AtlasCore | atlascore-panel[.]net, polymarket[.]atlascore-panel[.]net, casino[.]atlascore-panel[.]net, docs[.]atlascore-panel[.]net, prdct[.]cc, event-x[.]cc, predicate[.]cc, predictedby[.]cc, predicate[.]world, predicate[.]live, predicate[.]club, speculor[.]net, rqwrujarser[.]icu, wettora[.]com, bravioar[.]com, winzo[.]live, predictum[.]app, predictum[.]pro, predictum[.]cc, egov-x[.]com, deltevent[.]cc, delevent[.]cc, uppulse[.]xyz, depredictor[.]com, plexocade[.]com, predictmex[.]com, gobeast[.]bet, testdomainatlas[.]com, vnite[.]pro |
| Domain | AtlasCore | polycore[.]club, winzo[.]cc, polyweb[.]cc, holymarket[.]guru, polyblink[.]com, vuefax[.]com, polywax[.]net, zevrix[.]pro, polym[.]cc, deltapredict[.]net, polyxmarket[.]com, polyxchange[.]net, polymusk[.]net, polymrkt[.]cc, polymeet[.]cc, x-predict[.]cc, futurecastx[.]com, polymarts[.]net, event-pick[.]com, predict[.]biz, polidex[.]cc, polymarket-labs[.]click, polyspace[.]cc, 4pred[.]cc, werexo[.]com, plmrkt[.]com, polix[.]cc, 7poly[.]icu, lootwox[.]com |
| Domain | AtlasCore | polycore[.]cc, zarama[.]xyz, govazex[.]com, trybet[.]cc, polora[.]top, premrkt[.]cc, prognozland[.]com, polytax[.]cc, polylook[.]cc, prdect[.]lat, polymak[.]cc, polydep[.]com, swapnux[.]com, eventmex[.]com, tonchange[.]cc, apexswap[.]top, gemchange[.]com, predictionmarket[.]help, exchangezone[.]xyz, valorewards[.]shop, huesos[.]shop, jetox[.]top, fnbox[.]top |
| Domain | PolyFucked | polyfucker[.]space, preds[.]co, resolve[.]bet, forutsagt[.]bet, kiro-cheap[.]pro, futaryx[.]com, fortvet[.]cc, fortexp[.]live, authmy[.]co, predxmarket[.]xyz, polyfucked[.]top, fortnitebeast[.]top, predictbase[.]site, predivo[.]trade, polydexy[.]com, pollymarket[.]world, polyrnarket[.]vip, oraculus[.]live, oraculus[.]bet, forelytic[.]com, poly-market[.]top |
| Domain | Magnetic Team | magnetic-panel[.]space, tradingai[.]fun, crossbook[.]xyz, btwoteam[.]xyz, predicton[.]org, polymarket[.]casino |
| IP address | AtlasCore | 192[.]162[.]199[.]243, 158[.]94[.]209[.]19 |
| IP address | PolyFucked | 81[.]90[.]17[.]100, 83[.]217[.]208[.]78, 89[.]213[.]118[.]50 |
| IP address | Magnetic Team | 31[.]76[.]10[.]48, 192[.]64[.]119[.]163, 91[.]195[.]240[.]19, 87[.]120[.]165[.]193, 31[.]77[.]159[.]194 |
| AtlasCore / PolyFucked | austinhenderson199962[@]quickblox[.]net, maedawyggertie[@]gmx[.]com, bvzfsderman[@]gmx[.]com | |
| ETH wallet | PolyFucked | 0x2d71435b9bd26cb60fa874ce88d6b856f9a166d0 |
| Telegram | AtlasCore | @AtlasCoreTeam_bot, @AtlasCorePolymarket_bot, @AtlasCoreCasino_bot, @AtlasCoreManage, @ajento |
| Telegram | PolyFucked | @PolyFuckedBot, @polyfuckr, @kasrador, @polyfuckers |
| Telegram | Magnetic Team | @magneticteam_bot, @MagneticCEO |
| JavaScript file | AtlasCore | /build/assets/app-Ch74MqWt.js, /build/assets/app-DwKjOmEK.js |
| JavaScript file | Magnetic Team | partner.js, partner-rigging.js, partner-extras.js, partner-push.js, partner-wallets.js, partner-seo.js |
Note: IP addresses and domains are intentionally defanged (for example, using [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal or your SIEM.
Provide your SOC with the alert context needed to stop incidents quickly. Integrate threat intelligence from many SOCs to improve detection and response.
