Mexc.Co ZachXBT Warns of Polyarb's Active Wallet Drainer Scam
Article Content
- •Polyarb is identified as a fraudulent prediction market with an active wallet drainer.
- •Prominent crypto accounts inadvertently amplify the scam's reach by engaging with its content.
- •Users should verify contract addresses and use hardware wallets to protect against wallet drainers.
On May 4, 2026, onchain investigator ZachXBT reported that Polyarb, a site posing as a prediction market platform, is operating an active wallet drainer. This malicious tool disguises a harmful smart contract approval as a regular transaction, allowing attackers to gain full access to users' wallets when they connect and sign what seems to be a legitimate action. The investigation highlighted the risk of amplification through prominent crypto accounts engaging with Polyarb's content, inadvertently promoting the scam to millions. The rise of fake DeFi and prediction market platforms has been noted as a growing attack vector in 2026, leveraging the visibility of legitimate platforms. Users are advised to verify contract addresses and ensure the presence of audited contracts before engaging with such platforms. Red flags include recent social media profiles and lack of regulatory disclosures. ZachXBT has a history of exposing threats before significant losses occur, including a recent case involving a $71 million Ethereum seizure linked to the Lazarus Group. Recommendations include using hardware wallets for unfamiliar platforms and revoking token approvals after suspicious interactions.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Lazarus Group and Polymarket in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Bitget Suffers $388M Hack Attributed to North Korean Lazarus Group On September 24, 2026, Bitget reported a significant security breach resulting in the theft of approximately $388 million from its hot and warm wallets. The attackers exploited a vulnerability in a third-party security product to gain internal access credentials and issued fraudulent withdrawal commands. Bitget's cold…