Researchers say fake Polymarket sites let scammers set each victim’s ‘win chance’ from 0 to 100, and withdrawals stop working once money is in

Criminals are running fake websites that mimic popular prediction markets like Polymarket, letting them rig trades and block users from getting their money back. Operators can set each victim’s “win chance” anywhere from 0 to 100, and withdrawals stop working once money is deposited.

These sites are not simple phishing pages. They are full platforms that look like the real thing, complete with probability charts, trading volumes, and live market activity.

Researchers at Recorded Future’s Insikt Group found three Russian-speaking teams behind these operations: AtlasCore, PolyF—ed, and Magnetic Team. These groups act as providers, selling ready-made fake markets to affiliates who then lure in victims. While older scams often relied on malware to drain wallets, this new wave uses a rigged platform to trick users into thinking they are placing real bets.

The house decides who wins on these fake markets

Behind the scenes, the operator can manually set a win chance for any user. A setting of zero means the victim always loses, while 100 means the victim always wins. Some sites even use bots to fake crowd activity, making the order book look busy with thousands of fake traders.

The real Polymarket has faced its own scrutiny, including over allowing bets on downed US pilots, but these copycat sites are run by criminals. When a victim finally tries to cash out on one of them, they hit a wall.

The platforms are designed to keep the money trapped, using a series of excuses like fake identity checks, anti-money-laundering reviews, and demands for extra fees. The scammers also ask for sensitive information like card numbers, CVV codes, and photos of passports or driver’s licenses. That puts victims at risk of identity theft on top of losing their crypto.

According to the researchers, AI is helping these groups scale their efforts. Affiliates use AI to create fake influencer personas, blending photos of real people to post reaction videos on Instagram. They also use AI to handle chat support, automatically translating victim replies into Russian and switching to a different language model if one refuses to answer.

AtlasCore claimed to have brought in nearly $11 million in deposits between May 2 and Sept. 18. The figure comes from the criminals themselves and may be inflated.

The researchers advise treating any prediction market that is not on the official domain as suspect and double-checking the URL, since these sites often use lookalike domains. A site that asks for ID documents or card details before a withdrawal, or adds sudden fees and verification steps at cash-out, is a major red flag.

Sites promoted by influencers on Instagram or Telegram also warrant skepticism. Security professionals can help by blocking known domains and IP addresses associated with the three teams.