Five red flags of crypto "recovery" scams

Srey Leak — Mon, 12 Oct 2026 01:13:25 +0000

After the June 2026 Polymarket frontend hack, the victims got their money back — and then the real scam started. DMs flooded in from "recovery specialists" who had watched the same on-chain transfers everyone else did.

I teach scam-prevention workshops in Long Beach, and this pattern shows up in every language community I work with. Here are the five red flags I drill.

1. They contact YOU. Real support never initiates a DM. Polymarket, Coinbase, MetaMask — none of them cold-message users about stolen funds.

2. They ask for a seed phrase or private key. There is no legitimate reason for anyone to need it. Not for "verification", not for "safe-keeping", not to "recover" anything.

3. They promise guaranteed recovery. On-chain theft is not reversible by a third party. If someone claims otherwise, they are selling you a story.

4. They manufacture urgency. "Your funds expire in 24 hours." Urgency exists to stop you from checking.

5. Their links look official but aren't. Check the domain character by character. Polymarket support does not live at polymarketsupport[.]xyz.

One sentence to remember: Polymarket refunded every June-hack victim directly. No third party was ever needed — and none will ever be.

I'm a security researcher, not a recovery service. I write guides: session keys, multilingual scam patterns, pre-trading checklists. Links on my profile.

Learn more about crypto security

security #crypto #scams #polymarket

Session Keys: the one Polymarket feature most traders ignore

Srey Leak — Sun, 11 Oct 2026 21:31:32 +0000

Most people sign every trade with their main wallet key. That's like carrying your house deed to the grocery store.

Polymarket's Session Keys exist to solve exactly this: a scoped signer with limited permissions, so your master key stays cold. At Coinbase, account-takeover incidents almost always started the same way — a hot key with too much power, phished once.

Three rules I follow:

Trading key != storage key. Never mix them.
The key that signs daily trades should hold only what you can afford to lose this week.
Hardware wallet for anything long-term. Browser extensions are for convenience, not custody.

None of this is exotic. It's boring hygiene — the kind that saves accounts.

(Full breakdown coming in my next post: how to set up scoped signers step by step.)

Not financial advice. Security is your responsibility.

DEV Community: Srey Leak

Five red flags of crypto "recovery" scams

security #crypto #scams #polymarket

Session Keys: the one Polymarket feature most traders ignore