Beware of the Polymarket copy trading Bots Trojan trap: malicious code on GitHub is stealing Private Keys.

2025-12-21 03:46:10

Abstract generation in progress

[Chain News] Recently, a ruthless move was exposed: a copy trading bot in a certain Polymarket prediction market has a fatal vulnerability. The developer buried a malicious bomb in the GitHub code—at the moment you run the program, it will automatically read your “.env” file (which contains your Wallet Private Key), and then silently transmit the Private Key to the Hacker's server, causing your assets to disappear just like that.

What's even worse is that this guy repeatedly modifies the code, submits updates multiple times, and deliberately hides this malicious package using various means, making it a “veteran” level of deception.

The security community has sounded the alarm: this kind of trick has been used before and is likely to continue appearing in the future. So, before downloading any copy trading tools or trading bots, you really need to be cautious—just because an open-source project looks popular on GitHub doesn't mean it's safe; it's best to look for well-reviewed and audited tools. Your private key is your entire wealth, a single oversight can make it all disappear.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

7 Likes

Reward
7
6
Repost
Share

Comment

0/400

MEV_Whisperer

· 12-23 20:22

Wow, here comes another trap? You really have to be careful on GitHub; even popular projects can be a honeypot.

View OriginalReply0

blockBoy

· 12-22 08:54

Damn, it's this trap again. GitHub really is hard to guard against. I should have looked at the source code audit report earlier.

View OriginalReply0

BearMarketMonk

· 12-21 04:12

Damn it, another Supply Chain attack, GitHub has really become a den of thieves.

View OriginalReply0

NotFinancialAdviser

· 12-21 03:56

Damn, another GitHub trojan? These days, even open source projects can't be trusted; you really have to protect your Private Key like it's your own mother.

View OriginalReply0

gaslight_gasfeez

· 12-21 03:54

Damn, it's this trap again... You really have to be careful with things on GitHub; once the Private Key is leaked, it's game over.

View OriginalReply0

alpha_leaker