Polymarket Taps Palantir for On-Chain Monitoring as Fraudulent Schemes Thrive Off-Chain on Telegram
Polymarket’s efforts to slow market manipulation appear to overlook alternative platforms, where account farms and fake insider groups thrive
TLDR
Amid regulatory pressure and public concern about alleged insider trading, Polymarket recently announced it would partner with Palantir and TWG AI, using the companies’ Vergence AI engine to monitor its sports contracts and prevent or report on suspicious activity.
Polymarket contracts are executed in cryptocurrency (USDC) on the Polygon blockchain, which Vergence AI can monitor directly. However, the coordination of Polymarket trades occurs off-chain, in a complex ecosystem spread across alternative platforms such as Telegram, and remains unmonitored.
Using Open Measures’ platform to monitor the off-chain coordination of Polymarket activity, our researchers discovered a network of automated Telegram bots, KYC account farming, and predatory copy-trading schemes.
What is Polymarket? An Abbreviated History
Polymarket is the world’s largest so-called “prediction market,” an industry term for online platforms that facilitate betting on the outcomes of future events surrounding virtually any topic, including sports, politics, business, and weather. As companies like Polymarket have grown in recent years to facilitate billions of dollars’ worth of wagers, so has concern over its potential for abuse, manipulation, and insider betting.1
Polymarket has historically operated with minimal oversight and few safeguards. Since its founding in 2020, Polymarket has structured its business in ways seemingly intended to evade the scrutiny and oversight of US regulators. When the Commodity Futures Trading Commission (CFTC) fined the company for operating as an unlicensed futures broker in 2022, it offshored its operations to Panama and blocked access for users with US-based IP addresses.2 Transactions on the platform are conducted using USDC – a “stablecoin” cryptocurrency traded on the Polygon blockchain – rather than US dollars, and the company collects no KYC (“know your customer”) data for users outside the US. By contrast, its largest rival, Kalshi, has taken the opposite approach: working closely with regulators, collecting KYC data for its users, and conducting business in US dollars.3
In September, the CFTC approved Polymarket to reengage in US markets. One month earlier, Polymarket appointed Donald Trump Jr., the president’s adult son, to its advisory board and accepted an eight-figure investment from a venture capital firm where Trump Jr. is a partner.4 (Trump Jr. is also an advisory board member at Polymarket’s largest direct competitor, Kalshi.)
Polymarket now operates legally in the US, but the company still faces mounting pressure from US lawmakers and many of its US-based users have remained waitlisted while the company navigates various state-level restrictions and legal challenges.5 Under increasing scrutiny, the company has scrambled to erect new policies and systems for monitoring and reporting unusual and suspicious activity on its platform.6
Common Polymarket Scams and Schemes
Open Measures examined discussion of Polymarket on active alternative platforms (Telegram, 4chan, Bluesky) and recorded in our platform’s datasets since March 2025 to identify suspicious activity being organized off-platform. Using a mix of tools available in the Open Measures’ platform, we discovered a sprawling ecosystem of questionable tools and schemes aimed at gaming alleged vulnerabilities in Polymarket’s safeguards.
Bots and Third-Party Software Vulnerabilities
Polymarket enables its users, who may not possess much knowledge about trading or investing, to identify the platform’s most successful traders and mimic their bets – a strategy known as “copy-trading.”
While Polymarket offers some native tools that help users identify successful traders to copy, including a real-time “Leaderboard” page, many of its users pay for access to third-party software that alerts them to noteworthy transactions on the platform and directs Telegram bots to execute identical trades on their behalf. Open Measures identified thousands of posts on alternative platforms advertising two such services: PolyGun and Polypok.
Polypok
On Bluesky, nearly 41% of posts we identified mentioning “polymarket” were made by a single automated account: the Polypok bot. A whale-tracking service, the bot exclusively created two kinds of posts hundreds of times each: “SMART MONEY ALERT” posts, categorizing specific accounts or wallets as “elite traders” and “S-tier whales (top 1% win rate)”, and “Polymarket Anomaly” posts, flagging statistically unusual trades, accompanied by z-scores and order flow percentages. (For example, a $25,000 bet on the Iranian regime falling by June 30 was given a z-score of 19.6σ, meaning a trade that was allegedly 19.6 standard deviations away from the mean size in that market).
While the use of labels appeared intended to add authority to the alerts, the method (if one exists) for generating each label was not disclosed. Similarly, the outrageously extreme probability scores associated with certain events make it a near certainty that the mathematics in the “anomalies” are fabricated.
PolyGun
PolyGun is a prominent Telegram trading bot and discussion community with nearly 206,000 users at the time of writing. Users who join an associated Telegram channel are connected to a private chat with the bot, which instructs them how to create a cryptocurrency wallet, open a Polymarket account, and arrange for the bot to execute automated copy-trading strategies on users’ behalf. US users can then avoid the KYC required for email-based accounts by connecting their wallet to the site and checking a box.
While PolyGun’s services are not illegal and many of its users seem to be ordinary retail traders, using the bot entails risks that are not readily apparent while onboarding.
Since various automated trading strategies are multiplied by the hundreds of thousands of users deploying them, a high-volume of trades concentrated on a specific event can have significant impacts on a given market (in some cases, moving or consciously manipulating its price). Additionally, trade latency creates structural disadvantages for retail traders, as one user openly discussed in PolyGun’s “Prediction Desk” channel on Jan. 29, 2026:
the bot copied the trade only after 30sec-1minute from the polymarket api, so when you try to copy the market already moved . . . if you accept slippage above 0.03 cents each direction it’s already in a loss.
Similarly, bot operators’ can see user trades as they come in but before they resolve, making it possible for them to use that information to take advantaged positions against users (known as “front-running”).
Despite PolyGun’s “non-custodial” architecture – meaning users “own” their own wallets and can export their private keys – it still stores users’ private keys in its servers, meaning its users’ safety is dependent on the integrity of the app’s architecture (which users can’t easily assess). If a trading bot’s architecture has vulnerabilities, it can fall victim to server-side attacks wherein users’ wallets are drained (as users of Polycule, another trading bot, experienced firsthand in January 2026, when hackers drained the bot’s treasury of $240,000).7
KYC and Account Farming
“Account farming” is the mass creation or purchase of verified accounts using illegitimate identity documents, effectively producing anonymous access points users can buy to avoid platforms’ KYC restrictions. Selling fraudulent accounts is a federal crime under 18 U.S.C. § 1028, with precedent;8 using such accounts to trade on a CFTC-regulated platform also implicates anti-fraud provisions under Rule 180.1, as well as violating terms of service. Since Polymarket’s ability to operate legally in the US depends on KYC, this secondary market allows users to undermine the framework.
Of the 10 Telegram accounts included in our datasets that mentioned Polymarket most often since November 2025, we found that eight had shared thousands of near-identical posts advertising KYC and account farming services related to Polymarket. Seven of the eight accounts shared posts written in Russian; the other used an English-language template.
One template (left, above), translated from Russian read:
VERIFIED ACCOUNTS FOR YOUR BUSINESS 🏦 Banks / cards / payment systems 💱 Crypto exchanges / P2P / exchangers 🎰 Bookmakers / casinos 🔒 SOF / AML / KYC / DeepFake / proxies 🧼 Crypto cleaning / withdrawal / unblocking 🌍 Any geography. Using your data or ours.
“SOF” (“source of funds”) refers to the sale of forged documents, “AML” refers to services that help users pass “anti-money laundering” screenings, “KYC” refers to the sale of verified accounts on financial platforms, and “DeepFake” refers to related, custom AI-generated images. The post also listed financial institutions these services were available for, including Polymarket.
The eight accounts shared thousands of similar posts, often in so-called “over the counter” Telegram channels: bootleg peer-to-peer marketplaces ostensibly meant to facilitate large cryptocurrency trades without platform brokerage fees that often feature advertisements for questionable and illegal services.9
Though the template each account used for its posts was unique, all eight shared their posts to the same channels, plausibly indicating their activities were coordinated.
Scams Based on Fake ‘Insider’ Information
Telegram hosts many public, semi-public, and private Polymarket trading groups where users discuss trade ideas and share information. Some of these groups, such as “Insiders Polymarket,” markets itself as a group of Fortune 500 insiders with access to private information and “leaks” that could be used to make profitable trades on Polymarket.
As one example of this scheme, the group’s moderators ran a series of promotional messages teasing a “leaked email”, eventually revealed to be related to Minnesota Rep. Ilhan Omar’s alleged plans to resign. As the document is fake (and Omar did not retire), it appears to be a scheme to manipulate users into inflating the price of a small political event contract by betting “Yes” in one direction (so that the group operators can bet “No” against them, making greater profits).
Private Trading Groups
On 4chan, users primarily discussed and commented on ideas for trades and exploits with one another in /pol/ and /biz/. One anonymous /pol/ user alluded to recruiting other disciplined traders, rather than gamblers, into a private Telegram trading group (“TG”) to manipulate less sophisticated traders (“frontrun normiedom”) in a post made on Jan. 13, 2026:
so are you guys betting on polymarket too?
anyone wanna form a TG for this? we can alert eachother if news is there and frontrun normiedom
i’m holding a bunch of money on polymarket in cash just so I can buy in the moment some conclusive news appears regarding iran strikes
pls no gambletards tho
Others, were more critical of Polymarket’s existence at all, including an anonymous /pol/ user who posted on Feb. 4, 2026:
Suffice to say, Polymarket is a rigged, corrupt, broken system that is not legitimate and should be investigated and banned . . . literal blatant corruption in a betting market and there’s no recourse. People’s money stolen because the more powerful users can control the outcomes of these bets
Conclusion
Palantir’s partnership with Polymarket appears to be a step toward on-chain transparency, but off-chain coordination remains a structural problem. While various Telegram communities promise retail traders easy and automated profits, many of these services are designed in ways that allow operators to hold users’ private keys and front-run their positions.
As Open Measures indexes millions of posts from alternative platforms including Telegram, we will continue to monitor off-chain activity surrounding prediction markets – and we encourage other financial and cybercrime researchers to do the same.
Identify online harms with the Open Measures platform.
Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.
David Yaffe-Bellany. “All Bets Are On: The Rise of Prediction Markets.” The New York Times. 19 Jan. 2026. Here.
Hochstein, M. (2024, Nov. 14). Polymarket’s probe highlights challenges of blocking U.S. users (and their vpns). CoinDesk. Here.
Polymarket. (2025, Nov. 25). Polymarket receives CFTC approval of Amended Order of designation, enabling intermediated U.S. Market Access. PR Newswire. Here.
Guardian News and Media. (2026, March 24). Kalshi and polymarket ban insider trading as senators look to curb prediction markets. The Guardian. Here.
CryptoRank. (2026, Jan. 12). Polycule trading bot sparks alarming rug pull fears after sudden withdrawal halt: Market security. CryptoRank. Here.