Audit log

Every state-changing event for PolyArb: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-23 03:38:33Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 449,583,504

   sig

   4MU5F9ND3bVE…zu3G3LQXcopyexplorer ↗

   hash

   CdZyqBGcpNMB…VgYgbpHqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (9210 B) ▸

   {"actor":"system:backfill","investigation_id":"bd06de19-e001-4b28-9227-fdcd75358535","kind":"publish","page_slug":"polyarb","published_at":"2026-09-23T03:38:33.142Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"PolyArb","sections":[{"content":"On May 4, 2026, blockchain investigator ZachXBT publicly identified PolyArb as a deceptive prediction-market product whose website allegedly contains a wallet drainer (referred to in some coverage as a \"wallet swapper\") designed to steal funds from users who connect their wallet. ZachXBT's warning followed an interaction between tech investor William LeGate and the PolyArb account on X, which ZachXBT said risked giving the alleged scam exposure to a wider pool of potential victims. Security researcher \"bbsz\" reportedly characterized the operation as part of a cluster run by an individual associated with both wallet drainers and occasional malware campaigns operated across different front-end products, describing it as a longer-running, credibility-building operation rather than a typical hit-and-run drainer. These allegations originate primarily from social-media statements by named security researchers relayed through crypto news outlets; no independent confirmation from a law-enforcement or regulatory body has been identified.","heading":"ZachXBT Fraud Allegation and Wallet Drainer","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT: PolyArb for Fake Prediction Market Product with Wallet Swapper — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605395916"},{"credibility":3,"name":"ZachXBT Flags Polyarb as Fake Prediction Market With an Active Wallet Drainer — CryptoBreak.net","type":"news_article","url":"https://www.cryptobreak.net/cryptocurrencies/bitcoin-btc/zachxbt-flags-polyarb-as-fake-prediction-market-with-an-active-wallet-drainer.html"},{"credibility":2,"name":"Beware of wallet draining products on Polymarket, prediction markets, analysts warn — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/32805424/"}]},{"content":"According to the reporting cited above, the PolyArb account allegedly engaged in reply-based marketing under posts from well-known prediction-market-related accounts, a tactic described as intended to drive traffic and lend the product an appearance of credibility. This is characterized as distinguishing PolyArb from typical short-lived, low-effort drainer scams, since the operation reportedly built an ongoing social-media presence rather than relying on a single viral push. This claim rests on secondary reporting summarizing researcher commentary rather than a primary document, and should be treated as alleged.","heading":"Marketing and Traffic-Generation Tactics","severity":"high","sources":[{"credibility":2,"name":"ZachXBT: PolyArb for Fake Prediction Market Product with Wallet Swapper — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605395916"},{"credibility":2,"name":"Beware of wallet draining products on Polymarket, prediction markets, analysts warn — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/32805424/"}]},{"content":"The domain polyarb.io has been catalogued by the phishing-tracking service PhishDestroy, which recorded it as first identified and registered on April 8, 2026, hosted on IP 172.67.153.181 and registered through Name.com. PhishDestroy's listing indicates the domain was flagged by 4 of 91 security vendors on VirusTotal and appears on blocklists maintained by MetaMask and SEAL, and it associates the site with impersonation of the Jupiter brand (a Solana-based trading protocol) rather than Polymarket or Kalshi directly. A separate related domain, polyarb.bot, is also tracked by the same service with at least one detection as of the source's 2026 report. These technical indicators corroborate the wallet-drainer allegation but come from an automated/community threat-intelligence aggregator rather than a named forensic investigation, so specifics (e.g., total funds stolen, exact drainer mechanism) remain unverified.","heading":"Domain and Technical Indicators","severity":"high","sources":[{"credibility":2,"name":"polyarb.io — Active Crypto Wallet Theft Phishing domain profile — PhishDestroy","type":"research","url":"https://phishdestroy.io/domain/polyarb.io/"},{"credibility":2,"name":"Is polyarb.bot Legit or Scam? — PhishDestroy","type":"research","url":"https://phishdestroy.io/domain/polyarb.bot/"}]},{"content":"PolyArb's exposure occurred amid a broader increase in phishing activity targeting prediction-market users during 2026, as prediction-market open interest reportedly reached a record $1.3 billion in April 2026 across platforms including Kalshi (approximately $636.4 million) and Polymarket (approximately $589.8 million), a growth in user base and funds that reporting suggests made the sector an attractive phishing target. Separately from PolyArb, multiple outlets reported that a distinct phishing campaign used Polymarket's own comment sections to post links advertising fake \"private markets\" with better odds, directing victims to sites that mimicked Polymarket's interface and used a fake Cloudflare verification pop-up to execute malicious code and drain wallets; this campaign was reported to have cost users over $500,000 and was first flagged publicly by a trader using the handle \"25usdc.\" These are reported as related but separate schemes exploiting the same user base and general phishing pattern (fake tools/links preying on prediction-market traders), not the same operation as PolyArb.","heading":"Broader Context: Wave of Prediction-Market Phishing","severity":"medium","sources":[{"credibility":2,"name":"Beware of wallet draining products on Polymarket, prediction markets, analysts warn — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/32805424/"},{"credibility":2,"name":"Polymarket Users Face Phishing Campaign That Has Stolen Over $500,000 — BingX","type":"news_article","url":"https://bingx.com/en/news/post/polymarket-users-warned-of-phishing-scheme-that-has-stolen-over-k"},{"credibility":2,"name":"Phishing Link in Polymarket Comment Section Ends up Losing User $90,000 — GamblingNews","type":"news_article","url":"https://www.gamblingnews.com/news/phishing-link-in-polymarket-comment-section-ends-up-losing-user-90000/"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT: PolyArb for Fake Prediction Market Product with Wallet Swapper — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605395916"},{"credibility":3,"name":"ZachXBT Flags Polyarb as Fake Prediction Market With an Active Wallet Drainer — CryptoBreak.net","type":"news_article","url":"https://www.cryptobreak.net/cryptocurrencies/bitcoin-btc/zachxbt-flags-polyarb-as-fake-prediction-market-with-an-active-wallet-drainer.html"},{"credibility":2,"name":"Beware of wallet draining products on Polymarket, prediction markets, analysts warn — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/32805424/"},{"credibility":2,"name":"polyarb.io — Active Crypto Wallet Theft Phishing domain profile — PhishDestroy","type":"research","url":"https://phishdestroy.io/domain/polyarb.io/"},{"credibility":2,"name":"Is polyarb.bot Legit or Scam? — PhishDestroy","type":"research","url":"https://phishdestroy.io/domain/polyarb.bot/"},{"credibility":2,"name":"Polymarket Users Face Phishing Campaign That Has Stolen Over $500,000 — BingX","type":"news_article","url":"https://bingx.com/en/news/post/polymarket-users-warned-of-phishing-scheme-that-has-stolen-over-k"},{"credibility":2,"name":"Phishing Link in Polymarket Comment Section Ends up Losing User $90,000 — GamblingNews","type":"news_article","url":"https://www.gamblingnews.com/news/phishing-link-in-polymarket-comment-section-ends-up-losing-user-90000/"}],"summary":"PolyArb is a crypto product marketed as a prediction-market arbitrage bot for platforms like Polymarket, but was publicly identified by on-chain investigator ZachXBT on May 4, 2026 as a fraudulent front containing an active wallet drainer. Independent phishing-domain trackers separately flagged associated domains (including polyarb.io) as malicious. The operation surfaced amid a broader wave of phishing targeting prediction-market users in 2026, though PolyArb itself is a distinct scheme from the unrelated Polymarket comment-section phishing campaign that cost users over $500,000.","timeline":[{"date":"2026-04-08","event":"The domain polyarb.io was registered and subsequently flagged as a phishing/wallet-theft domain by threat-intelligence tracker PhishDestroy.","source":"PhishDestroy domain profile for polyarb.io","source_url":"https://phishdestroy.io/domain/polyarb.io/"},{"date":"2026-05-04","event":"Blockchain investigator ZachXBT publicly flagged PolyArb as a fake prediction-market product containing an active wallet drainer, after tech investor William LeGate interacted with the PolyArb account on X.","source":"Bitget News / CryptoBreak.net","source_url":"https://www.bitget.com/news/detail/12560605395916"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a30ed6f0-9ec4-427e-9314-e23647f90488copy
2. #2rescoreby systemsystem

   2026-10-27 06:14:55Z
   Score: 2 → 26 (+24)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 2 → 26. Problems weighed by who is responsible: the subject's own conduct −55, problems around the subject, caused by others −0.8; no established finding that it defrauded anyone, so it stays out of the red band.
   anchoranchored

   chain

   ●mainnet-betaslot 461,967,261

   sig

   3ecMcp5mBieh…DZysKrFDcopyexplorer ↗

   hash

   C1jwvyz1iuMA…pSo6mUW2copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (643 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:14:55.013Z","decision":"rescore","investigation_id":"bd06de19-e001-4b28-9227-fdcd75358535","new_score":26,"page_slug":"polyarb","prev_score":2,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 2 → 26. Problems weighed by who is responsible: the subject's own conduct −55, problems around the subject, caused by others −0.8; no established finding that it defrauded anyone, so it stays out of the red band.","score_delta":24,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 29e4e3d7-2154-4d37-aa42-89bba1780eaccopy
3. #3reviewby reviewerreviewer

   2026-10-27 11:36:43Z
   Score: 26 → 26 (no score change)
   The core allegation (ZachXBT flagged PolyArb as a wallet-drainer front on 2026-05-04) is well corroborated and appropriately hedged. Errors lie in the PhishDestroy section: the polyarb.io registration date is January 10, 2026 and not April 8 (also wrong in the timeline), the MetaMask/SEAL blocklist claim is contradicted by the source's structured data, and the Jupiter impersonation is only an automated label. The Cloudflare pop-up and 25usdc details in the broader-context section were not found in the BingX source. No shutdown or sanctions found.
   anchoranchored

   chain

   ●mainnet-betaslot 462,056,109

   sig

   3NoTd55ThTYJ…SpGir3Nbcopyexplorer ↗

   hash

   HpTVsTQVgUbq…ADKPCrurcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1434 B) ▸

   {"actor":"reviewer","artifact_identity":"ab530d195bcbc73b4c152c660bf48378","blocked_count":1,"decided_at":"2026-10-27T11:36:43.272Z","decision":"review","disputed_pct":0.25,"findings_hash":"HhFZFLJ3zzqeXA7zcTdKV9ytEKG9zNeHX5y186anfYp2","investigation_id":"bd06de19-e001-4b28-9227-fdcd75358535","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":26,"omissions":{"material":0,"total":2},"page_content_hash":"e1e2ad6a2fa2456b04dceb558630eb626f44d291a3b171e9e663b687d4355708","page_slug":"polyarb","prev_score":26,"reason":"The core allegation (ZachXBT flagged PolyArb as a wallet-drainer front on 2026-05-04) is well corroborated and appropriately hedged. Errors lie in the PhishDestroy section: the polyarb.io registration date is January 10, 2026 and not April 8 (also wrong in the timeline), the MetaMask/SEAL blocklist claim is contradicted by the source's structured data, and the Jupiter impersonation is only an automated label. The Cloudflare pop-up and 25usdc details in the broader-context section were not found in the BingX source. No shutdown or sanctions found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":12,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 18db2ab0-53dd-4fd5-bc5d-912fb6717102copy
4. #4review reviseby judgejudge

   2026-10-27 11:36:43Z
   Score: 26 → 26 (no score change)
   The central claim, that ZachXBT flagged PolyArb as a wallet-drainer front on May 4, 2026, is confirmed by several independent outlets (claim_findings[0]). Three of the 12 checkable findings (25%) were disputed, all in the PhishDestroy domain section. The polyarb.io registration date is January 10, 2026, not April 8, in both the section and the timeline (claim_findings[1], [2]), and the cited source lists MetaMask and SEAL as 'no match' rather than as blocklisting the domain (claim_findings[3]). One finding was left out of the percentage because the source blocked the reviewer (claim_findings[12]). The two omissions are minor, and nothing indicates a shutdown or sanction. The page also lacks on-chain evidence such as drainer addresses and loss totals, a high-priority gap, so a revision is warranted rather than approval.
   anchoranchored

   chain

   ●mainnet-betaslot 462,056,115

   sig

   4iUam6bqA3TT…P4RqD6Ctcopyexplorer ↗

   hash

   sgF9GfmrFNWe…gcCBbPXicopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1506 B) ▸

   {"actor":"judge","artifact_identity":"ab530d195bcbc73b4c152c660bf48378","band_override":null,"blocked_count":1,"decided_at":"2026-10-27T11:36:43.272Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.25,"investigation_id":"bd06de19-e001-4b28-9227-fdcd75358535","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":26,"page_slug":"polyarb","prev_score":26,"reason":"The central claim, that ZachXBT flagged PolyArb as a wallet-drainer front on May 4, 2026, is confirmed by several independent outlets (claim_findings[0]). Three of the 12 checkable findings (25%) were disputed, all in the PhishDestroy domain section. The polyarb.io registration date is January 10, 2026, not April 8, in both the section and the timeline (claim_findings[1], [2]), and the cited source lists MetaMask and SEAL as 'no match' rather than as blocklisting the domain (claim_findings[3]). One finding was left out of the percentage because the source blocked the reviewer (claim_findings[12]). The two omissions are minor, and nothing indicates a shutdown or sanction. The page also lacks on-chain evidence such as drainer addresses and loss totals, a high-priority gap, so a revision is warranted rather than approval.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":12,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7f1615ac-863d-4147-8f54-b406181af207copy