Five red flags of crypto "recovery" scams

After the June 2026 Polymarket frontend hack, the victims got their money back — and then the real scam started. DMs flooded in from "recovery specialists" who had watched the same on-chain transfers everyone else did. I teach scam-prevention workshops in Long Beach, and this pattern shows up in every language community I work with. Here are the five red flags I drill. 1. They contact YOU. Real support never initiates a DM. Polymarket, Coinbase, MetaMask — none of them cold-message users about stolen funds. 2. They ask for a seed phrase or private key. There is no legitimate reason for anyone to need it. Not for "verification", not for "safe-keeping", not to "recover" anything. 3. They promise guaranteed recovery. On-chain theft is not reversible by a third party. If someone claims otherwise, they are selling you a story. 4. They manufacture urgency. "Your funds expire in 24 hours." Urgency exists to stop you from checking. 5. Their links look official but aren't. Check the domain character by character. Polymarket support does not live at polymarketsupport[.]xyz. One sentence to remember: Polymarket refunded every June-hack victim directly. No third party was ever needed — and none will ever be. I'm a security researcher, not a recovery service. I write guides: session keys, multilingual scam patterns, pre-trading checklists. Links on my profile. Learn more about crypto security security #crypto #scams #polymarket