The 2026 World Cup, Polymarket, New Crypto Users, and New Threats

The World Cup comes to an end today. For many people, it became their first introduction to cryptocurrency. Prediction markets are the reason. They offered football fans a new way to bet on match outcomes. And this way of betting seems more reliable and transparent than using traditional bookmakers. Apparently, bookmakers took this competition seriously and used their lobbying power to have the best-known prediction market, Polymarket, banned in a number of countries. During the tournament itself, Polymarket was either banned or added to the list of illegal platforms in the Czech Republic and France. India, Indonesia, and Spain took similar measures shortly before the tournament began, while Brazil and Argentina did so earlier in the spring.

Why are football fans who like to bet increasingly choosing platforms such as Polymarket over traditional bookmakers? Because on prediction markets, everything looks clearer, fairer, and more reliable than it does at a bookmaker. All the complexities associated with cryptocurrency are hidden from view. You can sign up with Google, or connect MetaMask, Trust Wallet, or any other wallet. Then all you have to do is choose an outcome and bet however much you are willing to risk.

But behind this simplicity lie threats that even fairly experienced cryptocurrency users may not know about. Imagine how vulnerable complete beginners can be, especially when they are caught up in the excitement of betting.

These are the threats I want to discuss in today's article.

Where Polymarket Really Is Fairer Than a Bookmaker

When you place a bet with a traditional bookmaker, the company itself is your counterparty. It calculates the odds, builds its own profit margin into them, takes on the risk of a particular outcome, and may change the terms, limit the size of your bets, or refuse to accept them altogether.

Polymarket uses a different model. Your counterparty is another platform user just like you. The only difference between you is your view of the outcome of a match or some other event. Suppose that user puts up 60 cents on one outcome in the hope of receiving one dollar, while you put up 40 cents on the opposite outcome to receive the same dollar. Your orders will automatically match, creating a fully collateralized pair of "Yes" and "No" tokens. Once the match is over, one of those tokens can be redeemed for one dollar, depending on the final result.

Everything on Polymarket is more flexible than it is at any bookmaker. Every user can view all the orders submitted by other participants in the order book and set their own price. They can also sell their bet before the event ends if they change their mind, or if the market moves in their favor and the position is already profitable. In this respect, Polymarket is much more like an exchange than a bookmaker.

Settlement takes place through smart contracts on the Polygon network. A smart contract cannot know the outcome of a match or any other real-world event. Someone participating in the market therefore has to submit that outcome. You can do it yourself. And if you are wrong, any other participant can challenge your decision. The dispute is then put to a vote by UMA token holders, and the result of that vote is considered final. This is far more transparent than a bookmaker's closed internal process.

But transparency does not necessarily mean safety for the user.

Polymarket Is Not as Decentralized as It Appears

Polymarket is sometimes described as a decentralized bookmaker. But both words in that phrase are inaccurate. First, it is not a bookmaker, because it does not set the odds and does not take on the risk of any particular outcome. Second, there is very little about Polymarket that is genuinely decentralized.

Polymarket's documentation calls its trading system "hybrid-decentralized." Orders are matched by a centralized operator. Gas for recording trades on the blockchain is paid through the platform's gateway, which means a trade cannot go through without the platform's cooperation. Every new market is created by the team. Although it accepts suggestions from the community, users cannot create new markets themselves. The Polymarket team also drafts the resolution criteria and selects the sources that will later be used to determine the outcome.

These are all examples of a centralized approach. So what exactly remains decentralized? To be honest, I do not know. Perhaps only the composition of the market itself. Anyone is allowed to trade.

At first glance, dispute resolution is a decentralized process. But the smart contract that executes the decision reached through voting is controlled by an administrator with the authority to determine payouts manually. Amusingly, one of Polymarket's administrator addresses, which has this authority, is marked as compromised on Polygonscan.

Even the rules of an already open market may sometimes be clarified centrally by the team. Polymarket can publish what it calls "additional context," which participants are asked to consider during the dispute-resolution process. These clarifications are recorded on the blockchain and, under the rules, are not supposed to change the original meaning of the question. But the very need for such a mechanism shows how much depends on wording prepared by a centralized team.

So, users here are no less dependent on the platform's administrators than they are at traditional bookmakers.

The Price on the Screen Is Not Always Your Price

Imagine that before a match, bookmakers are offering odds of 1.25 on your chosen outcome. In other words, you need to stake 80 cents to win one dollar. At the same time, Polymarket shows that the probability of your outcome is 75%. Does that mean you can buy "Yes" tokens for 75 cents? You can, provided someone is willing to put up 25 cents on the opposite outcome. But there is no guarantee that anyone will.

The probability displayed on Polymarket is often the midpoint between the best bid and the best ask.

For example, if the bid is 70 cents and the ask is 80 cents, the screen may display 75%. But buying immediately will cost at least 80 cents, while selling immediately will bring only 70. If the spread is wider than 10 cents, Polymarket shows the price of the most recent trade instead of the midpoint, and that price may differ from the current market by several times.

Major football markets usually have enough liquidity for the difference between the displayed probability and the price actually available to be small. But on niche events, anyone planning a large trade also needs to look at how many opposing orders are available.

A bookmaker's odds may be worse and may include an opaque margin. But the user normally sees immediately the price at which the bet will be accepted.

Prices are formed more fairly on Polymarket, but users still need to know how to read them. Not everyone acting under the influence of excitement is capable of doing that.

Every Bet Is an Interaction With a Web3 Wallet

Every bookmaker's customer hands money over to the company, which is then responsible for keeping it safe. A Polymarket user also hands money — cryptocurrency or stablecoins — over to the platform, but from that point onward, the user bears all the responsibility.

In exchange for the assets transferred to Polymarket, the user receives the platform's internal tokens — pUSD. They have almost no circulation outside the platform. They are something like casino chips: they can be used for bets, or trades, and then returned to the platform in exchange for ordinary crypto assets.

Technically, however, these tokens are stored in the user's personal wallet, and that wallet must be used to sign every transaction.

Even when you sign up with Google, a dedicated Web3 wallet is created for you and embedded in the Polymarket website interface. This wallet can be accessed only through your browser, which means you alone are responsible for keeping the funds in it safe.

When an external wallet is used, signatures, approvals, and addresses enter the picture. The user always sees a technical Web3 wallet window asking them to confirm a transaction. But the EIP-712 signature used in this process looks like technical gibberish to anyone without deep knowledge of blockchain technology. Ask yourself: do you personally always understand exactly what you are signing? I am sure many people would answer "no." Otherwise, we would not see so many depressing stories about Web3 wallet users losing large sums after signing phishing transactions.

At rabbit.io, we deliberately avoid connecting customers' wallets to our website when you create exchange orders. Instead, we just provide an address to which you need to send the cryptocurrency. You copy that address into your wallet and then confirm a transaction that you created yourself. It is clear and safe.

On Polymarket, however, every transaction is generated automatically by scripts on the website. You do not need to copy anything anywhere. All you have to do is click a confirmation button in the wallet pop-up. And that becomes the foundation for one particularly dangerous scam.

The Bookmark That Can Drain Your Funds

As Polymarket becomes more popular, so does the number of offers promising ways to make money from betting with automated scripts or AI agents. Search YouTube for ways to make $1,000 on Polymarket in a week, and you will find plenty of options. I will not link to them because I do not want to draw attention to those videos. Most of them are scams.

The person behind the video provides a link to a bot or an "AI assistant." You follow it and see instructions: "Open your browser, create a new bookmark, copy this code into the bookmark's address field, and save it."

You do as instructed. A bookmark appears in your browser bar. It looks like nothing more than a saved link needed to launch a sophisticated bot that works with the Polymarket interface.

Then you open Polymarket and click the bookmark. At that moment, your wallet is drained.

The code stored in the bookmark does the following:

1. It reads data from your browser, including wallet addresses, balances, and authentication tokens.
2. It determines how you signed in — through Google or through a wallet.
3. If you signed in with Google, it uses a hidden frame to sign a withdrawal transaction.
4. If you signed in through a wallet, it asks you to sign an EIP-712 structured message that looks like an incomprehensible technical formality.
5. It sends the money to the scammer's address.

There is no one to blame for the loss and no one onto whom the responsibility can be shifted. You added the code to your browser yourself. You clicked the bookmark yourself. From the browser's point of view, it was your action.

This scheme is spreading more widely for two reasons. First, very few people understand what EIP-712 is, why the browser is asking for permission, or what that permission covers. Second, the scammer does not need to hack Polymarket or develop a sophisticated exploit. All they need to do is persuade someone to paste in a piece of code. When the promise is easy money in an area as promising as prediction markets, that is not especially difficult.

Why the World Cup Was the Perfect Time for Scammers

Social engineering in the cryptocurrency industry is especially effective when three conditions are present at the same time:

1. Users have a lot of money.
2. A new audience arrives without established cryptocurrency security habits.
3. There is enormous demand for advice, strategies, signals, and "secret methods."

The World Cup created all three conditions on Polymarket at once.

A football fan understands why one national team is stronger than another, but does not understand the difference between connecting a wallet, signing in with Google, signing a message, granting permission to a smart contract, and sending a transaction. That is why the creator of a scam video may appear more knowledgeable simply because they demonstrate confident use of a platform the viewer has heard a lot about but has never actually used.

Traditional bookmakers are also imitated by phishing websites, and bookmaker accounts are stolen with malware. But bookmakers have complaint procedures and bear responsibility for money held in user accounts. Moreover, for every sum involved, the bookmaker, the customer, and the regulator know who owns it, because all customers of regulated bookmakers are required to verify their identity. This does not change the fact that a bookmaker may impose rules allowing it to restrict a successful player, void a bet, or delay a withdrawal review. But it is unlikely to be able to steal your money outright.

If a scammer obtains a valid cryptographic signature and transfers the assets to their own address, however, there is often no one left to argue with. A smart contract does not know whether you knowingly authorized the signature or were deceived into providing it. As far as the contract is concerned, a signature is either valid or it is not.

Is Polymarket Really More Dangerous Than a Traditional Bookmaker?

For a cryptocurrency beginner, it may well be. The danger comes from threats that an inexperienced user does not even know exist.

Polymarket is more transparent than a traditional bookmaker when it comes to price formation, access to market data, trading between participants, and onchain settlement. The platform is not your permanent opponent in every position and has no interest in seeing you lose.

But a bookmaker is often safer when users rely on familiar forms of consumer protection: account recovery, payment disputes, and the ability to file a complaint. Polymarket hides behind a facade of "hybrid decentralization" to avoid legal responsibility for losses suffered by its users.

Today, football fans are placing their final bet on the winner. And I hope that if you decide to place such a bet on Polymarket for the first time, this article has helped you avoid the main mistakes: you will not confuse the displayed price with the midpoint, mistake a technical signature for a withdrawal transaction, or take a wallet-draining program for a useful browser bookmark.