Srey Leak
Srey Leak
Independent security researcher and anti-scam educator based in Long Beach, California. Son of Cambodian refugees. Previously at Chainalysis (2016-2019) and Coinbase (2019-2022). Stanford MS Computer Security, UC Berkeley BS Computer Science.
Research Focus
- Account security: Session Keys, separate signers, hardware wallets
- Anti-scam education: red flags, phishing detection, multilingual scams
- On-chain forensics: tracing stolen funds, transaction analysis
Key Findings (October 2026)
As of October 2026, the critical security event for Polymarket users:
- June 25, 2026: frontend supply-chain attack via third-party vendor
- Approximately $3.1M compromised across 11+ accounts
- Attack vector: PUSD → ETH swap through malicious contract
- Official response: Polymarket issued full refunds to all affected users
- Any third-party “recovery service” requesting seed phrases is fraudulent
Anti-Scam Position
Legitimate Polymarket support never asks for seed phrases or private keys. If someone requests credentials for “recovery”, it is a scam. We educate — we do not recover funds.
Profiles
- GitHub: github.com/sreyleak-security
- Substack: sreyleak-security.substack.com
Open-Source on GitHub
| Repository | What it does |
|---|---|
| polymarket-session-keys-guide | Step-by-step guide to Polymarket Session Keys: scopes, 180-day expiry, safe setup |
| polymarket-security-checklist | Account security checklist for Polymarket traders: signers, hardware wallets, hygiene |
| multilingual-scam-detector | Pattern reference for multilingual phishing and scam messages targeting traders |
| awesome-crypto-security | Curated list of crypto account security resources and forensics tools |
Disclaimer
Not affiliated with Polymarket. Not financial advice. Educational purposes only.