SlowMist CISO: Beware of malicious code hidden in a certain Polymarket copy trading bot program that can steal private keys

According to ChainCatcher, 23pds, Chief Information Security Officer of SlowMist Technology, reposted a community user's tweet on the X platform showing that a developer of a Polymarket copy trading bot had hidden malicious code in the GitHub code. When the program is launched, it automatically reads the user's ".env" file (which contains the wallet private key), then sends the private key to the hacker's server and steals it, resulting in the loss of funds. The author of this program repeatedly modified and submitted the code on GitHub, deliberately hiding the malicious package. 23pds stated that caution is needed with this method, "this is not the first time, nor will it be the last."