The direct answer
Use Polymarket from a route you open yourself, not from a forwarded link, urgent chat message or surprise wallet pop-up. If a request is unexpected, asks for a secret, or tries to turn an airdrop rumor into a deadline, stop. There is no prize worth rushing a wallet decision.
I like the autonomy of a wallet-native setup. The trade-off is simple: the user has to keep control of the keys and pay attention to what a request actually does. That is responsibility, not a flaw—but it only works when the boundary is clear.
What you never share
Non-negotiable secrets
Keep private keys, recovery or seed phrases, passwords, one-time email codes and developer API credentials out of chats, forms, screenshots and “verification” pages. A support conversation can explain a problem; it does not need the thing that controls your wallet or account.
Polymarket describes its wallets as non-custodial. In practical terms, that means control stays with the wallet holder rather than being delegated to a platform custodian. It also means a disclosed secret is not a minor account-detail mistake. The person holding it can potentially act as you.
Requests are not all the same
| What you see | What it can mean | Good response |
|---|---|---|
| Public address or transaction hash | A public identifier for a wallet or transfer. | Share only if it is relevant and you opened the support route yourself. |
| One-time email code | A sign-in confirmation for the account flow you started. | Enter it only in the expected official screen; never forward it to a person. |
| Wallet signature | A request to prove control or authorize a defined action. | Read the account and purpose. Reject it if you did not start that exact action. |
| Transaction or token approval | A blockchain action that can move value or grant a permission. | Slow down. Confirm the action, account and amount before approving. |
| Private key, recovery phrase, password or API credential | A secret that can control access or authorize actions. | Never disclose it. Close the conversation or page. |
The useful distinction is not “does this look technical?” It is “did I start this exact action, and do I understand its effect?” A normal signup or wallet connection can include a message to sign. That does not make a signature request from a notification, direct message or copycat site normal.
Token and airdrop claims
Polymarket says it has not announced a token, airdrop, giveaway or token-generation event. That makes the practical rule very easy: ignore any claim that needs your wallet connection, signature, approval or secret before you can “claim” it.
A familiar scam shape
A message says an airdrop expires today and sends you to a page that looks almost right. It asks you to connect a wallet, then escalates to a signature or recovery phrase. The right response is not to inspect the offer harder. Close it, open Polymarket independently, and wait for information you can confirm through a route you already trust.
Urgency is doing most of the work in that pitch. A real decision can survive a pause; a scam often cannot.
A simple check before you act
- Start point: Did you open the official route yourself, or did someone else create the moment?
- Purpose: Does the request match the exact account, connection, order or transfer action you intended?
- Scope: Is it asking for a public identifier, a normal confirmation, a signature, an approval or an actual secret?
- Pause: If the wording, wallet, account or timing is unfamiliar, reject it. You can always restart a genuine action from the official route.
This is deliberately boring. Good security behavior should be boring: one known starting point, one intended action, and no improvising under pressure.
If something feels off
Do not try to repair uncertainty by sending another transfer, signing another request or sharing more information. Close the prompt and return to the internal guide that matches what you were doing. The wallet-connection guide covers a normal connection flow, while Polymarket Troubleshooting keeps common operational problems separate from a request that may be unsafe.
If a private key, recovery phrase, password, one-time code or API credential has already been disclosed, the situation has moved beyond ordinary troubleshooting. Act promptly through the trusted recovery or security process for the specific wallet or account involved; do not keep engaging with the person or page that asked for it.
Bottom line
Polymarket can be wallet-native without being reckless. Keep control of the actual secrets, start from routes you trust, and reject any unexpected request that asks you to sign, approve or disclose more than the action requires. The safer choice is usually the slower one—and a real opportunity will still be there after you verify it.
Frequently Asked Questions
Is Polymarket non-custodial?
Yes. Polymarket describes its wallets as non-custodial, meaning the user controls the wallet secrets rather than handing custody of those secrets to Polymarket. That control is valuable, but it also means a private key, recovery phrase or password must remain private.
Will Polymarket ask for my private key or recovery phrase?
No. A Polymarket account or wallet flow does not need your private key or recovery phrase typed into a chat, form or support message. Treat any request for either secret as a stop sign, even if the sender uses Polymarket branding or claims urgency.
Does Polymarket have a token or airdrop?
No announced Polymarket token, airdrop, giveaway or token-generation event is currently described by Polymarket. Do not connect a wallet, sign a claim or disclose a secret because a message promises one; wait for a confirmed official announcement you can reach independently.
Should I sign an unexpected Polymarket wallet request?
No. Sign a Polymarket wallet request only when you started the exact action and the account, purpose and requested permission make sense. A signature can authorize an action, so an unexpected prompt should be rejected and reopened from the official flow you navigate to yourself.
What can I safely share with Polymarket support?
You can describe the problem and share only the minimum non-secret information needed to identify it, such as a public transaction hash when relevant. Never share a private key, recovery phrase, password, one-time sign-in code or developer API credential with anyone offering Polymarket support.
What should I do after a suspicious Polymarket message?
Stop interacting with the message, do not click its link or approve its request, and open Polymarket again through a route you already know. If you disclosed a secret or approved an unfamiliar action, treat that as urgent and use an appropriate trusted recovery or security process for the wallet or account involved.
Use the right guide for the action you meant to take
Return to a normal account or wallet flow only after the request makes sense. Do not let an unsolicited message choose the route for you.