Security
How 2WAYS handles your account
Plain descriptions of the parts that matter: how you are authenticated, where your money sits, what protects it, and how people try to scam you.
Telegram is your login
There is no 2WAYS password, because there is no 2WAYS account form. Telegram issues a signed payload identifying you when the mini app opens, and the backend verifies that signature before it answers anything.
- No email, no password, nothing to leak in a credential dump
- Sessions are tied to your Telegram account, so losing your phone is handled by Telegram's own recovery
- Turn on two-step verification in Telegram — it is the front door to everything here
Where your funds sit
Deposits are converted to the stablecoin Polymarket settles in and held in the Polymarket wallet attached to your account. Trades execute against Polymarket's own order book, on-chain.
- Balances and fills are visible on Polymarket, not only inside 2WAYS
- Withdrawals send to an address you supply and confirm
- Keep only what you are trading in the live balance
The 2FA vault
The vault is a separate balance you park funds in. Moving money out of it requires a second factor, so a session someone else got hold of cannot drain everything.
- Use it for the part of your balance that is not in play
- A compromised chat still cannot move vaulted funds
- Set it up before you deposit anything significant
Withdrawals
Withdrawal requests are explicit and confirmed in the bot chat, so every payout leaves a record in a conversation only you can read.
- Check the network and the address — on-chain transfers do not reverse
- Send a small test amount to a new address first
- Every withdrawal is logged in History with its transaction
Impersonators and fake links
The most likely way to lose funds here is a person, not a bug. Scammers clone the bot, the logo and the tone, then ask for something the real bot never would.
- 2WAYS will never ask for a seed phrase or a private key
- Support does not message you first, and never over a direct message asking for money
- Reach the app from 2ways.xyz or a link you saved yourself, not from search ads
- Admins in the Discord will not DM you offering to fix your balance
What we keep
The app stores what it needs to show you your account: your Telegram identifier, your trading history, and your preferences. It does not need your phone number, your contacts or your location.
- Your Telegram phone number is not exposed to the app
- Preferences such as language and theme are stored per account
- Analytics are aggregate traffic counts, not per-user trade surveillance
Found something?
Report vulnerabilities in the Discord to a listed maintainer before disclosing them publicly. Tell us what you found and how to reproduce it, and give us a chance to ship a fix.