460KB Malware Template Hits Three Polymarket Bot Repos

460KB Malware Template Is Spreading Fast — Check Your Forks

Today's lead is a security story. Three separate GitHub repositories were flagged carrying an identical 460KB payload: one targeting Polymarket sports arbitrage, one a generic Polymarket bot, and one a Kalshi/Polymarket hybrid. The exact file size match is the tell — this is a template being cloned and re-skinned, not independent malware. If you forked anything in the Polymarket bot space in the last 48–72 hours, audit it now. Check for unexpected network calls, hardcoded RPC endpoints you didn't write, and any eval() or exec() patterns touching your key material. The attack surface here is obvious: operators with live API keys and funded wallets running code they half-read.

Zero confirmed malware in today's seven new repos, but that number (three hits in one day) suggests an active campaign, not a one-off.

---

New Bots: 7 Found, 7 Worth Cloning

**polymarket-weather-edge** is the most conceptually interesting repo this week. It builds a Gaussian probability model over live METAR observations and Open-Meteo forecast data, then compares that model's implied probability against market prices. The core trade is shorting NO when the market is overconfident about temperature threshold hits. Weather markets on Polymarket have historically been thin and poorly calibrated — this is a real edge if the data pipeline holds.

**polymarket-copybot** deserves close inspection. The friction adjustment is the right idea: net edge is calculated as PnL/volume minus 2.3% times spread crossings, which means it's penalizing traders who look profitable but are actually grinding through spread costs. Hard gates on max drawdown and position limits are baked in, and the key-local-only architecture means credentials never leave the machine. This is the most production-ready copy-trading implementation we've seen in this space.

**polymarket-whale-tracker** does something subtler — it's trying to distinguish bot activity from human whales using order size uniformity, timing consistency, and multi-market correlation patterns. The output is copy-trade signal generation. Worth watching how it handles the adversarial case where sophisticated bots randomize their own signatures.

**polymarket-quotebot** is a market-making simulator — no live execution, just measurement. It models theoretical LP reward share, fill rates against the real CLOB, and adverse selection costs from historical data. Useful for anyone thinking about providing liquidity before committing capital.

**PolymarketBTCMonitor** covers 5-minute BTC binary options with configurable thresholds and Telegram alerts for price swings and spread anomalies. Narrow use case, but clean implementation for anyone running those markets.

---

Alpha Signals: Three Papers Worth Reading

No live trade signals today, but three research papers with direct operator relevance.

The merger arbitrage LLM paper is immediately applicable — long-context reasoning over regulatory filings and deal documents to forecast merger outcomes. Polymarket runs these markets regularly and they're often mispriced in the week after announcement when document volume is highest.

The 'financial epiplexity' paper formalizes something operators already feel intuitively: there's a gap between detectable market structure and exploitable market structure given real computational constraints. It gives you a framework for thinking about whether a signal is real or just expensive to act on.

The signature-based optimal execution paper matters for anyone running size. Modeling alpha decay and market impact as path-dependent functionals is the right approach for CLOB markets with thin books.

---

What to Watch

The HN item on Spain blocking Polymarket and Kalshi over licensing is regulatory noise for now, but the pattern of jurisdiction-by-jurisdiction licensing challenges is accelerating. Build geo-aware infrastructure if you're not already. The death-threat story around the Iran missile market is a reminder that geopolitical markets carry off-platform risk that no bot handles well. The 'Nothing Ever Happens' NO-buyer bot hitting 471 points suggests the base rate bias toward inaction is getting mainstream attention — expect that edge to compress.