Copytrading bot confirmed malware; whalewatch worth cloning

Malware Alert Leads Today's Cycle

The most important finding from this cycle is unambiguous: **Polymarket-Copytrading-Bot is confirmed malware**. If you have run it, treat your keys as compromised immediately. The repo presents itself as a copy-trading tool that tracks top Polymarket traders and mirrors their positions — a convincing surface for anyone looking to ride smart-money flow without building infrastructure. Do not run it. Do not share it. Full stop.

This lands in the same week we flagged a huge repo masked as a futures bot (see Security section below), which suggests a coordinated wave of malicious tooling targeting the Polymarket operator community. Stay sharp.

---

New Bots This Cycle (6 Found, 2 Worth Your Time)

**Worth cloning:**

• **polymarket-whalewatch** — The standout legitimate find this cycle. Monitors large fills, split-buy accumulation patterns, and aggregates smart-money consensus signals to surface market-moving activity before it's priced in. If you're building signal pipelines or running manual books on high-liquidity markets, this is worth pulling apart. The split-buy accumulation detection in particular is useful for catching wallets that are sizing into positions gradually to avoid moving the market.

**Monitor tier:**

• **pm-crypto-trend-dashboard** — A dashboard companion for a 5-minute crypto trend strategy. No autonomous execution, but the performance visualization layer could be useful if you're running your own short-interval bots and want a display harness without building one from scratch.
• **awesome-prediction-market-analytics-tools** — A curated aggregator of external tools and data sources. Not a bot. Useful as a reference list, particularly if you're mapping the current tooling landscape.
• **polymarket-tui** — Terminal UI for manual trading and market browsing. No autonomous strategy. Worth bookmarking if you operate without a GUI and want a lightweight interface for order entry and market scanning.

---

Security: Three Alerts Worth Acting On

Seven security alerts total this cycle. The three most operationally relevant:

1. **Confirmed malware — Polymarket-Copytrading-Bot.** Covered above. Keys first. 2. **Huge repo size masked as futures bot.** Oversized repos are a classic obfuscation tactic — bulk filler to bury a malicious payload. This one is flagged as malware. Do not run anything calling itself a Polymarket futures bot that you haven't audited line by line. 3. **Fake stars on Telegram Polymarket bot + garbled username spam repos.** Star farming is being used to manufacture social proof on bots circulating in Telegram groups. GitHub star counts mean nothing right now. Verify repos by reading the code, checking commit history, and looking at who is actually starring.

---

Alpha Signals: Three Research Papers Worth Reading

No live trades this cycle, but three research papers surfaced with direct strategic relevance:

• **Negative-risk arbitrage is harder than it looks.** A new paper draws a line between payoff-space no-arbitrage and protocol-executable no-arbitrage in Polymarket's negative-risk markets. The practical finding: visible arbitrage in linked binary markets representing mutually exclusive outcomes may not be exploitable because of position transformation limitations at the protocol level. Before you build a bot chasing these spreads, read this.
• **Arbitrage conditions in exhaustive/mutually exclusive condition sets.** A complementary paper lays out a formal framework for identifying when pricing in multi-outcome markets diverges from probabilistic coherence. Useful for operators building cross-market arb scanners.
• **LLM-based merger arbitrage forecasting.** An LLM system using long-context reasoning over technical M&A documents outperforms short-context methods on deal outcome prediction. M&A markets on Polymarket are thinly covered — this methodology is directly applicable.

---

What to Watch

• Spain has blocked Polymarket and Kalshi over unlicensed gambling. Watch for regulatory contagion into other EU jurisdictions — this affects liquidity and participant base.
• The HN thread on death threats over the Iran missile market (1,606 points) signals that high-stakes geopolitical markets are drawing mainstream attention and hostile actors simultaneously.
• The "Nothing Ever Happens" No-buyer bot story (471 points) is getting traction. Expect copycats and counter-strategies in non-sports markets over the next two weeks.