Malware Template Confirmed, Three Bots Worth Cloning Today
A confirmed malware template is circulating Polymarket bot repositories with an exact 460KB fingerprint — any repo matching that size should be treated as compromised until proven otherwise. Three legitimate bots cleared review today, led by a Random Forest calibration model hunting mispriced probabilities across active markets.
Malware Template in the Wild — 460KB Is Your Kill Switch
Lead with the threat today. Analysts confirmed a cloned malware template spreading through Polymarket bot repositories with a precise 460KB file size signature. This is not a coincidence — exact-size clones indicate a templated payload being repackaged and redistributed. If you are evaluating any new repo and the archive or primary script hits 460KB on the nose, stop, do not execute, and report. This tracks alongside two other active campaigns flagged today: garbled-username accounts pushing bot repos across GitHub and possible star farming on Polymarket-Telegram-Bot inflating its apparent credibility. The star farming signal means trust signals on that repo are unreliable. Do not use download count or star count as a safety proxy this week.
---
New Bots: Three Worth Cloning
**polymarket-edge-model** is the lead find. The strategy is ML-calibrated signal trading using a Random Forest model to compare market-implied probabilities against model-estimated true probabilities, flagging discrepancies as tradeable edges. It paper-trades detected edges rather than live-firing, which makes it safer to evaluate and easier to audit before you commit capital. If you have your own calibration dataset, this architecture is a clean base to extend. Clone it.
**polymarket-copy-trader** does exactly what it says: monitors high-conviction wallets on Polymarket, simulates mirroring their trades with realistic delay and slippage baked in, then measures actual PnL against what you would have made. The delay-and-slippage modeling is the differentiator — most copy-trading frameworks assume instant fills, which overstates returns significantly. This one does not. Worth cloning for the simulation harness alone, even if you swap out the wallet-selection logic.
**polymarketfuturesbot** targets US Futures markets specifically with a scalping approach — rapid entries and exits exploiting short-term price inefficiencies and momentum signals. Scalping on prediction markets is operationally harder than on order-book exchanges given liquidity constraints, but Futures markets on Polymarket have shown tighter spreads than general markets. Worth cloning if you operate in that vertical. Evaluate fill assumptions carefully before going live.
**arbitrage-radar-odds** is flagged as monitor, not clone. It scans for cross-book price discrepancies and optionally pulls proxy odds sources for comparison. The concept is sound but the implementation needs more review before a verdict. Watch it.
**arb-bot** is a skip. Cross-platform arbitrage across Polymarket, Kalshi, and Limitless sounds attractive but execution risk, withdrawal latency, and regulatory exposure across platforms make the live risk profile worse than the paper returns suggest.
---
Alpha: Research Papers With Operational Implications
Three papers surfaced today, two of which are directly relevant to anyone building pricing models.
The first two both address implied volatility surface forecasting using conditional diffusion models with arbitrage-aware autoencoders or refinement steps. The practical implication: if you are generating synthetic probability trajectories for Polymarket calibration, these architectures prevent your model from producing economically inadmissible forecasts — surfaces that imply free money that does not exist. The refinement-stage approach in the second paper is particularly implementable as a post-processing layer on existing models.
The third paper is mandatory reading for anyone running negative-risk strategies on Polymarket. It draws a hard distinction between payoff-space no-arbitrage and protocol-executable no-arbitrage. The key finding: even when a deterministic payoff identity implies an exploitable bound, the arbitrage may be practically blocked if the position transformation required — combining binary markets before settlement — is unavailable. Know which category your negative-risk setup falls into before sizing up.
---
What to Watch
The HN thread on Spain blocking Polymarket and Kalshi over gambling licensing hit over 1,000 points. Regulatory contagion risk is real — monitor for similar moves in other EU jurisdictions over the next 30 days. Separately, the "Nothing Ever Happens" bot buying No on non-sports markets trending on HN with 471 points is worth reading for base rate intuition, not cloning. The Iran missile story death-threat thread is a reminder that high-stakes markets generate real-world pressure on participants. Operational security is not optional.