NegRisk Arbitrage Theory Meets Practice: 4 Bots Worth Cloning

NegRisk Arbitrage Gets Academic Cover — And Two Bots Are Already Trading It

Today's most significant convergence: academic research dropped formalizing the distinction between payoff-space no-arbitrage and protocol-executable no-arbitrage in Polymarket's NegRisk markets, and two independent repos surfaced this week hunting the same structural gaps. The theory now has the practice. Whether the practice is profitable is another question.

---

New Bots: 4 Worth Cloning

**DRADIS** is the most architecturally ambitious repo in today's scan. It runs a centralized control tower coordinating four distinct strategy modules — momentum, market-making, arbitrage, and ML models — with an LLM optimization layer on top. This is rare: most public bots run a single strategy with no meta-layer. The LLM component appears to handle parameter tuning between sessions rather than live execution, which is the right call. Worth cloning for the architecture alone; expect to rip out and replace the ML models with your own.

**masterputra169/polymarket-btc-15-minutes** is narrowly scoped and well-executed. XGBoost + LightGBM ensemble targeting BTC 15-minute binary markets, with explicit retraining loops and performance monitoring built in. The 15-minute window is crowded and mean-reverting; edge here is thin and will decay fast. Clone it for the retraining pipeline — that's the transferable piece.

**matthewnyc2/arbitrage** is directly relevant to today's alpha signal on NegRisk structure. The repo scans multi-outcome markets for mispricings and includes a paper-trading mode, which is the correct way to validate before going live. If you've been watching NegRisk markets for manually identifiable gaps, this automates the scan layer. Vet the execution logic carefully before attaching real capital.

**tduic/prediction-market** takes a different arbitrage angle: cross-platform, Polymarket vs. Kalshi, same underlying event. Kelly criterion position sizing is embedded, and risk controls are present. Cross-platform arb has real latency and liquidity constraints that eat theoretical edge fast — but the Kelly implementation and risk scaffolding make this worth studying regardless of whether the core strategy pencils out for you.

**DarkLordGeo/polymarket-weather-bot** is flagged as monitor-only. Weather market trading is a legitimate niche but the repo lacks strategic specificity. Watch for updates before committing time to it.

---

Security: Two Malware Templates, One Spam Campaign

Critical. Two separate 460KB cloned malware templates were flagged today — one with a garbled username variant, suggesting the same actor running parallel distribution. This is an active campaign, not a one-off. The 460KB signature has been seen before; these repos mimic legitimate trading bot structure and typically exfiltrate wallet keys or API credentials on first run. Do not clone, do not run, do not inspect in an environment connected to live credentials. A third repo — garbled username, inflated stars — is a spam/credibility-washing operation, likely part of the same distribution network. Seven total security alerts today; treat the malware flags as high priority.

---

Alpha Signals: Research Worth Reading

Three papers in today's signal stack. The NegRisk arbitrage paper is the lead — it explains structurally why linked binary markets for mutually exclusive outcomes can show apparent arbitrage that isn't executable before settlement. If you're running or building a NegRisk scanner, read this before you size up. The second paper covers arbitrage across multi-condition markets with overlapping condition sets — directly applicable to complex Polymarket market structures. The third is the outlier: an LLM system for merger arbitrage using long-context reasoning over merger documents. Less immediately applicable to Polymarket operations, but the context engineering methodology is worth reviewing if you're building any LLM forecasting layer.

---

What to Watch

Spain's block of Polymarket and Kalshi over licensing is the regulatory story of the week — 1,083 HN points, and it's not slowing down. If you're running bots with European infrastructure or VPN exit nodes in Spain, review your exposure. The Iran missile story and associated trader threats crossed 1,600 points on HN; reputational and operational security risk for public-facing Polymarket operators is real and rising. The "Nothing Ever Happens" No-buyer bot at 471 points is a useful baseline reminder: simple systematic strategies with strong priors still outperform overengineered ML in low-signal markets.