Malware campaign targets bot builders; Spain blocks Polymarket

Malware Campaign Active — Do Not Clone Sports Arbitrage Repos

The most urgent story today is operational security. Three of six security alerts this cycle relate to a single coordinated attack surface: a **confirmed 460KB cloned malware template** dressed up as a sports arbitrage bot, now appearing in at least two distinct variants. One variant pairs the payload with a garbled username to defeat basic reputation checks; the other circulates under a cleaner account but carries the same binary fingerprint. A broader **Polymarket trading-bot spam campaign** using garbled usernames is the delivery mechanism — low-quality repos are being pushed across forums and aggregators at volume.

**If you cloned anything sports-arbitrage-related from an unknown account in the last two weeks, audit your environment now.** The 460KB size is a reliable signature — legitimate arbitrage bots in this space are rarely that bloated. Check for exfiltration hooks targeting clipboard data and environment variables. No new wallets were flagged today, but that may lag the infection timeline.

No bots were found worth cloning this cycle. Zero. The noise-to-signal ratio on public repos is at a cycle high.

---

Regulatory: Spain Blocks Polymarket and Kalshi

Hacker News is lit up with 1,083 points on Spain's decision to block both Polymarket and Kalshi for operating without a gambling licence. This is the first major EU-jurisdiction block of a prediction market platform at the ISP level. Operators running Spanish residential proxies or VPN endpoints in Spain should expect connectivity issues immediately. More importantly, watch whether this triggers copycat regulatory action in Portugal, Italy, or Germany — the legal theory Spain is using (prediction markets as gambling products) is portable across jurisdictions with similar frameworks.

The separate HN thread — *Polymarket gamblers threaten to kill me over Iran missile story* at 1,606 points — is a reputational event, not a trading event, but it is accelerating mainstream media framing of Polymarket users as unstable. Expect tighter KYC pressure in the next regulatory cycle.

---

Alpha Signals: Two Papers You Should Read This Weekend

Two research papers surfaced this cycle with direct trading implications.

**Paper 1 — Protocol-Executable vs. Payoff-Space Arbitrage:** This work makes a distinction that matters practically: just because a deterministic payoff violation exists in Polymarket's negative-risk markets doesn't mean you can exploit it before settlement. Protocol constraints — position limits, available order book depth, settlement timing — create a gap between theoretical and executable arbitrage. The takeaway for bot builders: your arbitrage scanner is probably flagging opportunities that are real in the payoff sense but unreachable in practice. Calibrate your execution model to account for protocol friction before sizing positions.

**Paper 2 — Condition-Set Arbitrage:** This is the more immediately actionable paper. It systematically maps Polymarket's market graph for violations of exhaustiveness and mutual exclusivity — the two structural requirements for proper resolution. The paper provides empirical evidence of exploitable mispricings where linked markets imply probabilities that don't sum correctly. This is classical Dutch book territory, and the paper claims the violations are systematic, not random. If you're not already running a consistency-check layer across linked market clusters, this is the research that justifies building one.

**Paper 3 — Diffusion-Based Vol Surface Forecasting:** Less directly applicable to Polymarket specifically, but operators who also trade options or use vol surfaces for correlated-asset signals should note the arbitrage-aware autoencoder approach. The conditional latent diffusion framework for 30-step trajectory generation is novel enough to warrant a read.

---

Strategy Intelligence

Six new strategies entered the tracking pool this cycle, zero wallets. The *Nothing Ever Happens* bot — which always buys No on non-sports markets — is getting renewed attention at 471 HN points. The core insight (that most dramatic-sounding geopolitical markets resolve No) is not new, but the HN visibility means expect copycats and mean-reversion in No-side liquidity on low-activity markets.

---

What to Watch

• Spain block enforcement mechanics and whether geo-restrictions cascade to other EU states
• Second-stage malware variants beyond the 460KB template — the campaign is active
• Condition-set arbitrage opportunities in any market cluster that resolved or restructured this week
• HN-driven retail inflow following the Iran missile story coverage — sentiment markets may see unusual volume