Lead-Lag Arb Bot Surfaces; 5-Min BTC Markets Confirmed Edge-Free

Lead-Lag Arb, a Malware Pair, and the 5-Min BTC Graveyard

Today's sweep of 8 new repositories turned up four worth your time, two confirmed malware clones, and a cluster of alpha signals that collectively close the door on 5-minute crypto markets as a viable bot target. Here's what matters.

---

New Bots: Four Worth Cloning

**lagisalpha** is the headline find. The strategy is lead-lag arbitrage: it prices Polymarket contracts against a vig-free line derived from crypto market data, then exploits the delay in Polymarket's price discovery to enter positions before the market catches up. Position sizing uses Kelly criterion, which means it's not just finding edges — it's sizing them correctly. This is the kind of structurally grounded approach that separates serious operators from noise. Clone it, audit the line construction logic, and stress-test the latency assumptions before going live.

**auspex** takes a different angle: event-driven trigger monitoring. It calculates the distance between a contract's current price and its resolution trigger using live data feeds, assigns confidence scores, and flags high-probability trades. Think of it as a proximity alert system for contracts approaching resolution. Useful for markets where the resolution condition is measurable in real time — regulatory announcements, price thresholds, election call times.

**polymarket-tui** is not a strategy bot — it's a terminal UI for manual trading against the Polymarket CLOB with live data. No automation, but if you're manually managing positions or testing strategies by hand before automating, this is a cleaner interface than the web app for serious operators.

Two others — **PM-Crypto-Trend-Dashboard** and **predicthub-ai** — are on monitor status. The dashboard is trend-following on 5-minute crypto markets (more on why that's a problem below). predicthub-ai aggregates Polymarket and Kalshi odds alongside whale wallet tracking and AI signals, which is an interesting data fusion angle, but the signal quality is unverified.

---

Security: Two Malware Clones, One Spam Campaign

**Critical alert.** Two separate instances of a 460KB cloned malware template repository were found in today's sweep. These are not novel malware — they're clones of a known template, which suggests a low-sophistication actor seeding multiple repos to increase surface area. The 460KB size is a fingerprint; do not clone or run any Polymarket-adjacent repo matching that file size without a full static analysis first. Neither repo has been named publicly yet pending further review.

A third alert covers a garbled-username spam campaign pushing fake Polymarket bot repos. These appear designed to harvest stars or redirect traffic rather than execute malicious code, but treat anything from accounts with randomized usernames as compromised until proven otherwise.

---

Alpha Signals: 5-Min BTC Is a Confirmed Dead End

Three signals today converge on the same conclusion about 5-minute Bitcoin markets on Polymarket.

First: a bot developer publicly documented finding zero exploitable edge after systematic testing of 5-minute BTC contracts. Second: a separate trader reported losses specifically attributed to 2-second price flips occurring immediately before settlement — a pattern consistent with sophisticated actors or latency-advantaged bots front-running resolution. Third: PM-Crypto-Trend-Dashboard, a momentum-based system targeting exactly these markets, is rated monitor rather than clone for this reason.

The takeaway is unambiguous: 5-minute crypto markets on Polymarket are not retail-bot-friendly. If you're running or building automation targeting these contracts, stop and reallocate that development time.

On a separate note, 11 free GitHub repos for Polymarket automation were aggregated and shared publicly today. Worth a pass through the list — at minimum it's a map of what strategies are now commoditized.

---

What to Watch

The HN front page is carrying three Polymarket-adjacent stories simultaneously, including Spain blocking access over licensing and a reporter receiving death threats from bettors. Regulatory surface area is expanding. Watch for copycat jurisdiction actions in the next 30 days. lagisalpha's line construction methodology is the technical thread worth pulling on this week.