Copy-Trading Infrastructure Matures; Spain Blocks Polymarket

Copy-Trading Goes Quantitative, Arbitrage Gets Cross-Venue

Today's most operationally significant finding is the simultaneous emergence of two mature copy-trading frameworks — not the toy variety, but implementations that actually measure the thing that kills copy-trading alpha: delay and slippage. If you've been copying wallets manually or with naive mirroring, today's bot roundup is a forcing function to upgrade.

New Bots: What's Worth Your Time

**winning-wallet-finder** filters wallets by statistical significance of performance using z-scores before you ever copy a single trade. This is the right prior — most outperforming wallets on Polymarket are noise, not signal, and raw PnL leaderboards are a trap. It also pings on new trades in real time, which matters when delay is your primary cost. Worth cloning.

**polymarket-copy-trader** is the more surgical instrument: it empirically measures delay, slippage, and PnL degradation against the wallets it mirrors. If your copy-trading edge is decaying and you don't know why, this gives you the diagnostic tooling. Worth cloning and running against your current setup before you run it as a live strategy.

**auspex** takes a different angle entirely — distance-to-trigger analysis against live resolution sources with confidence scoring. This is closer to fundamental forecasting than copy-trading: it watches how far a market is from its resolution condition and prices that gap. The no-fee frontend is a minor operational bonus. Worth cloning.

**dino-markets-mcp** is the cross-venue play: it detects arbitrage by matching equivalent markets across Kalshi and Polymarket. Cross-venue arb has been theoretically available for years and structurally underexploited. If you have accounts on both venues, this is the infrastructure that makes it executable. Worth cloning.

**polymarketfuturesbot** (US Futures scalping with automated order placement) is on monitor, not clone. Scalping in prediction markets has razor-thin viability windows and this one needs more observation before committing infrastructure to it.

Security: Three Red Flags Today

This is a critical section. Do not skip it.

Two malware indicators surfaced in today's scan. First: a **460KB exact-size repository** appeared in Polymarket-tagged GitHub results. Exact-size repos in scraping datasets are a known malware distribution fingerprint — the size uniformity indicates automated packaging, not organic development. Do not clone, do not run. Second: a **garbled-username account with a repository created today** is flagged as a likely malware dispenser. New account, synthetic username, Polymarket keywords — this is a honeypot pattern. Treat any repo from accounts created within the last 72 hours with fresh skepticism.

Additionally, **possible star farming** was detected on one repo showing high star-to-fork ratio with keyword stuffing. This doesn't mean malware, but it means the social proof is manufactured. Evaluate the code, not the stars.

Rule of thumb going forward: run unknown repos in a sandboxed environment with no wallet credentials present. Always.

Alpha Signals: Research Worth Reading

Three papers landed that have direct operational implications:

The **merger arbitrage LLM paper** is relevant for anyone trading M&A-adjacent markets. Long-context reasoning over regulatory filings to predict deal success is exactly the kind of edge that hasn't been commoditized yet. The finetuning approach suggests it's not zero-shot — you need domain data to replicate it.

The **agentic market clustering paper** addresses a real structural problem: Polymarket has fragmented, overlapping, and sometimes contradictory markets on the same underlying event. A system that automatically finds implicit equivalences and contradictions is a mispricing detector by another name.

The **financial epiplexity paper** is the most theoretically significant. It formalizes the gap between detectable market structure and *profitably learnable* market structure under computational constraints. If you're building ML-based strategies, this framework helps you avoid overfitting to patterns you can detect but cannot exploit fast enough to matter.

What to Watch

Spain's blocking of both Polymarket and Kalshi is not an isolated event — it's the second major jurisdictional action this quarter. Operators with European user exposure should be monitoring this actively. The HN thread on Polymarket gamblers threatening a journalist over the Iran missile story is a reputational surface area problem for the platform that may accelerate regulatory scrutiny elsewhere. Watch for copycat blocking actions in the next 30 days.