Malware clone detected; 3 strong bots worth deploying today

Three Solid Bots, One Malware Trap, and a Theoretical Edge You Can't Quite Trade

August 16 is a busy one. The bot pipeline delivered three legitimate cloning candidates and one to watch, but the security picture is uglier than usual — a confirmed malware template is in circulation and two separate star-farming campaigns are muddying the Telegram bot space. Read the security section before you pull anything new.

---

New Bots: What's Worth Your Time

**winning-wallet-finder** is the standout today. The strategy is copy-trading, but it's done properly: z-score analysis filters out wallets that got lucky from wallets with statistically genuine edge. That's a meaningful distinction. Most copy-trading bots chase recent winners; this one tries to distinguish skill from variance. Worth cloning and reviewing the z-score threshold logic before deployment — your edge depends entirely on how conservatively that filter is tuned.

**polymarket-weather-edge** targets a specific, under-exploited niche: weather markets. The approach is statistical arb — comparing live observations and forecast data against the market's implied probability to find mispriced NO shares. Weather resolution is clean and objective, which makes this a low-manipulation niche. If you're not already running weather exposure, this is a low-overhead way to add it.

**polymarket-edge-model** is the most technically ambitious of the three. It trains a Random Forest on historical market data to identify mispricing, then executes on the identified edge. ML-based calibration bots live or die on their training data quality and retraining cadence — audit both before you go live. The architecture is sound; the devil is in the data pipeline.

**TG-Polymarket-bot** is on monitor, not clone. Whale-following with instant notifications and automated execution is a legitimate strategy, but given today's star-farming campaigns specifically targeting Telegram bot repos (see below), treat any TG bot repo with extra scrutiny right now.

---

SECURITY ALERT: Malware and Star-Farming Campaigns Active

Three alerts today, and the first one is critical.

**460KB exact-size repo clone — confirmed malware template.** This signature has been confirmed before and it's back. If you're pulling repos and one comes in at exactly 460KB, do not execute anything from it. The size match is the tell. Verify against the original source repository and diff the code before running locally or on any infrastructure connected to funded wallets.

**Two separate star-farming campaigns targeting duplicated Telegram bot repos.** These are spam/credibility manipulation, not direct malware — but they're running right now and they're specifically inflating star counts on Telegram bot repos. This matters because star count is often used as a quick proxy for legitimacy. In this environment, it isn't. Cross-reference commit history, contributor profiles, and code originality before trusting anything in the TG bot space today.

---

Alpha Signals: Research Worth Reading

Two papers on arbitrage structure are relevant to anyone running multi-market positions.

The first distinguishes between *payoff-space* no-arbitrage (which always holds mathematically) and *protocol-executable* no-arbitrage (which depends on what position transformations Polymarket actually allows). The practical finding: linked binary markets for mutually exclusive outcomes can show apparent violations that are visible but not exploitable until settlement, particularly in negative-risk market structures. Know this before you build arb logic that assumes all visible gaps are tradeable.

The second paper examines how arbitrage arises when condition sets across markets intersect, creating probabilistic inconsistencies. If you're running cross-market exposure on related events, this is the theoretical foundation you should understand.

The third signal — an LLM system for forecasting M&A outcomes using long-context reasoning over technical documents — is more speculative for direct trading but signals that serious quantitative effort is moving into event-specific forecasting. Worth tracking as merger markets grow.

---

What to Watch

The HN front page tells you something useful about Polymarket's environment right now: a story about gamblers threatening a journalist over an Iran missile market hit 1,600 points, Spain has blocked Polymarket and Kalshi over licensing, and a bot that *always buys NO on non-sports markets* got 471 points — suggesting "Nothing Ever Happens" still has real cultural traction as a prior. Regulatory pressure in Europe and the community's volatility around geopolitical markets are both factors if you're sizing positions in those categories.