460KB Malware Template Confirmed Across Multiple Polymarket Repos

460KB Clone Template Is the Story Today

Two separate repositories — **Polymarket-Trading-Bot** and an unnamed variant — have been confirmed as matching an active malware template. The fingerprint is a 460KB clone structure; if you've pulled any Polymarket-branded repo recently and the package weight hits that mark, treat it as hostile. This is not a theoretical risk. The template is confirmed, the clones are plural, and the attack surface is anyone running automated infrastructure who grabs repos without auditing. Full file-hash checklist in the member portal.

Separately, **Polymarket-Telegram-Bot** is showing coordinated star-farming activity. It hasn't been flagged as malware, but artificial social proof on a bot repo is a yellow flag — star counts on that repo should not be used as a trust signal.

---

New Bots: 5 Worth Your Time, 2 to Watch

**polymarket-edge-model** — ML-calibrated probability estimation. The architecture appears to be training against historical resolution data to identify markets where the crowd is systematically miscalibrated. Worth cloning for the feature pipeline alone; adapt the signal layer to your own model.

**prediction-market-maker** — Avellaneda-Stoikov market making with delta hedging. This is the most sophisticated market-making implementation we've catalogued on Polymarket infrastructure to date. A-S is designed for continuous double auctions; the author has done real work adapting it to binary outcomes. If you're running a book on high-volume markets, this is the priority clone this week.

**polymarket-copy-trader** — Mirror trading of top smart-money wallets. Straightforward on-chain copy logic. Quality depends entirely on which wallets you seed it with; the framework itself is clean.

**postbot** — Monitor only. Event-driven signal trading on social media posting rates. The thesis is that posting velocity is a leading indicator for market movement. Conceptually interesting, noisy in practice. Watch it, don't deploy it yet.

**donmarket** — Monitor only. Market microstructure analysis with a focus on fee detection. Niche application but useful as a diagnostic layer if you're running high-frequency strategies and want to instrument your cost basis more precisely.

---

Alpha Signals: Three Research Papers With Operational Relevance

Three papers crossed the radar today, two of them directly applicable to Polymarket operations.

The most actionable: a study specifically examining **Polymarket's negative-risk markets** distinguishes between theoretical no-arbitrage violations and what is actually exploitable given platform mechanics. The finding is that deterministic payoff identity violations may exist but position transformation constraints prevent extraction. If you've been running arb scans on multi-outcome markets and coming up empty on execution, this explains the gap. Read the protocol-executable section before you spend more compute on that strategy.

Two additional papers propose generative frameworks for implied volatility surface forecasting using conditional diffusion models with arbitrage-aware constraints. Less directly applicable to binary prediction markets today, but the arbitrage-aware autoencoder architecture in the first paper has clear conceptual transfer to any system trying to maintain admissible probability estimates across correlated Polymarket contracts.

---

Strategy Intelligence

The **Nothing Ever Happens** bot — always buy No on non-sports markets — pulled 471 points on HN. The performance data behind that strategy has been discussed before, but the public attention means copycat volume is coming. If you're trading the Yes side on low-prior political or macro markets, expect increased No-side pressure in the near term from unsophisticated deployments of this logic.

Spain's block of Polymarket and Kalshi is a regulatory signal worth tracking for geographic liquidity shifts, not an operational threat to most readers.

---

What to Watch

Audit any Polymarket repo pulled in the last 30 days for the 460KB fingerprint. The prediction-market-maker A-S implementation is the highest-priority legitimate clone this cycle. Watch postbot's posting-rate signal for a second month of data before committing capital. The negative-risk arb paper is worth a full read if you have active multi-outcome scanning infrastructure.