Cross-Platform Arb Bots Surface as Malware Campaign Targets Builders
Two confirmed malware repos using an exact 460KB cloning template were detected today, targeting Polymarket bot developers — clone nothing without checking file sizes first. On the legitimate side, five bots worth your attention dropped, headlined by two cross-platform arbitrage tools spanning Polymarket and Kalshi.
Cross-Platform Arb Goes Open Source — While Malware Hunters Go Fishing
September 6 is a heavy day. Two malware repos, a spam campaign, five cloneable bots, and a research signal that could quietly invalidate your entire arb strategy. Let's get into it.
---
New Bots: What's Worth Your Time
**Six repos cleared today, five highlighted.**
`poly-kalshi-arb` and `prediction-markets-arb` are the lead story. Both target the Polymarket/Kalshi overlap on intraday BTC markets — the former is a dedicated two-venue automated arb bot, the latter does combinatorial arbitrage detection across Polymarket, Kalshi, and additional venues. If you're not already monitoring cross-platform spread on BTC resolution markets, you're behind. These repos give you a starting point; neither should be deployed without auditing the credential handling and position-sizing logic independently.
`polymarket-trading-bot-ai-model-btc-5m-15m-1h-stacked-ensemble-xgboost-lightgbm` is exactly what it says. Stacked ensemble of XGBoost and LightGBM across three timeframes for BTC directional prediction, feeding into Polymarket trade execution. The multi-horizon stacking approach is the interesting part — 5m signal for entry timing, 1h signal for directional conviction. Worth studying the feature engineering even if you don't run it live.
`polymarket-paper-lab` is a simulation framework comparing multiple bot strategies in paper-trading mode. Useful infrastructure for anyone building or backtesting — clone this before you clone anything that touches real capital.
`polymarket-weather-bot` trades Polymarket temperature markets using live weather data feeds. Niche, but if you've ever looked at those markets and wondered whether anyone was actually doing this systematically, now you know.
---
⚠️ Security: Active Malware Campaign — Read This
**Two confirmed malicious repos detected today, both using an identical 460KB file-size fingerprint.** This is a cloning template attack: bad actors take a legitimate-looking Polymarket bot repo, stuff malware into it, and publish it with a near-identical name or slightly garbled username. The exact 460KB size is the tell — it's the same payload, copied twice across different accounts.
A separate garbled-username spam campaign is also running concurrently, pushing fake Polymarket trading bot repos from accounts with randomized or corrupted usernames.
**Operational rule until further notice:** Before cloning any Polymarket-related repo, check the total repository size. Anything sitting at exactly 460KB that you didn't find through a trusted referral is suspect. Cross-reference the account age, star history, and commit cadence. These repos are designed to look active. They aren't.
---
Alpha Signals: The Arb That Isn't
Two research papers today deserve serious attention from anyone running arb strategies.
The first distinguishes between *payoff-space* no-arbitrage and *protocol-executable* no-arbitrage in prediction markets. The practical implication: Polymarket's negative-risk market structure means that apparent price violations in linked binary markets for mutually exclusive outcomes may be **unexploitable** given platform-level position transformation constraints. If your arb scanner is flagging these, verify that the trade is actually executable before sizing in.
The second paper targets markets where outcome sets aren't properly exhaustive or mutually exclusive — a structural inefficiency that creates real pricing discrepancies for traders who map the resolution rules carefully. This is slower alpha, but it's durable. Worth reviewing your active market inventory against this framework.
The third paper — a conditional latent diffusion model for joint IV surface and returns trajectories — is more infrastructure than immediately actionable, but relevant if you're building volatility-aware sizing models for crypto markets.
---
What to Watch
- Spain has blocked both Polymarket and Kalshi over licensing. Regulatory contagion risk to other EU jurisdictions is real — watch for similar actions in the next 30 days.
- The HN thread on death threats over the Iran missile market is a signal on how toxic resolution disputes are getting. Controversial geopolitical markets carry tail risk beyond P&L.
- The "Nothing Ever Happens" No-bias bot hitting 471 points on HN means this strategy is now fully public. Edge compression incoming on non-sports markets if it wasn't already priced.
Stay off unverified repos until the 460KB campaign is confirmed cleared.