Security Alert: Malicious Code Discovered in Polymarket Copy-Trading Bot on GitHub

Open-source crypto tools just got a whole lot riskier. Security researchers have uncovered malicious code lurking in a popular Polymarket copy-trading bot hosted on GitHub, raising alarm bells for traders seeking automated edges.

The Hidden Payload

The bot, marketed as a tool to mirror successful prediction market positions, contained a stealthy backdoor. It wasn't just copying trades—it was potentially siphoning funds or compromising connected wallets. Researchers flagged the repository after detecting anomalous network calls and unauthorized permission requests buried in the script's dependencies.

A Trust Crisis in Open-Source

This incident highlights the double-edged sword of open-source trading automation. While GitHub fosters innovation, it also provides perfect camouflage for bad actors. Developers often blindly fork repositories, assuming community scrutiny has vetted the code. This exploit proves that assumption dangerously naive—like trusting a stranger to manage your hedge fund because they have a nice GitHub avatar.

Polymarket's Shadow

The bot specifically targeted Polymarket, a decentralized prediction market platform. Copy-trading—mirroring the positions of top performers—has surged in popularity as users chase alpha. This malicious version turned the promise of passive gains into an active security threat, exploiting the very trust that makes social trading work.

Protecting Your Stack

Security firms recommend extreme caution with any third-party trading automation. Always audit code yourself or wait for trusted verification—even if it means missing out on the next 'guaranteed' strategy. In crypto, if something looks too good to be true, it's probably running a script to empty your wallet.

The bottom line? The hunt for yield continues to outpace common sense. In a world where everyone's looking for a free lunch, sometimes the meal comes with a side of malware. Stay skeptical, verify everything, and remember: the only 'copy' you should trust is the one you control.

SlowMist sounds Polymarket trading bot warning 

Earlier today, December 21, 23pds, SlowMist’s Chief Information Security Officer, retweeted a warning from a community user about a malicious code in a Polymarket copy-trading bot on GitHub, posing security risks. 

The incident has reminded many that the crypto bot market still has many vulnerabilities, which is why scrutinizing GitHub repositories for hidden threats is now non-negotiable. 

According to the post 23pds interacted with, this code was deliberately put there, but its malicious nature was disguised while the author revised it repeatedly to ensure that it evaded detection. 

This occurred across multiple submissions in the “polymarket-copy-trading-bot” repository, potentially exposing users to fund theft.

The hidden code in the bot’s program made it scan and read configuration files automatically, extract private keys, and transfer them to a remote server controlled by the hackers.  

Users are urged to be cautious with any unaudited code repositories. In 23pds’s post, he alleged this is not the first time the method is being used to target GitHub and its users and that it will not be the last of such incidents. 

How to avoid the private key exploits 

The most crucial thing about this form of exploit is that it depends on the individual to kick-start the process, which means extra caution WOULD do a lot to prevent repeated cases. 

The exploit is a classic supply-chain attack on open-source tools. It requires users to first install the bot, which many do in an effort to copy successful traders on Polymarket. These users input their private keys for signing trades, thereby unknowingly exposing them.

Anyone who finds themselves in such a predicament is advised to immediately delete the repository if it has been downloaded, assume any wallet linked to it has been compromised, and MOVE all funds to a new one as quickly as it can be done. 

It also does not help matters that similar issues have come up in other Polymarket bot repos. So it has become crucial to scrutinize third-party trading scripts to be on the SAFE side. 

It should be noted that the Polymarket platform has not been hacked; the bots that have been wreaking this havoc are unofficial ones, which pose high risks since they require direct access to users’ private keys.

Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.