DeFi devs, Polymarket trading bot users targeted in fresh info

Hackers created a fake trading bot for Polymarket’s prediction markets on GitHub. The bot was used to spread malware that steals credentials like wallet keys and browser passwords.

30 malicious packages were found across several npm accounts, reportedly targeting developers and traders who use automated strategies. At least 53 developers fell for the trap before it was flagged.

On July 1, 2026, the security firm SlowMist flagged a fake trading bot that promised big profits on Polymarket but was actually just a delivery vehicle for malware. SafeDep found 30 malicious npm packages spread across multiple accounts and tied to one fake GitHub repository.

The criminals posted a “polymarket-arbitrage-bot” that claimed to make over $80,000 per year. It got 36 stars and 53 forks before the scam was exposed. Every developer who downloaded and installed it ran the malware.

The attackers were aware of the fact that real trading bots have made huge money on Polymarket .

One bot profiled by prediction-markets analyst Dexter’s Lab turned $313 into $414,000 in just one month, while another, analyzed by researcher Igor Mikerin, made $2.2 million over two months. This track record made the fake bot look believable to traders chasing easy profits.

The instructions for this fake trading bot included having users put their Polymarket private key into a .env file before running “npm install.” During installation, the malware, which is hidden inside a dependency called “clob-client-math”, would run.

The malware steals a lot of sensitive data, including:

Security researchers believe North Korean hackers are behind this attack. The group is running a larger campaign called “Contagious Trader” that targets crypto developers.

Cryptopolitan reported in March that hackers took over an Axios developer’s account and published malicious npm packages. In May, one compromised account was used to take over 323 packages in under 30 minutes.

Polymarket users have also faced other attacks this year, like when, in late June, a phishing scam drained $2.94 million from at least 11 accounts.

SafeDep says any computer that ran “npm install” on the fake bot should be treated as hacked. Such individuals are advised to rotate all crypto wallet keys right away, change every password stored in their browser, and replace all AWS credentials, SSH keys, and API tokens.

Traders are also advised to check their npm lock files for the 30 malicious packages by looking for dependencies that appear in package.json but never get used in the code. The repository’s “package.json” in this attack listed four dependencies, but only three (the official Polymarket SDK, ethers, and dotenv) were legitimate. The fourth, clob-client-math, which hid the malware, was never imported anywhere in the bot’s source code.

The best defense is checking if packages come from new accounts with no publishing history, as all the fake packages were published by brand-new accounts.

It is a GitHub repository (Trum3it/polymarket-arbitrage-bot) that posed as a TypeScript trading bot for Polymarket's prediction markets but included a malicious npm dependency called `clob-client-math` that installed an infostealer when developers ran `npm install`, according to SafeDep's investigation.

The malware targets crypto wallet vaults from eight major wallets including MetaMask and Phantom, browser cookies and passwords, SSH keys, AWS credentials, npm and PyPI tokens, Docker configs, shell history, and password manager databases from Bitwarden, KeePass, and 1Password.

Developers who cloned the repository should inspect their npm lock files for any of the 30 packages identified in the campaign, rotate all credentials and private keys that were stored on the affected machine, and audit their `package.json` for dependencies that are declared but never imported in source code.

Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.

Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.