Malware Spread via Fake Polymarket Trading Bot Targets DeFi Developers

On July 1, 2026, security firm SlowMist identified a fake trading bot on GitHub designed to spread malware targeting Polymarket users and DeFi developers. The bot, named 'polymarket-arbitrage-bot', was promoted as a lucrative investment tool, claiming potential earnings of over $80,000 annually. It contained 30 malicious npm packages that were downloaded by at least 53 developers before being flagged. The malware, hidden within a dependency called 'clob-client-math', steals sensitive data such as wallet keys and browser passwords. The attack is believed to be part of a larger campaign by North Korean hackers known as 'Contagious Trader'. Users who installed the bot are advised to treat their systems as compromised and take immediate security measures. This incident follows a series of attacks on Polymarket users, including a recent phishing scam that drained $2.94 million from multiple accounts.

Key Points: • A fake trading bot for Polymarket was used to distribute malware targeting developers. • At least 53 developers downloaded the malicious bot before it was flagged. • The attack is linked to North Korean hackers and is part of a broader campaign.