Security Researchers Warn of Malicious Code in Polymarket Copy Trading Bot on GitHub (December 2025)

• What Happened with the Polymarket Copy Trading Bot?
• How Did SlowMist and the Community Respond?
• How Can Users Protect Their Private Keys?
• Why Is This a Wake-Up Call for Crypto Traders?
• What’s Next for GitHub and Crypto Security?
• FAQs About the Polymarket Bot Exploit

A popular open-source Polymarket copy trading bot hosted on GitHub has been flagged by cybersecurity experts for containing hidden malicious code designed to steal private keys. The bot, created by a developer using the pseudonym "Trust412," poses significant risks to users who unknowingly expose their crypto wallets. Here’s what you need to know to protect your assets.

What Happened with the Polymarket Copy Trading Bot?

Security researchers and firms, including SlowMist, have raised alarms about a Polymarket copy trading bot circulating on GitHub. The bot, developed under the alias "Trust412," was found to contain deliberately inserted malicious code across multiple commits and dependencies. This code remained undetected due to repeated revisions by the author, making it a sophisticated supply-chain attack.

The malicious script scans users' configuration files, extracts private keys, and sends them to a remote server controlled by hackers. This exploit is particularly dangerous because it requires users to initiate the process by installing the bot—often done to mimic successful traders on Polymarket. Once installed, the bot gains access to sensitive wallet information, putting funds at risk.

How Did SlowMist and the Community Respond?

On December 21, 2025, SlowMist’s Information Security Director retweeted a community alert about the malicious bot. The warning highlighted that this wasn’t the first time GitHub repositories had been exploited this way—and likely wouldn’t be the last. The incident underscores the broader vulnerabilities in the crypto trading bot ecosystem, where unvetted third-party scripts can lead to significant financial losses.

According to the BTCC research team, the bot’s code was cleverly disguised, evading detection during casual reviews. Users who downloaded the repository are advised to assume their linked wallets are compromised and transfer funds immediately to a new, secure wallet.

How Can Users Protect Their Private Keys?

The exploit relies on users voluntarily installing the bot, making caution the first line of defense. Here are key steps to avoid falling victim:

• Avoid Unaudited Repositories: Only use bots and scripts from verified, well-reviewed sources.
• Monitor Wallet Activity: If you’ve used the bot, check for unauthorized transactions and move funds ASAP.
• Never Share Private Keys: Legitimate trading bots don’t require direct access to private keys—use API keys with limited permissions instead.

Polymarket clarified that the platform itself wasn’t hacked; the malicious bots are unofficial tools created by third parties. However, the incident highlights the risks of using unvetted trading automation tools in the crypto space.

Why Is This a Wake-Up Call for Crypto Traders?

This incident is a classic example of a supply-chain attack, where malicious actors infiltrate open-source tools to exploit unsuspecting users. The crypto community has seen similar schemes before, but the sophistication of this attack—combined with the growing popularity of copy trading—makes it particularly concerning.

As the BTCC team notes, "The allure of quick profits often blinds traders to security risks. Always audit code or rely on trusted platforms to minimize exposure."

What’s Next for GitHub and Crypto Security?

GitHub has become a hotspot for such exploits due to its open nature. While the platform offers transparency, it also requires users to be vigilant. Developers and traders alike must prioritize security audits and community vetting before using any open-source tool.

For now, the Polymarket bot serves as a stark reminder: in crypto, convenience shouldn’t come at the cost of security.

FAQs About the Polymarket Bot Exploit

What is the Polymarket copy trading bot?

It’s an unofficial, open-source bot designed to automate copy trading on Polymarket, a prediction market platform. The malicious version steals private keys from users who install it.

How was the malicious code hidden?

The developer "Trust412" embedded the code across multiple commits and dependencies, making it hard to detect without thorough auditing.

Is Polymarket itself unsafe?

No, Polymarket wasn’t breached. The risk comes from third-party bots requiring excessive permissions.

What should affected users do?

Delete the bot, assume wallet compromise, and transfer funds to a new wallet immediately.