Polymarket and Kalshi trading bots: how they work, what they cost, and how to avoid bot scams
Bots quote prices, chase arbitrage and copy whales on Polymarket and Kalshi. How a trading bot is built on each API, what fees did to bot strategies in 2026, how copy trading really works, and the malware wave aimed at Polymarket bot users.
A large share of trading on Polymarket and Kalshi is done by bots: programs that place and cancel orders through the platforms' APIs. Some are run by professional market makers, many by individuals. They can be useful tools, but the bot world is also where some of the worst scams in prediction markets live.
What trading bots do
| Bot type | What it does | Main risk |
|---|---|---|
| Market making | Keeps a bid and an ask in the book, earns the spread and rewards | Being run over by news (adverse selection) |
| Arbitrage | Trades price gaps between platforms or between linked outcomes | Fees, slow fills, different rules on each platform |
| Copy trading | Mirrors the trades of chosen wallets | Lag, slippage, copying luck rather than skill |
| News and data | Trades the moment a result or data release appears | A speed race against professionals |
| Short-term crypto | Trades 15-minute and hourly crypto price markets | Polymarket's highest fee rate since 2026 |
How a bot is built
Every bot has the same parts:
- Market data: prices and the order book, streamed over a WebSocket rather than polled.
- A strategy: the rule that decides what to buy or sell, at what price and size.
- Order management: placing, amending and cancelling orders, and tracking what filled.
- Risk limits: a maximum position per market and in total, a loss limit per day, and a kill switch that cancels everything.
- Logging: every decision and fill, so you can tell skill from luck afterwards.
On Polymarket
Polymarket's order book (the CLOB) has official open-source clients for TypeScript and Python. After the exchange upgrade in April 2026 these are the V2 packages, and orders settle in pUSD, Polymarket's dollar token backed one-to-one by USDC. API credentials are derived from your wallet's signature, which is why a Polymarket bot needs access to a private key: that key controls your money.
On Kalshi
Kalshi offers REST and WebSocket APIs (and FIX for institutions). You create an API key in your account and sign requests with its private key; the key can be revoked at any time, and Kalshi runs a demo environment for testing with fake money. Endpoints, limits and code examples for both platforms: Kalshi API and Polymarket API.
What fees did to bots
Until 2026 most Polymarket markets had no trading fees, which made tiny, high-frequency edges profitable. Polymarket's fee rollout started with exactly those markets, short-term crypto, and now charges takers a category rate × price × (1 − price) on most categories, while makers still pay nothing and earn rebates (Polymarket fees vs Kalshi fees). The result: strategies that take liquidity need bigger edges than before, and strategies that provide liquidity became relatively more attractive.
Copy trading: what it really gets you
Every Polymarket trade is public on the blockchain, so you can follow any wallet, and copy-trading tools automate that. Before you copy anyone:
- You always trade after them, at a worse price, often after their order has moved the market.
- Big wallets are not always skilled: some are lucky, some are hedging positions elsewhere, some trade on information they should not have.
- Their sizing is not yours: a whale's 1% position might be your whole bankroll.
Watching big traders is useful for spotting where money is moving (Polymarket whale tracker, Polymarket leaderboard). Copying them blindly rarely is.
Bot scams and malware
In 2026 security researchers found waves of fake "Polymarket trading bots" built to steal money:
- Fake GitHub repositories with polished READMEs and inflated stars, including more than 20 published from a hijacked, verified organisation.
- Typosquatted npm packages that wrapped the real Polymarket client so the bot appeared to work, while sending wallet private keys and
.envfiles to the attackers (reported in May 2026). - A fake "Polymarket arbitrage bot" flagged in July 2026, which stole wallet keys and browser passwords from developers who ran it.
How to protect yourself:
- Never paste a private key into code you did not write or fully read, and never into a website or chat.
- Use a separate wallet with limited funds for any bot; keep your main funds elsewhere.
- Install only the official clients, and check every dependency name letter by letter.
- Ignore "guaranteed profit" bots, paid Telegram bots and anyone offering to run a bot with your keys.
- If you ran something suspicious, treat the computer as compromised: move funds from a clean device first, then rotate every key and password.
Are bots allowed?
Both platforms provide APIs for automated trading and publish rate limits. Manipulative behaviour, such as trading with yourself to fake volume or spoofing orders you never intend to fill, is against their rules (and, on Kalshi, against CFTC rules). Check each platform's terms before you run anything.
Trading bots: frequently asked questions
Do Polymarket bots make money?
Some do, mostly professional market makers with low costs and good risk control. Most retail bots lose to fees, slippage and faster competitors.
Is there an official Kalshi bot?
No. Kalshi provides an API and a demo environment; bots are built by traders and firms.
Is Polymarket copy trading safe?
The idea is legal, but you trade later and at worse prices than the wallet you copy, and many copy-trading tools ask for your private key. Never give it to them.
Are GitHub Polymarket bots safe?
Many are not. Several 2026 campaigns used fake bot repositories to steal private keys.
