Polymarket Trading Bots (2026): Who Uses Them, What Works and the Malware to Avoid

A large share of Polymarket's biggest winners are machines, or people running machines. On November 2, 2026 we checked the 100 most profitable Polymarket accounts of the past month. 35 of them sent 60 or more separate orders inside a single hour, a pace of at least one a minute. Those 35 accounts made 41% of the group's profit and 63% of its trading volume.

This guide covers what those bots do, which strategies make money once fees are paid, what copy-trading bots can and cannot do, and the fake "Polymarket bot" downloads that steal wallet keys. If you want to build one, the Polymarket API guide has the endpoints and code.

---

How many top traders are bots?

We pulled Polymarket's public monthly leaderboard (top 100 by profit) and each account's 500 most recent trades in which it sent the order itself (taker trades). Fills from the same transaction were counted once. Then we found each account's busiest hour.

The top 100 together showed $73.2 million of profit for the month. Four of the ten most profitable accounts were in the 60-plus group.

What this does and does not show:

• It is a floor, not a full count. A bot that trades slowly, for example one that places a few orders a day on a schedule, looks human here. So does an account that rests limit orders and lets others fill them.
• Speed is not proof. A person with a fast hand on a busy game night can hit 60 orders in an hour. Sustained runs of 200 to 400 orders an hour, which several accounts showed, are hard to do by hand.
• We name no accounts. Polymarket accounts are pseudonymous, and a fast account can be a trading firm, a hobbyist's script or a person using a trading terminal.

The live board is on our Polymarket leaderboard, and the largest single trades are on the whale tracker.

What Polymarket bots actually do

Most profitable automation falls into five groups.

1. Market making

The bot keeps buy and sell orders on both sides of a market and earns the spread between them. On the international exchange, makers pay no fee and receive rebates funded from taker fees (Polymarket fees). Polymarket US also pays makers a rebate (fee schedule).

The risk is being picked off. When news breaks, the first person to see it buys from your stale order. Good market makers pull orders quickly and size down before scheduled events.

On our leaderboard, market makers show up as accounts with huge volume and profit under 1% of that volume.

2. Fast reaction to live events

In sports and short crypto markets, prices lag the event by seconds. Bots read a faster data feed (a live score API, an exchange price) and trade before the book catches up. This is where the 200-plus orders an hour come from. It needs a fast, paid data source, and the edge shrinks as more bots compete for it.

3. Cross-venue arbitrage

The same question often trades on Polymarket and Kalshi at different prices. A bot buys YES on one and NO on the other when the two together cost less than $1 after fees. Our Kalshi vs Polymarket scanner shows this every 15 minutes. The honest result: most gaps are 1 to 3 points and both venues' fees eat nearly all of it. Gaps also persist because moving money between a dollar exchange and a USDC exchange is slow.

4. Rebalancing related markets

Some events have many outcomes whose prices should add up to $1, such as "who wins the nomination". When they add up to more or less, a bot can trade the difference. The same idea applies to linked markets, such as a state race and the overall Senate control market.

5. Model-driven trading

The bot holds its own forecast (from polls, weather data, sports models) and trades when the market price is far enough from it. This is the slowest group and the one that looks most like a human trader. It is also the only one where a hobbyist's edge can come from knowing a subject well rather than from speed.

Do bots make money after fees?

Only when the edge is bigger than the fee plus the spread. The fee matters most for takers, the side that crosses the spread:

At 50¢, a 1.75¢ fee is 3.5% of the money you put in. A bot that buys at 50¢ needs to be right well over half the time just to break even. That is why most of the fast accounts above are on the maker side or trade where they have a speed edge, not a better opinion.

Fees are from Kalshi's fee schedule, Polymarket US and Polymarket international, checked in October 2026.

Can you run a bot from the US?

Yes, on a US-regulated venue:

• Polymarket US has a retail trading API with API keys, WebSockets and official SDKs. It cancels all open orders and goes offline every Thursday from 6 to 8 a.m. Eastern, so a bot has to handle that window. Details are in our API guide.
• Kalshi has a public trading API for retail accounts, with a demo environment for testing.
• Polymarket international is close-only for the US: existing positions can be closed, new orders are rejected (geoblock docs). Running a bot there through a VPN breaks Polymarket's terms and puts the account and funds at risk.

New to the US app? Start with how to use Polymarket in the US.

Copy-trading bots

A copy bot watches one or more wallets and repeats their trades in your account. Because Polymarket is on a public blockchain, every trade is visible, so this is easy to build and widely sold.

It works worse than it sounds:

• You buy after the leader, at a worse price. In a thin market, the leader's own buy moves the price before your copy fills.
• The fastest traders cannot be copied. By our count above, many of the top accounts trade dozens of times a minute. A copy bot reacting seconds later is trading against them, not with them.
• You see the trade, not the reason. A big buy can be a hedge for a position on another venue.
• Leaders change. A top trader this month is often not one next month. Our leaderboard shows this between the "Month" and "All time" tabs.
• Subscriptions add up. A paid copy tool has to earn back its fee before any profit is yours. That includes KalshiSpy, the paid Kalshi analytics tool we link to at the top of this page and earn a commission from.

If you want to study top traders, reading their positions and history on the leaderboard teaches more than copying them blind.

Fake Polymarket bots that steal wallet keys

Searching GitHub or npm for "Polymarket bot" turns up a lot of malware. The pattern repeats: a polished README, hundreds of stars, instructions to put your wallet's private key in a .env file and run npm install. The install step sends the key to the attacker.

Documented cases in 2026:

• March 2026, hijacked GitHub organization. StepSecurity found that a legitimate Japanese DeFi project's GitHub organization, dev-protocol, had been taken over and filled with Polymarket bot repositories from around February 26. The flagship copy-trading bot really connected to Polymarket, but two typosquatted npm dependencies stole the .env file and opened an SSH backdoor on the user's machine (StepSecurity).
• May 2026, fake trading CLI. SafeDep found nine npm packages published within two minutes by an account called "polymarketdev". They asked users to paste a private key, claiming it "stays encrypted", and also read PRIVATE_KEY from any .env file, then sent the raw key to the attacker (SafeDep).

How to protect yourself:

1. Never give a private key to a tool you did not write or fully read. Stars, forks and a verified organization badge can all be faked or hijacked.
2. Use a separate wallet with a small balance for any bot. If it leaks, you lose that wallet, not your savings.
3. Prefer API keys over wallet keys. Polymarket US and Kalshi issue API keys from your account settings, and you can delete a key the moment you suspect a leak. A leaked wallet key cannot be revoked; the only fix is to empty the wallet before the attacker does.
4. Read the dependency list before npm install. A one-letter misspelling of a well-known package is the usual trick.
5. If you ran one, act now. Move funds to a new wallet from a clean device, then check ~/.ssh/authorized_keys for keys you did not add.

Ads and posts promising a bot that "returned 1,000% in minutes" are selling something. Profitable automation on Polymarket is mostly unglamorous market making, done by firms with fast infrastructure.

Should you use a bot?

• If you are a developer who wants to learn: build a small bot on the Polymarket US API or Kalshi's demo environment, trade tiny, and expect to lose a little while you learn.
• If you want a bot to make money for you: be skeptical. Anyone with a reliably profitable bot earns more running it than selling it.
• If you want to trade on your own views: you do not need a bot. Fees and spreads matter more than speed for most event markets. Our Kalshi vs Polymarket comparison covers where each is cheaper.

Method

Data: Polymarket's public data API, pulled November 2, 2026, about 11:00 UTC. We used the monthly leaderboard ranked by profit (/v1/leaderboard?timePeriod=MONTH&orderBy=PNL, top 100) and each account's latest 500 taker trades (/trades?user=…&takerOnly=true). Several fills in one blockchain transaction were counted as one order. "Busiest hour" is the largest number of separate orders in any rolling 60-minute window within those 500 trades. Profit and volume are Polymarket's monthly figures, which mark open positions at current prices. Numbers will differ when you re-run it; the shares above are a snapshot, not a constant.

Frequently asked questions

Are bots allowed on Polymarket?

Yes. Both Polymarket US and the international exchange publish trading APIs for automated trading. Bots must follow the same rules as everyone else, including the bans on trading with confidential information.

How many Polymarket traders use bots?

There is no official figure. In our November 2, 2026 check, 35 of the 100 most profitable accounts of the month traded at one order a minute or faster in their busiest hour, and they made 41% of that group's profit.

Is there a free Polymarket bot?

There are open-source examples, and many fake ones. Treat any bot that asks for your private key as dangerous until you have read the code and its dependencies yourself.

Do Polymarket copy-trading bots work?

They copy trades, but late and at worse prices. They cannot follow the fastest accounts, and past leaders often stop leading.

Can I run a Polymarket bot from the US?

Yes, on Polymarket US through its retail API, or on Kalshi. The international Polymarket exchange does not accept new orders from US users.