Scammers pick Hyperliquid, asterDEX, Polymarket — a retail volume map

What happened

Three GitHub repos hit Trending in the last 24 hours by stuffing their README and description fields with the same phrase repeated twelve to fifteen times. `Novaquant-labs/hyperliquid-trading-bot` (score 391). `SigmaTradeLabs/aster-bot` (386). `Signal-Trade-Core/weather-prediction-bot` (365) — the last one a Polymarket bot wearing a meteorology costume. The SEO hijack is its own story, and we covered it nine hours ago. The more interesting signal is which three venues the scammers picked.

Not Binance. Not Coinbase. Not Uniswap. Not Solana memecoin sniping — the obvious 2024 target. The picks are Hyperliquid (the perpetuals DEX that ate dYdX's lunch), asterDEX (a newer onchain perp venue), and Polymarket (prediction markets, post-election boom). Three venues, three different niches, one common denominator: this is where the *active* retail attention sits in mid-2026.

Scam-org branding follows a recognizable playbook — three-word compound names ending in `-labs`, `-core`, or `-quant`; first-time GitHub orgs with no public history; READMEs that promise "profitable" returns without ever defining strategy, parameters, or backtest data. The repos are bait for a specific audience: a retail trader who knows just enough to clone a Python script and pip-install requirements, but not enough to read the actual code.

Why it matters

Fraud is a market research function. Scammers do not waste compute on dying venues. Where bot-scam README spam concentrates is a real-time heatmap of where speculative retail dollars are actually flowing. When the 2021 cycle peaked, the equivalent repos targeted Binance Smart Chain sniper bots. In 2023 it was OpenSea floor-sweepers. In early 2024, Solana memecoin volume bots. The choice of Hyperliquid + asterDEX + Polymarket in May 2026 is a data point you should file alongside your DefiLlama dashboards.

The Hyperliquid and asterDEX picks confirm what onchain analytics has been showing all quarter: perpetual DEX volume is consolidating onto purpose-built L1s with low-latency execution, not on general-purpose L2s. Hyperliquid's market share is now north of 60% of decentralized perp volume by most counts. asterDEX is the credible challenger. The fact that scammers are targeting *both* (instead of just the leader) suggests they're seeing meaningful retail flow on the challenger too — fraudsters are too lazy to chase venues with no users.

Polymarket is the tell that surprised me. Prediction-market bots are a different animal from perp bots — the edge is in information arbitrage and liquidity provision around resolution events, not directional speculation. A `weather-prediction-bot` repo aimed at Polymarket means there's enough retail speculation on weather event markets to be worth phishing for. That's a non-obvious shift in what prediction markets are being used for. Election season is over. The product-market fit apparently isn't.

Now the payload. None of these repos contain a real strategy — that's not how the scam works. The three common monetization paths, in descending order of sophistication: (1) wallet drainer — the bot prompts the user to paste a private key or seed phrase "to enable trading," then ships it to a server-side endpoint; (2) pump-the-author's-token — the bot "trades" by routing all buys through a single illiquid token the author holds the supply of; (3) Telegram funnel — the public repo is a teaser, real bot is behind a $99/month paywall, no bot exists. The third is the most common and arguably the least harmful, since you only lose the subscription.

What this means for your stack

If you're building developer tooling for the DEX ecosystem, this is your TAM map. Hyperliquid SDKs, asterDEX integrations, and Polymarket resolution-event tooling are the three lanes where there is provably enough non-institutional money to attract organized fraud. Build wrappers, dashboards, position trackers, or actual (legitimate) strategy frameworks for these three venues and you're addressing a market that scammers have already validated.

If you're a developer who occasionally clones random GitHub repos to "see how they work" — stop. The 2026 supply-chain threat model for crypto-adjacent code is not subtle npm dependency confusion. It's a Python script that asks for your seed phrase on line 47 of `config.py`, wrapped in 2000 lines of plausible-looking ccxt boilerplate. The repo will have a clean commit history, a fake license, and zero stars three days ago. Treat any "profitable trading bot" repo as you would treat a USB stick in a parking lot.

For security teams at exchanges and wallet providers: the moment a venue shows up in scam-bait READMEs is the moment you need to ship better in-product warnings about pasted private keys. Hyperliquid and asterDEX should both consider a key-paste detection heuristic in their first-party SDKs — at minimum, a runtime warning when a private key string is detected in an environment variable or logged to stdout. This is cheap, and it materially reduces drainer payoff.

Looking ahead

The next scam-target rotation will tell us what's coming. If we start seeing keyword-stuffed repos for Monad, Berachain, or whichever post-Hyperliquid perp venue emerges, that's the buy signal — not for the token, but for tooling. Scammers are bad people and good market analysts. They've already told you, for free, which three venues to focus on this quarter. The only question is whether you ship something useful for those venues before someone else does.