I have spent most of this year arguing that this moment would arrive.

In January I wrote in War on the Rocks that markets tied to military outcomes structurally reward insider trading and hand participants a financial interest in how wars unfold.

In February, Max Meizlish and I argued in the Wall Street Journal that gambling markets had become an intelligence asset that adversaries would read whether or not Washington chose to, and in May I described in the Journal how cheating on these platforms was evolving from simple foreknowledge toward the manipulation of outcomes themselves.

Each of those claims drew polite doubt from people who still regarded prediction markets as a novelty, and the Pentagon has now written the premise into official policy.

The prohibition was overdue by any measure. In April the Justice Department charged an Army Special Operations master sergeant with earning roughly $410,000 by betting on the capture of Nicolás Maduro before the raid became public, and over the summer researchers identified more than 150 wallets that appear to have traded on military insider knowledge while Polymarket referred dozens of cases to prosecutors. The department could hardly go on pretending the problem was hypothetical.

Yet the memo’s lasting significance lies in a single sentence of justification from Mr Hegseth:

“Our enemies watch movements in these markets,”

With that line the Secretary of Defense conceded what the department’s personnel policies had never addressed, which is that prediction markets have become a collection target and the United States sits on the wrong side of the trade.

Consider what a hostile intelligence service sees.

A contract on an American strike or a leadership decapitation idles at a low probability for weeks, and then, in the hours before an operation, the price lurches upward on heavy volume. The market has aggregated the knowledge of whoever placed those bets, stamped it with a time and published it to the world, so that no recruited asset, intercept or satellite pass is required because the leak arrives already priced and sorted.

The memo also reaches a subtler danger, which Mr. Hegseth frames in operational terms. A logistician with money riding on a strike date, he observes, acquires an interest in that date, and an analyst holding a position on an outcome acquires an interest in that outcome, a condition he describes as a dilution of the warrior ethos.

I have been calling it the agency problem, because a wager converts a spectator into a participant with a reason to influence the result and allows the people who serve a principal to profit by betting against him. In a trading firm that is a compliance matter, while in a combatant command it is a matter of lives.

Here’s what the memo leaves unsaid. If adversaries are harvesting intelligence from these markets, then the United States can do the same.

Open-source intelligence formalized the systematic reading of public information, social media intelligence did the same for platforms, and a parallel discipline is now taking shape around markets where people stake money on outcomes, a field practitioners have started calling betting intelligence, or BETINT.

Its questions are the familiar ones of any collection discipline: who is moving a given market and when, whether the timing of a position implies foreknowledge of an event, and which contracts adversaries have adopted as reference points. None of it requires classified access, only tradecraft applied to a data source that did not exist at scale three years ago.

The need will only grow. Prediction markets are on course to become a multitrillion-dollar asset class, and contracts touching military, diplomatic and public-safety outcomes will multiply along with them. Forbidding soldiers from participating removes one category of bettor without shrinking the signal that remains or blinding the foreign services already reading it.

Mr. Hegseth has told his department that the enemy watches these markets. The harder question, which his memo raises without answering, is who in the American intelligence community is watching back.

BETINT stands ready to assist that mission.

Disclosure: AI tools assisted with drafting and editing this piece; the analysis, arguments and conclusions are my own.

TripWire is a live newswire for reporters, newsrooms, and analysts seeking real time signals from prediction markets and betting markets. This product is the embodiment of our BETINT thesis: that betting markets and activity create a new information space that serves as an intelligence signal of intent, insider knowledge, and pending real-world action.

This product came together through months of collaborative investigations and pilot programs with major organizations across the media landscape.

What TripWire Delivers

TripWire produces live story cards and push alerts in the following formats:

• Moved Before the News: a market moved before the news broke with high conviction and a lack of credible public information as to why. These are our insider candidates.

• Market Reactions: Markets instantly react to new information. Sharp traders nearly always take action before media and social media see it.

• Price moves: sharp moves on Kalshi and Polymarket in real time.

• Large trades: big single bets as they hit the order book.

• Position builds: one-sided money piling into a market over a short period ($100K+ on one side).

• Crowd moves: many separate bettors piling onto the same side at once.

• New markets: fresh listings that draw real money in their first day. Controversial markets (charges, trials, conflicts, arrests, pardons, impeachments, scandals) are emphasized.

• BETINT.ai Investigations: our internal reporting conducting deep dives on the market dynamics and discoveries of our own AMS (automated market surveillance) technology.

Why Should Your Organization Care about TripWire?

The underlying technology behind TripWire is the same technology that is responsible for BETINT’s reporting that has been cited in and collaborated with The Wall Street Journal, NBC News, The New York Times, and many more top quality media organizations in the US and abroad. Everything we have reported came out of this technology.

A few examples:

• NBC News and BETINT reported on a $331,226 bet on Putin leaving power via assassination, coup, death, or election. More than 50 outlets in 20-plus countries picked it up within six days.

• The Wall Street Journal used our trade data to report the White House press secretary trades.

• USA Today worked with us on US-Cuba conflict markets that moved before the story broke.

The need for this technology is clear. Automated market surveillance across hundreds of thousands of markets is not feasible for a reporter or even an entire newsroom to manage, digest, synthesize and act on.

The need for cutting edge systems smart enough to determine the signal from the noise has always played a role in modern information operations. BETINT.ai’s technology delivers this experience for the fastest growing new asset class across finance and DeFi.

TripWire serves more than just media clientele - organizations seeking the ability to see markets move before the headlines can reach out to discuss access.

Why Is It Called TripWire?

A tripwire goes off when something crosses it.

BETINT’s TripWire goes off when money moves before the story does.

BETINT technology focuses on three core questions:

1. What is happening in real time in betting and prediction markets?

2. What JUST happened in betting and prediction markets?

3. How do betting markets on everything create capital-backed incentive structures to influence, disinform, and manipulate public narratives?

TripWire is the product that delivers answers to questions 1 & 2 to our qualified partners and customers.

BETINT identifies the baseline on every market and identifies anomalous trading, market manipulation, coordinated positioning and real time price action.

We ask you - if a market that affects your organization’s stakeholders moves, who on your team is watching?

For almost every organization on Earth, the answer is nobody.

Until now.

Does BETINT Offer Additional Products?

Yes, BETINT offers a 2nd product currently in private beta with security, compliance, and intelligence organizations. You can read more about our intelligence product at bettingintelligence.ai/product, which addresses all three of BETINT’s core questions in a fully custom agentic interface.

Request a demo →

Questions or tips, find us on X at @betint.ai and @dan_zmann.

The account, which trades under the username andrewohio53, has been accused of profiting from Wedgewood’s fabricated polls. Its trading records show otherwise. Markets on the races Wedgewood polled earned the account just $53 after fees. Yet his profitable early bets came around polls from another questionable firm SoCal Strategies, a firm that pollster Lester Tellez says the founder of Wedgewood ran before Wedgewood.

The fake polls demonstrate how easily a false number can move a prediction market.

On July 21, three days after David Crowley re-entered Wisconsin’s Democratic primary for governor, Wedgewood published a survey putting him at 9%. No other poll had been released since his return.

His Kalshi price fell from 23% to 13 within 15 minutes of the poll’s release, the market traded at roughly 70 times its normal hourly pace, and about $45,000 in new money came into the contract within a day. Crowley went on to win the primary.

Kalshi has said fake polls barely move its markets. Yet this one did, against the candidate who won.

In January we described this risk in what we called The Poly-Pump Fake: a for profit misinformation operation. As we said in the piece, “Prediction markets don’t reward truth; they reward those who shape the momentum of truth.” Wisconsin is that warning playing out with a fake poll, and andrewohio53 shows the other half of it: a pollster betting on the markets his polls moved.

BETINT examined all 2,458 of the account’s public trades and compared them with private messages Tellez published on Wednesday. Tellez says he worked with the man from 2024 and raised money for his surveys. Four of the five messages that describe specific trades match the account’s activity by market and date, and a fifth partially matches. Of the seven public Kalshi accounts that traded at least two of the markets he wrote about, only andrewohio53 fits.

The Kentucky Republican primary is the clearest example. At 11:43 AM on May 16, the account bet $99 that Rep. Thomas Massie would lose. Massie was the favorite, trading at 61%. Nine hours later SoCal Strategies released a poll showing his challenger ahead by seven points, and Massie’s price fell to 46% within the hour.

Massie lost three days later. That night, according to Tellez’s screenshots, the man wrote to him: “Poll is gonna be right on.” Then: “Maybe SoCal knows a thing or two.” Three minutes later: “And I made money on it.”

Kalshi’s Massie market, with andrewohio53’s trades and the two polls marked

Kalshi had not commented on the account as of Wednesday night. Its rules prohibit insider trading, but no rule requires a pollster to disclose bets on races he surveys. We assess that the account likely belongs to the man in Tellez’s records. Only Kalshi, which verifies its users’ identities, can confirm it.

How it came out

Wedgewood Polls appeared on X in late June 2026. Over four months it published 15 polls of Senate and governor races, and they were picked up by the New York Times’ polling database, FiftyPlusOne, VoteHub and Decision Desk HQ, and reported by outlets including Newsweek.

On Tuesday evening, after the polling newsletter FiftyPlusOne found that its respondent data did not check out, Wedgewood posted a statement calling itself “an experimental project to demonstrate the vulnerabilities” of the polling industry. It said there was “no real data behind the vast majority of our releases.”

Four hours later, an X user named @BeshearStan posted a screenshot of a Kalshi profile. “So I found Wedgewood’s Kalshi account,” the post said. “He goes by Andrew and has been insider trading using the fake polls that he was posting.” When another user asked how they knew, @BeshearStan pointed to an old “Andrew” account on X and to the profile’s focus on election bets.

The andrewohio53 profile as shared on X.

The profile showed a return of $4,764 and a Seattle Seahawks badge. The profile photo turned out to be borrowed. A reverse image search matches it to the obituary of a Virginia man who died in 2021. Kalshi’s records show it was added on May 21, two days after the Kentucky primary.

At noon on Wednesday, Tellez published a statement and a 42-page file of evidence. He wrote that he had worked since 2024 with the person he believes is behind Wedgewood, had raised $19,587 from 382 donations to pay for his polls, and had known him under several names: “Wilson Rochford” of SoCal, “Jack Sims,” “Andrew,” and a Discord account called “Michael Tracey’s Top Guy.” (That account has no known link to the journalist Michael Tracey.) The file includes screenshots of their private messages, with the date and time visible on each.

That message dump is what made it possible for BETINT analysts to test the Kalshi account’s affiliation.

The unveiled messages that confirm the trades

The Kentucky night is in Tellez’s Exhibit E.

Tellez Exhibit E: messages from “Michael Tracey’s Top Guy” on the night of the Kentucky primary, May 19, 2026

Tellez Exhibit E, 8:05 PM the same evening

The trading record fills in the rest. On primary day the account added 1,596 more contracts against Massie, and it closed out at 98% as the result came in. It made $815 across the Kentucky markets, the single best race in its history.

Two days later, in Exhibit F, the same Discord account accuses another group of being “massive insider traders” for profiting when their poll moved a market. Then he says: “His share price went up to 60c when they dropped the poll. I made 3x my money.”

Tellez Exhibit F, May 21, 2026, 1:09 to 1:14 AM. Names redacted by Tellez

The timing fits a different firm’s Kentucky survey, released on the morning of May 13. The account had bet against Massie the evening before and sold that morning, after the poll knocked Massie’s price down. It made 1.6 times its money, not three.

We went through every message in Tellez’s file that makes a claim a trading record could check. They are below. Where he names a market and a night, the account traded that market that night. Where we can check which side he was on, the side matches too. Where he names an amount, he overstates it.

Every testable message in Tellez’s exhibits, set against andrewohio53’s trades

The June 2 messages matter most for narrowing it down, because they are about losing. “I lost so much money in Iowa,” he wrote after the Iowa governor primary, then told Tellez to kill himself, with a slur attached, because “I just lost 1k.” That night andrewohio53 lost about $520 in the same market, betting on Feenstra, the candidate he names.

Kalshi lets traders make their profiles public, so we checked every public account in these markets. Ninety-nine public accounts traded the narrow Kentucky margin market he called “easy 3x.”

Seventy-seven traded the Iowa primary. Seven traded both.

Only one of the seven traded the margin market on the days he described, traded the Massie market, and lost money on Iowa that night: andrewohio53.

Narrowing the field: public Kalshi accounts in the markets the messages name

That test can’t rule out a private account, since most Kalshi traders don’t make their profiles public. But it narrows the field to one public account, and the timing and sides match the messages.

Three polls → three early bets

If andrewohio53 belongs to the man Tellez describes, the obvious question is what it did around SoCal’s polls.

Five SoCal polls had a Kalshi market while the account existed. It sat out two of them, the 2025 New Jersey and Virginia governor polls. It traded the other three, and each time it bet the way the poll would point before the poll was published.

andrewohio53’s trades before each SoCal Strategies poll it traded

In Maine in October 2025, it put about $1,120 on Janet Mills three and a half hours before SoCal’s poll showed her leading. That was its largest bet of the year - In Kentucky, nine hours early.

In the Texas Senate runoff on May 21, it bought brackets on a Paxton blowout, including “Paxton wins by 20% or more,” in the three hours before SoCal’s poll put Paxton up by 21.4.

SoCal Strategies disputes part of this. It told the Washington Examiner that Jack Sims, one of the names Tellez ties to the man, “is not currently employed with SoCal Strategies and has not been for a year,” and that Andrew Prater never worked there. Tellez says the man ran SoCal until May 2026. If SoCal is right, he had left before the Kentucky and Texas polls. On the night of the Kentucky primary, though, he wrote about that poll as if it were his: “Poll is gonna be right on.”

None of these bets was large: $99, $237, about $1,120. Betting before a poll is also not, on its own, proof that someone knew what the poll would say. But a pollster betting in the hours before his firm, or his former firm, publishes, and then writing “Maybe SoCal knows a thing or two,” is exactly the conflict that prediction markets have no rule for.

What a fake number can do

Wedgewood’s polls moved real money once, clearly.

Most of Wedgewood’s 15 polls barely registered. In races with plenty of real polling, traders ignored the new name. Twelve of the 15 moved their Kalshi market by two cents or less in the first hour.

All 15 Wedgewood polls and what Kalshi did in the first hour

Wisconsin was the exception, and timing explains why. Milwaukee County Executive David Crowley had dropped out of the Democratic primary for governor, then jumped back in on July 18 with Gov. Tony Evers’ endorsement. No poll had been published since his return. Traders priced his comeback at about 23% and waited for a number.

Wedgewood gave them one on July 21. It put Crowley at 9%.

Within 15 minutes his price fell from 23% to 13%. His market traded more in the first hour than in the whole previous day, at about 70 times its normal hourly pace, and about $45,000 of new money came into it within a day. Francesca Hong’s campaign had launched a TV ad that same afternoon citing a poll labeled “NY Times” whose matchup only Wedgewood’s first Wisconsin survey had. The next day its press release cited Wedgewood by name.

Kalshi’s Wisconsin Democratic governor primary. Right: Crowley in the hours after Wedgewood’s July 21 poll

Crowley stayed below his pre-poll price until primary day. Then he won, by about half a point.

The account tied to Wedgewood’s author barely touched this race. It bought Mandela Barnes about 85 minutes before Wedgewood’s first Wisconsin poll on July 5 and sold two days later, up $5. That is the only trade it ever made ahead of a Wedgewood release. It made no trades around the July 21 poll, and made $78 trading live on primary night. Its total across the Wisconsin race was $83 before fees.

Wisconsin by the numbers: the market after the poll, and how the real polls compared

To be fair to the market, real polls released over the next week also had Crowley trailing, and they all missed too. What the fake poll did was get there first. It landed three days into his comeback, on a market that had just priced him back in and had nothing else to go on.

Kalshi has made the opposite case. In August, after a different fake pollster was exposed, the company’s spokesman told NPR that fake polls show why election markets are “a filter for misinformation.” “Traders lose money if they act on bad information,” he said. “While news outlets and campaigns touted the poll as real, the markets barely reacted at all.”

For most of Wedgewood’s polls, that held up. Wisconsin is where it broke. With no other number to go on, traders took the fake one and sold the candidate who went on to win. The same NPR story noted that Kalshi had Crowley as a long shot before his surprise win. Until the campaigns released their own polls the next day, the only poll behind that price was a fake one.

That is the pattern we laid out in The Poly-Pump Fake. We argued that the danger comes in information vacuums, where someone can “plant a rumor that ‘sticks’ simply because it is the only information available.” We expected the hard part to be trust: becoming a source a market believes takes the longest. Wedgewood made it look easy. FiftyPlusOne approved it for its averages on June 29, six days after its account appeared on X.

What Wisconsin lacked was the last step the paper described: someone positioned to cash out. The account tied to the pollster didn’t trade the July 21 poll. But nothing would have required anyone who knew the number was coming to disclose a bet on it. “Truth pays eventually,” we wrote, “but confidence pays immediately.”

The damage that didn’t show up in prices was real too.

In Michigan, Wedgewood’s late-June poll put Mallory McMorrow at 9 percent in the Senate primary. Her Kalshi price was already near 2% and barely moved. She left the race a week later. On Tuesday night, she described what the poll did to her campaign:

Where the money came from

So did andrewohio53 get rich? No.

It is a profitable politics trader: up $6,298 before fees and $4,764 after, almost all from election markets. But most of that came from ordinary primary betting across the country.

The races SoCal polled made it $735 after fees. Wedgewood’s races made it $53.

Where andrewohio53’s profit came from, before and after Kalshi’s fees

andrewohio53’s weekly trading and running profit, March to October 2026

The account barely traded for its first 15 months. It came alive in May 2026, the month of the Kentucky primary and, per Tellez, the month the man left SoCal.

Its heaviest trading ran through June and July, while Wedgewood was publishing. Its last trade was on October 16, four days before the confession. As of Wednesday night it had not traded since.

Who ran Wedgewood

The accounts conflict. Wedgewood’s own June email to FiftyPlusOne, published on Tuesday, named two people: Jack Sims, who signed it, and a “co-pollster,” Andrew Prater, described as active in Ohio Democratic politics. On Tuesday night the man using the Prater name gave a live interview on a Discord server. He said he ran Wedgewood’s companion X account, that Sims made the polls, and that he only learned they were fake on October 19. VoteHub’s head of data science, Zachary Donnini, said Wedgewood’s head pollster had told him he was a Boston University student who used to work at SoCal Strategies. The Washington Examiner found no students by either name in Boston University’s directory.

Tellez says there was one man behind every name. He has a grievance, and we have only seen redacted copies of his records. But every claim in them that we could test against market data held up.

Our evidence connects the Kalshi account to the man who wrote the messages in Tellez’s file. It does not tell us his legal name, and we are not attaching one. Kalshi knows who holds the account, because it verifies identity before anyone can trade.

What happens now

Kalshi had not commented publicly on the account as of Wednesday night. It has looked before: after Median Strategies, Kalshi checked its author’s account and found no bets on his races, NPR reported, citing two people with knowledge of his trades. Kalshi’s rules prohibit insider trading, and it told NPR it has barred campaign staffers from betting on their own races. Whether a pollster’s own numbers, before he publishes them, count as inside information is a question for Kalshi and its regulator. No rule we know of requires a pollster to disclose bets on races he polls.

Faking a poll is cheap. FiftyPlusOne paid $900 for 600 real interviews to test Wedgewood’s data, and making the numbers up costs nothing. Wedgewood is also the second fake pollster this year. In August, Median Strategies was exposed for fabricating polls in the Los Angeles mayor’s race, Nevada and the same Wisconsin primary. Its 21-year-old author called it a social experiment, much the same explanation Wedgewood gave.

The fallout so far has landed on the polls, not the markets. Decision Desk HQ and the Silver Bulletin pulled Wedgewood from their averages. The New York Times added an editors’ note and covered the fallout. The FCC chairman, Brendan Carr, warned broadcasters about airing “fake polls.”

Stock markets solved a version of this problem long ago, with rules about who can trade before an earnings release and surveillance around the release itself. Election markets move on polls now. Nothing stops the people who write the polls from trading on them, and nothing stops someone from inventing a poll to move a price.

BETINT has an open case on Wedgewood. We are watching andrewohio53, the X accounts involved, and the 13 races Wedgewood polled that are still trading through Election Day. If the account moves or more information emerges in this story, we’ll report it here on BETINT.net.

Trade data comes from Kalshi’s and Polymarket’s public records and andrewohio53’s public Kalshi profile, which lists every trade. Messages are from Lester Tellez’s October 21 statement and exhibits, which we have read only in redacted form. Other sources are posts on X, FiftyPlusOne’s reporting, the Washington Examiner, NPR, and other published coverage. Times are Eastern. That andrewohio53 belongs to the man described in Tellez’s records is BETINT’s assessment, and Kalshi has not confirmed it. Nothing in this piece alleges that anyone broke the law. The full brief, BI-20261021-WDG, has the method and every source.

That day we rebuilt every trade in the market from Kalshi’s public data and shared it with the Journal. The Journal’s Brian Schwartz posted our figures that evening:

What we found

$1,388 bought about 20,000 YES contracts before any news. Between 7:47 PM Thursday and 2:00 PM Friday there were 78 trades. A buyer betting on Zacharia started every one of them. If she got the job, those contracts paid about $20,000.

The price went from 1¢ to 45¢ before the first report. For five weeks Zacharia never traded above 4¢. The New York Times story went live at 2:00:28 PM Friday. By 1:56 PM she was already at 45¢.

Red bars are YES buying before the 2:00 PM story. Source: Kalshi public trade data.

The three reported bets are really two orders. The $19, $74 and $80 figures in early coverage are pieces of larger orders.

The $19 bet is one slice of a Thursday 10:43 PM order that pays about $4,332. The $74 and $80 bets are slices of a single order placed at 1:41:25 PM Friday: exactly 10,000 contracts for exactly $200.00, paying $10,000, 19 minutes before the story broke.

Only one name moved. In a market where exactly one candidate wins, the favorites Anna Kelly and Scott Jennings held their prices while Zacharia climbed alone.

A rumor spreading through the crowd usually pulls money off of front-runners.

That does not seem to be the case here.

The key numbers. Source: Kalshi public trade data, BETINT analysis.

Every pre-news buyer is anonymous on Kalshi, so only Kalshi can say who placed these orders. Our brief documents timing and size. It does not allege wrongdoing by any person.

This is the work BETINT technology is running 24/7 every day: watch prediction markets at the trade level, find the moves that come before the news, and turn the raw tape into numbers a newsroom can use. If you cover markets, politics or regulation and want the trade-level data behind a story, reach out to us at BETINT.

BETINT Brief BI-20261009-KZC. All times Eastern.

• On Oct. 2, a Polymarket trader bet $1.14 million that Indiana won’t pass a data center moratorium. Odds of a ban fell in every state the site covers and haven’t recovered.

• In the five hours before the bet, other accounts sent that trader $905,000. Two of them, dromedaryy and ScottyNooo, supplied $750,000

• The bet is the smallest part of the story. The accounts behind it have traded more than 1,000 of the same markets and passed each other shares 74 times since March.

• Their biggest wins are in US politics and the Iran war resulting in a net total of $3.8M in profit combined.

Late night on Friday, Oct 9th, a Polymarket account called aenews2 put $1.14 million on Indiana saying no to a data center moratorium.

It wasn’t exactly hiding. aenews2 links its profile to the X handle @aenews, it has traded on Polymarket since early 2024, and it ranks among the site’s most profitable politics traders. Just minutes after the order filled, a whale-alert bot posted about the trade to X.

What the alert didn’t show was where the money came from. We followed it, and it led to a group of accounts that fund one another, trade the same markets and settle deals between their own wallets. The data center bet turned out to be the tip of it.

A thin market takes a $1.14 million order

The market asked whether Indiana would enact a moratorium on new data centers by the end of 2027. Before Oct. 2, about $26,000 had traded on it in total.

That number measures trading volume, not money resting on the order book. The market was thin, but it wasn’t empty.

To get traders to quote prices in new markets, Polymarket incentivizes them through liquidity farming rewards: a daily pool, $500 a day on each of these state markets, shared among accounts that keep orders sitting on the book near the current price. The bigger the order, the bigger the cut. An order can earn its share every day without ever being filled.

On Indiana, an account called JambonMogettes had parked a bid to buy 1.25 million “Yes” shares at 26 cents, about $325,000. It was there to collect rewards, not to trade. Nobody had traded against it, because nobody had wanted to trade that much.

aenews2 did. It bought 1.54 million “No” shares at 74 cents and took the entire bid in one go. On Polymarket a “No” buyer at 74 cents is matched with a “Yes” buyer at 26 cents, and the contract creates a fresh pair of shares, so a $1.14 million bet needed only about $400,000 on the other side. JambonMogettes supplied most of it.

With that wall gone, there was little left holding the price up. The market had priced a ban at about 27%. By the next evening it was 9%.

The move spread. Polymarket runs the same question for 6 states across 4 deadlines. The average chance of a ban across those 24 markets fell from 21.5% to 13% overnight. On Tuesday Oct 13th it was 13.9%.

The money arrived first

aenews2 didn’t fund the bet alone. BETINT’s investigation shows $905,000 landing in its account in the five hours before the order, $870,000 of it from other Polymarket accounts. The two biggest senders, ScottyNooo and dromedaryy, put in $750,000 between 10:31 and 11:11 p.m., 22 minutes before the bet.

None of it has been paid back. As of Oct 13th, aenews2 has sent nothing to either account, and nothing to the Coinbase address it normally uses to cash out.

dromedaryy and MisTKy, another account with a history of paying aenews2, placed “No” bets of their own within the hour. Other traders piled in too, but only after a whale-alert bot posted the bet at 11:43 p.m. For accounts with no money tie to aenews2, that public alert seems like the simplest explanation.

Dromedaryy sold its Indiana bet by Oct. 8 for about a 30% gain. aenews2 stayed. It still holds 1.41 million “No” shares, up about $157,000 on paper and roughly 50x the size of its next-largest bet.

So who is aenews2 betting with?

The accounts behind the bet

The wires on Oct. 2 weren’t the first money to move between these accounts. We added up every dollar aenews2 has exchanged with six accounts around it: ScottyNooo, MisTKy, dromedaryy, Rex416, imnice and Lolakis.

For 13 months before the bet, the money moved both ways in roughly equal amounts, about $222,000 in and $241,000 out, proving direct levels of cooperation and coordination. Then, in one night, $750,000 came in, more than 3x what aenews2 had received from them in the previous year.

The six are only the closest ring. aenews2 has exchanged money directly with over 1K wallets, and Oct. 2 wasn’t the first time unreturned money arrived just ahead of a big position. On June 16, four accounts sent it $734,000, the day before it started buying into a US-Iran peace deal market. That money hasn’t been paid back either…

Professionals, not newcomers

The four accounts at the center are not new to this. Polymarket’s own leaderboard shows aenews2 up $2.23 million over its lifetime, ScottyNooo $932,000, MisTKy $339,000 and dromedaryy $269,000. Together that is $3.8 million in profit on nearly $500 million traded.

Between 82% and 97% of their recent fills came from orders they left resting on the book for others to trade against. Profit runs about .5c to 1 cent per dollar traded. That is more typical of how a market maker works: small, steady margins on very large volume.

They aren’t rewards farmers. These four have collected about $182,000 in liquidity farming rewards, which is a lot, but at their volumes its minimal, only about 5% of their profit.

That is what makes Oct. 2 unusual. A group that normally provides liquidity and waits for others to come to it went the other way, taking $1.14 million in one order.

The same markets, again and again

This group doesn’t just share money. It shares markets.

We pulled every position these accounts have opened. aenews2 and ScottyNooo alone have traded 608 of the same markets, and at least two of the four core accounts have been in more than 1,000 of the same ones.

Because they make markets, they often hold both sides of a contract at some point, so sharing a market doesn’t mean betting the same way. It means they work the same corners of Polymarket at the same time.

Those corners are mostly politics and war. About 60% of the gains we can attribute to a topic come from US politics and the conflict between the US, Israel and Iran. The single contract where they overlap most profitably is “US x Iran permanent peace deal by June 15,” where aenews2 and ScottyNooo made more than half a million dollars between them.

They lose big too.

ScottyNooo dropped $467,000 on when last year’s government shutdown would end, and aenews2 lost $239,000 on the 2024 popular vote.

This is not a group that always knows the answer. It is a group that trades very large size on the same news.

Passing shares between wallets

Money isn’t the only thing that moves between these accounts. Actual Shares do too.

Quick explainer:

Every Polymarket share is a token on the Polygon blockchain, held in the trader’s own wallet. It can be sent to any other wallet, like a Venmo payment. Two traders can agree on a price, swap shares for dollars and never touch the order book. Those deals don’t appear in Polymarket’s trade feed, its volume figures or its price charts. And because only one side can win, one “Yes” plus one “No” is always worth exactly $1, which the contract pays out on the spot.

Since March, the seven accounts have passed each other shares 74 times, about 217,000 shares in all, or roughly once every three days. About half of the swaps we could match to a payment were settled in cash, wallet to wallet, within 15 minutes. MisTKy sent two-thirds of the shares.

The swaps track the group’s biggest trades. The day before the June 15 peace-deal deadline, MisTKy sent aenews2 a block of “Yes” shares in that market, the contract where aenews2 and ScottyNooo went on to make $516,000.

They show up in Indiana too. aenews2 has cut its data center position only twice, both times through private swaps at $0.10 cents a share and never on the exchange. MisTKy was on the other end of the second one, on Oct. 11. aenews2 paired the shares from both swaps with its own “No” shares and cashed out about $141,000.

The same afternoon, MisTKy sent shares to HorribleWork, the account that bought Texas “No” right after the alert on Oct. 2. HorribleWork had no money tie to aenews2 that night, but it isn’t a stranger to the group.

A private swap needs two parties who agreed to it. 74 private swaps in 7 months indicates a working relationship.

The other side of the trade

The rewards bid aenews2 took on Indiana belonged to JambonMogettes, which runs with a circle of its own. Since May, more than $11 million has moved between JambonMogettes and two linked accounts, UnderperformingForALiving and CryptoScam. UnderperformingForALiving also sold into the Indiana bet.

The two circles have dealt with each other before. MisTKy and UnderperformingForALiving swapped shares privately 3 times in May and June, all in Iran-related markets.

That doesn’t make the Indiana trade a wash trade though. JambonMogettes is down about $121,000 on paper, so someone on that side is losing real money. But the two biggest players in Polymarket’s data center markets, on opposite sides of a single trade, sit one account apart…

What they’re betting on now

The data center bet is aenews2’s largest open position by far. The others are spread across the next set of political markets.

ScottyNooo’s biggest current bet is $185,000 on Flávio Bolsonaro winning Brazil’s presidential election.

MisTKy is short Alexandria Ocasio-Cortez for the 2028 Democratic nomination.

Dromedaryy, the account that wired $500,000 the night of the bet, now has $95,600 on Benjamin Netanyahu not being Israel’s next prime minister.

Indiana’s odds have been tested once since the bet. At 11:01 a.m. Tuesday, a brand-new account was opened, funded within minutes by a second new account, and by 11:13 a.m. it had spent $30,579 on “Yes” and pushed Indiana from 9% to 21%.

We found no news behind it and no link to either group. That afternoon, aenews2 bought another $22,000 of “No.” The contract closed the afternoon at 16.5%. Indiana lawmakers don’t return until January.

Until then, the odds on whether a state bans data centers rest largely on one trade between two groups of linked, professional accounts. For the group that placed it, Indiana was one market out of thousands, and the question we can’t answer from the blockchain is the one that matters most: why a desk that lives on small margins decided this was the bet to make big.

What is established: every trade, transfer, share swap and account-creation time cited here comes from Polymarket’s trade and position data and the Polygon blockchain. Profit and volume figures are Polymarket’s own leaderboard numbers as of Oct. 13. Per-market results combine both sides of each contract. The share of fills from resting orders is measured on each account’s latest 3,000 fills. Topic shares are based on each account’s largest gains and losses, up to 4,000 closed positions per account.

What is not: whether the money and shares sent between these accounts were loans, stakes in a trade or one owner’s funds spread across several accounts; who controls the accounts that moved Indiana on Tuesday. Nothing in this analysis shows that anyone broke a rule or traded on non-public information. Running multiple accounts, transferring money and shares between wallets, and redeeming positions are all permitted on Polymarket.

Twelve new prediction markets are trading on what happens next, with three of them pricing a pandemic outright.

Here is what they are actually saying.

Let’s start with what we know, because it’s not much.

A 28-year-old lab worker at the Irkutsk Anti-Plague Research Institute in Siberia was hospitalized on September 29 and died two days later. Nearly 200 people who had contact with her are under now medical observation, and the hospital that treated her is under quarantine.

The governor of the region next door said she died “possibly from the plague.”

Russia’s public health agency, Rospotrebnadzor, says it was “pneumonia of unknown etiology” and that testing found nothing connected to her work. The U.S. State Department says it is monitoring the situation with the CDC, as Marco Rubios says that now is ‘a time for focus’ on this concern.

So an employee of a plague lab died of a lung infection nobody will name, and the official position is that everything is… fine.

So naturally we ask…

What do the prediction markets say about this concerning new topic?

Yes, there is a pandemic market

Three of them, in fact. They have nothing to do with plague specifically, and they were open long before anyone had heard of Irkutsk.

Polymarket has “New pandemic in 2026?” and “New pandemic before 2028?” Kalshi has “Pandemic in 2026?” All three cover any disease at all.

Here is where they sit:

• A pandemic by the end of this year: about 6 percent on Polymarket, 6 to 8 percent on Kalshi.

• A pandemic before 2028: about 20 percent on Polymarket.

Those are the cleanest answers to the question in the headline.

Roughly 1 in 16 odds for the next three months, and 1 in 5 for the next before the end of 2027.

They did move on these reports, though. Polymarket’s 2026 contract sat at 4.5 percent all of last week and is now around 6.

The before-2028 contract went from 17 percent to just under 20. A lab death in Siberia added a point or two to the odds of a global pandemic, and that seems to be all for now.

Then there are nine newer markets built around the Irkutsk story itself. Put all of these new plague markets side by side and they are asking four different questions.

The standing pandemic markets and every live market tied to the Irkutsk death, as of Monday afternoon.

Will there be a pandemic?

The three markets above.

Will it spread?

Polymarket is asking whether a new pneumonic plague case gets confirmed in Russia. The lab worker herself is written out of the contract. Kalshi is asking whether Irkutsk reports two or more cases, or five or more.

Will Russia say what it was?

Kalshi has a market on whether Rospotrebnadzor names the pathogen before November 1, and another on whether Irkutsk reports even one plague case this month.

Will it show up here?

Kalshi is also trading whether a pneumonic plague case gets reported in the United States.

On the plague itself, the headline number is the Polymarket one. Traders are giving it roughly a 1 in 8 chance that another case is confirmed by October 15, and about 1 in 5 by the end of the month.

So the market’s answer to the pandemic question, at least for now, is probably not.

The scare lasted about half a day

It was not always that calm.

The end-of-October market, in red, briefly priced a new case as a coin flip.

For most of Saturday and Sunday morning these markets sat near 10-15 percent. Then on Sunday afternoon, as the story landed on front pages across the U.S. and Europe, the end-of-October contract ran from under 20 percent to a peak of 52 percent at 6:20 PM ET.

For a few hours on Sunday night, the market thought a second plague case in Russia was more likely than not.

By Monday morning it had fully reset.

No new reporting was confirmed in between - no new case, no new diagnosis - but the price went up on attention and fell back down on the absence of news.

Small money, leaning one way

Now for the part that should temper everything above.

This is a retail-sized market.

The big pandemic markets are liquid. More than $1.1 million has traded on Polymarket’s 2026 contract, including about $19,000 in the past day.

The plague markets are not. About $17,000 has traded on Polymarket’s two Russia contracts since they opened, and about 5,500 contracts on Kalshi’s seven. The old pandemic market did more business in a day than the new plague markets have done in their lives.

On the Polymarket plague contracts that is 124 accounts placing 230 trades. The single largest bet is $1,781, and only two trades are above $500.

But the direction of the money is clear. Close to 80 cents of every dollar traded on those two contracts has gone toward “no new case.” The biggest bets, almost without exception, are people buying No at 80 to 90 cents and collecting a small return if nothing happens.

At BETINT we spend most of our time looking for the opposite pattern: a large, well-timed position from someone who seems to know something. There is none of that here, although I am not sure how there could be outside of healthcare workers or deeply entrenched Russian government personnel. No whales and no blocks have surfaced.

If somebody inside the Russian health system knows what killed her, they are not expressing it on a prediction market… Yet.

My read

Here is what I think people may miss about these markets.

Most of these markets are not really pricing a disease. They are pricing a press release.

This is because every one of these contracts resolves on what an official source confirms. Not on what is provably true.

That includes the pandemic markets: on Polymarket - both pay out only if the World Health Organization declares one.

A second case that Russia never acknowledges pays out exactly the same as no second case at all. So when the market says 1 in 5, it is not saying there is a 20 percent chance of spread. It is saying there is a 20 percent chance that Rospotrebnadzor, or someone it cannot contradict, says so out loud by Halloween.

Those are very different bets.

It also explains the most interesting gap on the board. Traders give it around 30 percent that Russia names the pathogen this month. That is higher than the odds of a new case.

In other words, the market finds it more believable that Moscow eventually admits what this was than that it gets any worse.

I’m willing to bet the pathogen market is the one to watch. It is the only contract that moves on information alone, with no second patient required.

And the U.S. market? Kalshi has it between 20 and 23 percent that a pneumonic plague case is reported in America before November 1. The CDC counts an average of about seven human plague cases a year in this country, and most of them are bubonic, not pneumonic. I’d take the other side of that one at whatever odds.

That price is not a forecast. It is a few hundred contracts and a scary headline.

What prediction markets are good for here

So what do the markets actually tell us about a plague pandemic?

Three things.

1. The crowd is not panicking. With real money on the line, the odds of a pandemic this year moved from 4.5 percent to about 6, and the consensus is that Irkutsk stays a one-person story.

2. The crowd is not deep. Outside the big pandemic contracts, this is thin. Seventeen thousand dollars is an opinion poll with an entry fee, and one motivated trader could move any of the plague prices.

3. The crowd is betting on disclosure, not disease. The question being traded is what Russia will say, and when.

That last point is where this gets interesting for anyone who watches markets for a living. If these contracts grow, the first sign of real news will not be a headline. It will be somebody buying Yes in size at 2 in the morning Irkutsk time.

We will be watching for it.

This is not health advice and it is not trading advice. Prices are as of 3:17 PM ET on October 5, 2026 and will have moved by the time you read this.

At 1:21 AM Eastern on September 30, a Flydubai Boeing 737 MAX 8 cruising at 34,000 feet over northern Saudi Arabia began to fall. Within a minute it had lost more than 14,000 feet. Fifteen minutes later its transponder was broadcasting 7500, the code for unlawful interference.

For the next 43 minutes, we the public had no idea what was occurring on flight FDB1073.

The first report came at 2:19 AM, from Amit Segal of Israel’s Channel 12, the moment the military censor cleared it:

I was on my couch finishing up some development work when Segal’s tweets popped up on my alerting system. I immediately felt like this could rapidly develop into a major security incident, so I hopped into my work station.

This piece walks through that night the way I reported it it: my posts and Amit’s, in the order they went out, set against what the aircraft itself was broadcasting. All times are Eastern.

2:19 to 2:53 AM: The Live Report

Amit’s feed moved fast. Within two minutes he had the airline and the code.

That post has now been seen more than 670,000 times. Three minutes later I replied under his first report:

Then I opened FlightAware and Flightradar24 side by side. They disagreed. FlightAware showed the flight “completed” on a clean line into Tel Aviv. Flightradar24 showed something else.

The purple line on FlightAware was not the plane. It was a projection: the flight plan, drawn forward from the last known point, with altitude and speed set to zero. The white line was real, and the white line showed a U-turn over the Saudi-Jordan border.

At 2:31 AM Amit laid out the sequence that would define the night:

Then the plane vanished from the apps. At 2:38 AM FlightAware’s app stopped showing the flight at all:

Amit’s tone turned at 2:38 (”For the first time, there are positive signs”), and at 2:45 he reported the plane back on the trackers and in contact with the Saudis. At 2:53 AM:

Seconds later came the post that set the early narrative:

3:11 AM: The first visualization

Amidst the chaos, I wanted to see the whole night on one screen. I pulled the FlightAware track through their API and synced it with the timestamps on Amit’s posts. Every X post ID encodes the exact second it was published, so the timing is exact.

The most striking thing on that timeline was not the turn. It was the red band: 26 minutes between the plane’s last FlightAware signal at 1:53 AM and Amit’s first post. And FlightAware had a bigger hole than that. It recorded nothing between 1:21 and 1:32 AM. Its log jumps from 33,700 feet straight to 15,300.

3:31 to 3:43 AM: The dive

A screenshot from a second tracker filled that hole: 33,225 feet at 1:21:48, then 18,925 feet at 1:22:25. That is 14,300 feet in 37 seconds.

I checked it against the raw transponder logs from two volunteer receiver networks, ADS-B Exchange and adsb.lol. Both caught the start: 31,950 to 27,950 feet in 8.2 seconds, roughly 29,000 feet per minute. Then both lost coverage. So I built a 3D reconstruction and posted it first as a reply under @Faytuks:

Twelve minutes later I put out a main thread. It has now passed 117,000 views:

For scale: a planned emergency descent for a cabin-pressure loss runs about 4,000 to 6,000 feet per minute. This was four to five times that, at the jet’s maximum operating speed, while turning roughly 90 degrees.

The zoomed-in version of the model travelled furthest on its own:

3:45 to 6:57 AM: What happened on board

While the data was being rebuilt, the human story arrived through Amit’s feed. At 3:45 AM, passengers described a stabbing with a pocketknife and “a lot of blood.” At 3:47 AM, investigators were examining whether a pilot had tried to crash the plane.

By 4:27 AM Israel was treating it as a terrorist attack. That is the most-viewed post of the entire night, at 1.59 million views:

I posted my read of the data alongside it:

At 2:28 AM the IRMilitaryMedia account posted a plane emoji; I flagged it at 3:04 and hedged it myself at 3:06 (”or just opportunistic propaganda slop”); at 10:31 AM Amit asked whether a statement from Iran’s security council was “an indirect claim of responsibility.”

At 6:47 AM Amit named the attacker as an Omani pilot. The cabin footage he posted at 6:53 AM has been viewed more than half a million times:

What the data shows

After the thread went out, I added a Flightradar24 API key and pulled their full record for the flight: 708 track points. It changes the picture in three ways.

1. The fall went deeper than 18,925 feet.

Time (ET) Altitude Source / note

1:20:56 34,000 ft Level cruise, heading west

1:21:48 33,225 ft Descending 24,512 ft/min

1:22:05 to 1:22:13 31,950 → 27,950 ft ADS-B Exchange + adsb.lol only

1:22:25 18,925 ft Descending 30,976 ft/min, reported by the aircraft 1:22:36 16,850 ft Groundspeed 598 kt

1:22:40 16,600 ft The bottom 1:23:23 21,725 ft Climbed back 5,100 ft

1:24:18 14,950 ft Fell again, 6,800 ft in 55 s

The real figure is roughly 16,600 feet lost in 52 seconds. The 31,000 ft/min rate is not a calculation. It is the descent rate the plane itself broadcast.

2. It went up and down twice. After the bottom, the plane climbed 5,000 feet, then dropped nearly 7,000 more, all inside about two and a half minutes. By midday we had the explanation. Yaniv, one of the passengers who broke into the cockpit:

A passenger pulling back on the controls of a 737 at nearly 600 knots is an absolutely incredible story often thought only possible in Hollywood. While the data can’t prove who was at the controls when, it fits his account second by second.

3. It landed at Tabuk, Saudi Arabia. Flightradar24’s record reads: diverted, actual destination Tabuk (OETB), landed at 3:09 AM ET. Their last position report is at 2:11 AM, heading straight for Tabuk at 14,925 feet, so the 3:09 landing time may be an estimate rather than a measured touchdown.

The squawk codes. Both raw feeds show 7700 (general emergency) at 1:31 AM, then 7500 (unlawful interference) from 1:36 AM to the last message at 1:53 AM, across more than 100 messages. Flightradar24 has told NBC and the BBC that the aircraft went 7700, then 7500, then back to 7700. Their API data shows a different sequence, so I treat the raw feeds as the record here.

One caveat on the visualizer - In the video, altitude is exaggerated 4x so the fall reads on screen, which also steepens the nose angle. The stretch from 1:22:40 to 1:31:26 has very sparse coverage and is shown dashed.

The market waited for the tweet

No prediction market covered this flight directly. The closest was Polymarket’s “Israeli airspace closed by October 31, 2026?”, trading at 13 cents.

1:36 AM Aircraft broadcasting 7500 on public ADS-B feeds

1:36 to 2:28 AM No trades

2:19 AM Amit Segal’s first post

2:28 AM Buying burst begins, five wallets

2:35 AM Peak at 18.8 cents, up about 45%

2:43 AM Back to 12 cents

The money was small, but the pattern is the point: the hijack code sat on public transponder feeds for 52 minutes before anyone traded on it. The market moved on the tweet, not the data.

That gap between public signal and priced signal is what BETINT exists to watch. In this case, there was no indication of insider trading or market positioning based off this event.

How it ended

At 9:39 AM Israel’s defense minister called it “an attempted jihadist terrorist attack, which was thwarted only thanks to the bravery of several Israeli passengers who broke into the cockpit.”

At 11:37 AM the passengers landed in Israel under a fighter escort:

I am glad I was up and able to jump into action on this and am so grateful that what appears to have been a very near catastrophe avoided by heroic actions of the passengers and crew.

I used my custom AI system built by Classified AI to monitor and reproduce these 3D recreations in real time, the same technology stack that powers BETINT.ai.

Sources

• Raw ADS-B traces: ADS-B Exchange and adsb.lol, aircraft A6-FKF (hex 8965D1)

• Flightradar24 API: flight summary and 708-point track

• FlightAware AeroAPI: flight record and track

• Amit Segal (@AmitSegal), Channel 12, live reporting on X

• CNN, NYT, NBC, BBC coverage, September 30, 2026

• Polymarket trade history, “Israeli airspace closed by October 31, 2026?”

• On September 15, news reports revealed that Israel is quietly sharing intelligence with Saudi Arabia to help it defend against Houthi attacks, with U.S. Central Command acting as the go-between. The same day, Axios reported that the top military officers of Israel, Saudi Arabia and seven other regional states had met privately in Germany at a CENTCOM-hosted retreat. Six months into the war with Iran, these are the most concrete public signs yet that the two countries are working together on security.

• Within hours, a prediction market on Kalshi asking whether Israel and Saudi Arabia will normalize relations during Trump’s term shot from 22 percent to 97 percent. By the next afternoon it was back at 33 percent, close to where it started.

• The entire jump was driven by about $11,000 of buying on a market so quiet that a few hundred dollars could move the price.

• Prediction market prices are increasingly quoted by journalists and policy staff as if they measured the odds of world events. This episode shows why that only works when real money is on both sides. On a market this thin, the price tells you what the last buyer paid, not what the market thinks.

Analysis

On September 15, the Jerusalem Post and i24 News reported that Israel had provided Saudi Arabia with intelligence to help counter Houthi attacks on Saudi territory, with U.S. Central Command mediating the exchange.

Later that day Axios reported that the military chiefs of the United States, Israel, Saudi Arabia, the United Arab Emirates, Bahrain, Kuwait, Qatar, Jordan and Egypt had met privately in Germany the previous week at a retreat organized by the CENTCOM commander, Admiral Brad Cooper, to discuss the war with Iran. CENTCOM confirmed that a conference of senior leaders had taken place. A follow-up in the Jerusalem Post that afternoon quoted an anonymous source calling for the countries involved to sign the Abraham Accords together.

The reports describe a level of military cooperation between Israel and Saudi Arabia that had long been assumed but never documented. They also arrived at a moment when Houthi strikes on the kingdom and Iranian attacks on U.S. bases have made the Gulf states more dependent on the regional air defense network that Israel anchors.

The market reaction looked dramatic. Kalshi’s market asking whether Israel and Saudi Arabia will normalize relations before January 20, 2029, had spent the morning around 22% YES, even though the intelligence-sharing story had been public since early in the morning eastern time.

Then, starting at 3:42 PM ET, several quick bursts of buying over the next few hours pushed the price as high as 97%. Once the buying stopped, the price drifted back down. It ended the evening at 49% and was at 33% by early the next afternoon. On Kalshi’s chart the whole thing now looks like a single vertical line on a market that had otherwise been sliding for most of the year.

So why was the move so easy and why didn’t it last?

First, the amount of money involved was small. About $11,000 changed hands over the whole day, almost all of it from buyers, and most of it in a few bursts that each lasted seconds to a minute. This market has less than $100K volume all time, making it prone to major moves from proportional volume.

The market itself was nearly dormant. At the end of the day there were only a couple dozen standing offers to buy or sell at any price. When that little is resting on a market, one buyer willing to pay up can drag the price wherever they like, and the price will fall right back once they are done.

This is not new behavior for this market. It has jumped and collapsed before on trivial amounts, including a spike from 55 to 95 percent on New Year’s Eve.

The clearest sign that the price carried no real information is what DIDN’T move.

Kalshi lists the same question with a shorter deadline, asking whether the two countries will normalize before January 2027. That market is more than twice as large as the one that spiked, and on September 15 it traded two contracts at 5 percent. Companion markets on Israeli normalization with Syria and Qatar traded next to nothing.

Polymarket’s version of the Saudi question moved on a few hundred dollars and stayed near 8 percent. If traders had genuinely decided a Saudi deal was more likely, the nearer-dated market and the neighboring countries would have moved too, since the same diplomatic logic applies to all of them, above all an end to the war and progress on the Palestinian question that Riyadh has consistently made a precondition. Instead, one contract was pushed and then let go.

Prediction market prices now show up routinely in news coverage and policy analysis as if they were measurements of probability.

A price only earns that treatment when enough money sits on both sides to make it a real contest.

Anyone reading these prices should ask how much was traded, how much is waiting on the order book, and whether related markets moved the same way, before treating a jump as meaningful.

The September 15 spike fails every one of those tests. The intelligence-sharing arrangement and the Germany meeting are the real story, and they point to a security relationship advancing well ahead of any formal normalization.

For more analysis on the realtime signals intelligence that betting markets and exchanges create, subscribe to BETINT.net.

The Fresh-Wallet Bets Against the Crypto Bill Just Doubled to $3 Million

Two weeks ago we documented five brand-new Polymarket accounts betting $1.4 million that the CLARITY Act dies. Three more have arrived since, funded from the same exchange wallets, and the two largest purchases in the market’s history landed before dawn.

On August 24, a brand-new Polymarket account bet $818,000 that the CLARITY Act, the crypto bill facing a make-or-break Senate vote on September 15, does not become law this year. The account was just minutes old. The money had arrived moments earlier from an offshore exchange, and the whole trade was completed before sunrise in New York. The wallet hasn’t traded since.

On August 14 BETINT published an investigation into five accounts just like this one: fresh wallets, funded with hundreds of thousands of dollars from non-US crypto exchanges, betting one way on one market, mostly before dawn, never selling. We ended that piece by saying the story was still being written and we would be tracking every one of those wallets using our software, BETINT.ai.

Since then, three more accounts have entered our view with another $1.6 million wagered on “No.” We’re now tracking eight accounts holding roughly $3.0 million at cost, which works out to eight of the nine largest “No” positions in the entire market. Not one share has been sold and seven of the eight accounts have never traded anything else, signaling to us analysts a convincing level of confidence.

As we stated in part 1 of our investigation, nothing in the public record tells us who is behind any of these accounts. We are not accusing anyone of insider trading, and we’re not claiming one person is running eight accounts. What we can show you, transaction by transaction, is where the money came from, how the wallets have behaved, and when they moved the market.

Where we left off

If you didn’t read part 1, here’s the short version (the first piece has the full detail): between May and mid-August, five accounts built about $1.4 million of “No” on this market.

Every one traced back to a withdrawal from Binance or Bybit, most through freshly created pass-through wallets used exactly once. One went from creation to a six-figure bet inside four hours. The largest purchases printed between 3:41 and 4:25 AM Eastern, on different dates. And in what may be the most important note, there were multiple instances where the money moved hours before news that hurt the bill became public.

When we published, the fifth account was sitting on $366,000 it had not spent, and we wrote that if that money moved, we would see it.

That money still hasn’t moved. What did happen, however, is that new money showed up, three times, through the same doors.

First, the bill rallied

The timing matters here, because the new accounts didn’t buy into a falling market. They bought into a rising one.

The recess turned out to be eventful. On August 14, the OCC granted preliminary approval to a bank charter for World Liberty Financial, the Trump-family crypto venture at the center of the ethics fight that stalled the bill all summer.

On August 19, the White House hosted the industry’s chief executives, and the President urged Congress to pass “a fair version” of the bill.

Bitcoin surged, and Polymarket’s “Yes” price climbed from 18.5 cents to 25.5 over three days, its best stretch since June.

If you were holding $1.4 million of “No,” that was the worst week since the positions opened. None of the five accounts reacted. No sells, no adds, nothing. And then the new wallets started arriving.

August 21: back to the Binance channel

The sixth account is the smallest of the new three. Just after noon Eastern on August 21, a brand-new wallet received $199,999 traced to Binance Hot Wallet 34, the withdrawal wallet that also funded the first three accounts in our earlier piece, across what is now more than three months.

One thing to hold onto every time a shared hot wallet comes up in this story, starting now: these hot wallets are exchange plumbing. Hot Wallet 34 processes withdrawals for millions of Binance customers. Money arriving from it tells you the account was funded off Binance but it does not link one account to another directly.

The funding carried a similar human fingerprint we found in May: a small test transfer first, $9.40 this time, with the real money following a few minutes behind. That is a human operator; someone checking the pipe before sending the full amount.

It bought $92,100 of “No” that same afternoon, in a dozen fills, hours after the Bitcoin rally peaked. It has $108,000 still unspent.

This wallet did have some variety in it’s behavior relative to the other wallets. It bought into the market midday Eastern time - not before dawn like the other traders. It also dripped its buying in over a dozen trades rather than sweeping the book in one massive trade.

Subscribe now

August 24: $818K the biggest position in the market

The seventh account is the new largest whale.

At 3:37 ET on August 24th, a brand-new wallet was opened. Minutes later, $829,999 arrived from a Bybit withdrawal wallet we recognized, one that had also funded the two newest accounts in our first piece. The money reached Polymarket at 3:49, and 30 seconds after it landed the account had bought $818,100 of “No” in two fills.

From empty wallet to the largest position in the market took about twelve minutes, and there was seemingly no hesitation anywhere in it. No pause to look at prices, no testing the market with a small order first.

The purchase was big enough to move the market by itself.

“Yes” fell roughly seven points in that hour, from 24.5 cents to under 18, and there was no headline or senator’s statement that hour to explain it. The rally that had been building since the White House meeting got unwound by this account’s trade.

The timing is also interesting, because it was the best odds the bill had to pass all month. The first piece documented two accounts buying against visibly good news for the bill, and this is the same behavior at an even bigger scale.

August 25: it happened again the next morning

A day later it ran again, almost step for step. Before dawn on August 25, another fresh wallet went through the same motions: fee money first, then a $10.00 test transfer, then $799,998 from that Bybit withdrawal wallet again.

Within the hour the money was on Polymarket, and at 5:42 AM the account bought $676,700 of “No”, three fills so fast they printed inside two seconds.

That made it the second-largest holder in the market, behind only the $800K+ account from the day before. It paid the worst prices of anyone in this story, 83 to 85 cents on the dollar, buying after the market had already moved its way. At those prices you’re risking roughly five dollars to win one. It has $123,000 still sitting unspent.

Its purchase pushed “Yes” from 18.5 toward 15. So between these two mornings, the market’s entire late-August repricing traces back to two orders.

One more detail carried over from the first piece, because it kept happening. The four Bybit-funded chains each leave almost exactly one dollar behind per hop: $500,000.20 became $499,999.20; $499,999.20 became $499,998.20; $829,999.20 became $829,998.20; $799,998.40 became $799,997.40. That looks like the same withdrawal and bridging mechanics being used four times. In fairness, it’s also something an exchange’s fee structure could produce for any customer, so we treat it as texture, not proof.

What the shared wallets do and don’t tell us

The shared wallets are the part of this case most likely to be over-read, so here is the full picture and its limits in the same breath.

Four of the eight accounts, spanning May to late August, drew their money through one Binance withdrawal wallet. The other four, spanning fifteen days, drew theirs through one Bybit withdrawal wallet. All eight used the same bridging service, moved round amounts, spent their money almost as soon as they had it, and the manual test-transfer tell appears on four of the eight chains.

We’ve flagged it at each step and it bears repeating in full: exchange withdrawal wallets are shared infrastructure, the pipes an exchange uses to pay out everyone. Two accounts drawing from the same one proves only that they used the same exchange around the same time. That was true in the first piece and it’s still true with eight. It is NOT evidence of cluster trading or coordinated positioning, and we are not presenting it as such.

What is fair to say is that several ordinary things line up at once: same exchanges, same bridge, same cadence, same tells, same one-dollar decrements, same one-way bet on the same market, eight times over four months. Each item alone is unremarkable. The accumulation is much more interesting.

There is no direct on-chain transfer linking any two of the eight wallets, no shared intermediary between the Binance and Bybit sides, and our own clustering engine, which requires harder evidence than a shared exchange before it connects accounts, assigns no cluster here. The identities are recoverable only through exchange customer records, which would take a legal process to reach.

Five of the eight have now printed their single biggest purchase between 3:41 and 4:25 AM Eastern, on five different dates spanning almost a month. The newest account landed just outside it at 5:42 AM, still pre-dawn in New York.

That stretch of clock carries elevated volume generally because it’s mid-morning in Europe. But it carries nine of the nineteen large fills. Paired with two exchanges that don’t serve US customers, it could be a hint.

And the first five accounts haven’t moved at all. Through the White House rally, through the drawdown, through the recovery, zero trades across all five since August 12. The only thing that changed is their mark: at today’s price of 85.5 cents, every one of the eight positions is in profit, about $358,000 cumulative in the green at the time of writing.

Why someone might bet $3 million on “No”

So what would make someone comfortable wagering this much on “No”? We can’t establish who these accounts belong to or whether they’re connected, and we’ve been careful not to guess. But we can give informed speculation.

Start with what “inside information” would even mean here. A bill is not an earnings report. There’s no single number sitting in a data room until a release date.

Whether the CLARITY Act becomes law is being decided in public, slowly, by a few hundred people whose staff, colleagues, donors, and lobbyists talk constantly.

Someone can be extremely well informed about a bill’s chances without possessing anything close to a secret, and in Washington the line between “well connected” and “inside” is blurred and mostly legal.

“No” was never a fringe position. “Yes” did peak at 82% chance back in March but spent the whole summer sliding.

Betting against Congress finishing something is, historically, a safe default. What stands out is the size and freshness of the wallets.

But the most informed speculation I have that I find most interesting: hedging.

Imagine someone with a lot riding on the CLARITY Act passing.

A crypto business that becomes far more valuable under the new rules, a fund heavy in tokens that would rally on passage, an investor whose whole book is positioned for regulatory clarity. For that person, a large “No” bet isn’t a prediction at all. It’s insurance.

If the bill passes, they lose the wager and don’t mind, because everything else they own just went up - probably by a lot more than $3M. If it dies, the payout cushions a much bigger loss. Paying 80 cents on the dollar for “No” looks reckless if the bet is your whole position. As the offset to a large “Yes”-shaped portfolio, it could be entirely rational.

The hedging read would also explain the behavior we keep documenting and can’t otherwise account for: no reaction to a 12-point adverse move, no selling into profit, no risk management of any kind.

Traders tend to manage positions. Hedgers may be more confident putting down theur bet on and leaving them alone. If the hedger were a company rather than an individual, that would introduce complications of its own around how such a position gets booked, but the mechanics work the same way.

None of this is a claim about what’s actually happening. It’s the honest range: high-conviction bearishness on Congress, a hedge against the bill passing, one operator spreading exposure across fresh wallets, or something we haven’t thought of.

Every wallet here, and thousands more, are under surveillance on our systems. If any of them move before the vote, we’ll cover it.

Reporting via onchain records and BETINT’s internal systems. Our earlier coverage of the first five accounts is here. Nothing in this piece is an allegation of unlawful conduct.

At 4:25 AM ET on August 12, a fresh account on Polymarket bet $134,000 on “No” that the CLARITY Act, the biggest crypto bill Congress has ever seriously considered, will become law this year.

We were already watching this market.

Because twenty-four hours earlier, an account that was four hours old at its first trade had done nearly the same thing at 4:08 AM, for $297,000. Both accounts had been loaded with exactly half a million dollars, withdrawn from the same offshore exchange a day apart. Neither wallet has traded any other market.

They are the fourth and fifth accounts of their kind. Since May, a series of fresh wallets funded from non-US crypto exchanges has been quietly stacking the “No” side of this market. Together they now hold five of the six largest “No” positions on Polymarket: about $1.41 million at cost. Not one of them has sold a single share. Four of the five have never touched another market.

I want to be careful right at the top about what this story is and isn’t. We spent three weeks tracing these wallets transaction by transaction, and nothing in the public record tells us who is behind any of them, or whether they are connected to each other at all. This is not an accusation of insider trading, and it is not a claim that one person is running five accounts.

What we can show you is the size, the construction, and the timing. The timing in particular kept doing something that made us keep digging: the money kept moving hours before the news.

What is The Clarity Act?

The CLARITY Act would settle, for the first time, which US regulator oversees which parts of the crypto industry. It passed the House by a wide margin in July 2025 and cleared the Senate Banking Committee 15 to 9 in May. Then it stalled. An ethics fight, centered on the Trump family’s own crypto holdings, hardened Democratic opposition through the summer, and the bill sat while the Senate’s calendar filled up. On August 8, hours before leaving for a five-week recess, Majority Leader Thune filed for a make-or-break procedural vote: September 15 at 2:15 PM, the day after the chamber returns. If the bill can’t clear that vote, it is probably dead for the year.

Prediction markets have been pricing this drama the whole way. On Polymarket, “Yes, the bill gets signed in 2026” peaked at 82 cents in February. It was 12.5 cents by August 7. Today it trades around 17.

Which means the people in this story, the ones betting “No,” are currently winning.

How to Read a Polymarket Wallet

Two pieces of background make everything below legible. First: Polymarket runs on a blockchain, so every account is a wallet whose entire history is public, when it was created, where its money came from, every trade it ever made.

There are no names attached, but the behavior is naked. Large deposits usually arrive from crypto exchanges, and exchanges pay withdrawals out of big shared company wallets, the way a bank pays everyone from the same vault.

So a funding trace can tell you which exchange the money left. It cannot, by itself, tell you whose money it was, because that vault serves millions of customers. Keep that caveat in your pocket; we’ll need it repeatedly (and will expand on this dynamic in future writing).

Now the five accounts, in the order they arrived.

May: the Smallest Bet That Was Right Early

The first account is the smallest and in some ways the strangest. On May 12, a wallet was created, received $49,900 from Binance Hot Wallet 34, and started buying “No” within minutes. Actually, that’s not quite the full sequence: first it received a $10 test transfer, and then the $49,900 three minutes later. Someone checking that the pipe worked before sending the real money. That’s not a bot behavior. That’s a person.

Here’s what makes it strange. This account bought “No” at 29 to 40 cents straight through May 14, the day the Senate Banking Committee advanced the bill 15 to 9. That was a good day for the bill. The committee vote was the strongest signal all spring that the thing was moving. And this wallet spent it betting $48,100 that the bill fails, while the market visibly disagreed.

Three months later the consensus caught up to it. Those 29-cent shares now trade above 80. The bet isn’t resolved, and I want to resist the urge to grade it early, but so far the early, lonely, wrong-looking position has been directionally right.

July: The Largest Holder

The second account is the biggest holder in the market and the only one of the five with real history. Its wallet dates to April, and it had already built and exited a smaller “No” position in the spring. On July 22 at 4:49 AM Eastern, it came back, opening with over $50,000 of “No.”

That afternoon, at 12:11 PM, Senate Republicans released the bill’s rewritten text. By 4:35 PM Senator Warren had called it “dead on arrival,” and seven Senate Democrats rejected the draft the same day. The market fell. The account kept buying for two more weeks, ending up around $387,000.

Sit with that morning for a second, because it’s the shape we kept finding: the position opened hours before the document that tanked the price became public.

It’s possible that text was circulating privately the night before; drafts do leak around Washington. Maybe it was a lucky read on a bill that plenty of smart people already thought was dying. The timestamps can’t distinguish those stories, and we won’t pretend they can. What the timestamps do say is that the money moved first and the news arrived second.

The funding is its own signal. This account draws from a personal treasury wallet that has handled roughly $100 million in stablecoins on Ethereum alone since mid-2024, pulls eight-figure sums from both Binance and Bybit, and keeps tens of millions parked in institutional-scale yield strategies.

Whoever runs it is not a hobbyist.

Eight times between April and August, money left that treasury and landed in the Polymarket account within minutes, including $100,000 on July 30 that arrived exactly one minute before the account’s single largest purchase printed. This is someone who wires money when they intend to use it.

And a small human fingerprint, the same one from May: when this account cashed out its earlier position in the spring, it sent a 10 USDC test transfer first, then $46,141 a few minutes later. That is a very human action to check the accuracy before wiring massive sums of cash.

August 4: Fresh Wallet with Massive Size

The third account is the one that made us start writing this up, and its clock is worth walking through slowly.

August 2: the account does not exist. August 3: it’s created, and that evening $100,000 leaves Binance Hot Wallet 34 for a freshly made burner wallet. August 4, 4:13 AM Eastern: $400,000 more follows. That burner has only ever made three transactions in its life: two in, one out.

At 9:30 that morning, Brendan Pedersen at Punchbowl News posted the first public sign that Senate Democratic leadership was moving to delay the bill’s vote. It’s the earliest public crack in the dam that we could find. The $500,000 had left Binance five hours before that post.

At 10:01 AM the burner forwarded the full amount into Polymarket. First trade five minutes later. And at 3:41 the next morning, August 5, the account bought $416,000 of “No” in two fills, hours before that morning’s reporting that Democrats considered the procedural vote doomed.

Within 36 hours of existing, the account had deployed $442,700 and become the second-largest “No” holder in the market. It hasn’t traded since. It has never sold. When the market briefly recovered after the cloture filing, the position went about $10,000 underwater and the account did nothing at all. It’s back in the green this week.

August 10 to 12: the Bybit Pair

Then this week the pattern repeated twice more, fast, from a different exchange, and this is the part we watched happen more or less live, because by now these wallets trip our alerts.

On the morning of August 10, a wallet was born on Ethereum, got a few dollars of gas money from a Bybit payout wallet, and two minutes later received $500,000.20 from a high-volume Bybit withdrawal wallet. Eight minutes after that, the full amount was on its way to Polymarket.

The wallet’s lifetime activity: two transfers, one in, one out, done. The account it funded made its first trade four hours later and printed its big one, $297,000, at 4:08 the next morning. It has never traded another market.

The next day showed a similar story. A new wallet, gas money at 4:52 AM, then $499,999.20 at 5:43 AM, from the same Bybit withdrawal wallet that had funded the account above, twenty-four hours earlier. Eleven minutes later the money was in Polymarket. The following pre-dawn, 4:25 AM on August 12, it bought $134,000 of “No” in a single print.

Two details here that we keep turning over. The first: the amounts. The August 10 chain ran $500,000.20 into the burner and $499,999.20 out. The August 11 chain ran $499,999.20 in and $499,998.20 out. Each hop leaves exactly one dollar behind. That’s consistent with the same withdrawal mechanics being used twice, though in fairness, an exchange’s fee structure could produce it for any two customers.

The second: the fifth account is sitting on $366,000 it hasn’t spent. It arrived with $500,000 and has deployed about a quarter of it. Which makes this a live story, not a closed one. If that money moves, we’ll see it.

The Bybit caveat gets the same treatment as the Binance one, and I mean that seriously, not as a disclaimer to skim. That withdrawal wallet pays out to many customers every hour. Two accounts drawing from it a day apart proves they used the same exchange around the same time.

The narrower coincidence, same wallet, same bridge, same one-dollar decrement, same never-used-again burners, same pre-dawn execution, is exactly that: a narrow coincidence that a busy exchange could still, in principle, produce.

This is what the five funding chains look like next to each other:

The Rest of the Market

Pattern-hunting is cheap, and the failure mode is famous: go looking for suspicious wallets and everything starts looking suspicious. The guard against that is to screen everyone, not just the accounts that catch your eye. So we did.

The typical big holder looks nothing like them. We pulled the top 80 holders on both sides of the market and every fill from July 22 onward, more than 16,000 trades. The rest of the “No” side is ordinary. The typical big holder trades dozens or hundreds of markets.

The pre-dawn timing is the most elusive detail in the whole case, so it deserves the most skepticism. Each of the four large late accounts printed its single biggest buy between 3:41 and 4:25 AM Eastern, on four different dates.

That window does carry elevated volume generally, roughly one in eight of all fills in this market, because 8 AM UTC is mid-morning in Europe and crypto never sleeps.

But it carries 7 of the 12 large fills. And that’s the other stat worth staring at: across three weeks of trading, only twelve fills in this whole market were $25,000 or bigger, and eleven of the twelve belong to these accounts. The block-size flow in this market is these wallets. The twelfth was somebody buying “Yes.”

Read the pre-dawn window alongside the funding, two exchanges that don’t serve US customers, and you get a soft hint about what time zone the buyers live in. That’s as far as we’ll go without more information.

A Check against Kalshi

One reasonable objection to everything above: maybe this is just Polymarket being Polymarket. So we looked at Kalshi, the US-regulated exchange that runs equivalent contracts on the bill. Kalshi has no public wallets, so there’s nothing to trace there, and nothing on Kalshi connects to the accounts in this story.

What we can say is modest. Prices fell there too, and over the same stretch Kalshi’s larger trades leaned toward “No.” There’s one wrinkle in the price data worth a sentence: for part of the window, Polymarket’s odds ran a few cents below Kalshi’s before the two converged in early August. That could reflect heavy buying pressing on one venue. It could also just be two markets finding the same price at slightly different speeds.

Since the cloture filing, Kalshi’s contracts have moved toward expecting the September 15 vote to happen, and expecting the bill to lose it.

Every date and dollar figure in this piece, in one place:

The other explanations + what to watch for

The honest range of explanations for all of this runs wider than the pattern suggests at first read.

Informed positioning is on the list. So is a sophisticated hedge: imagine a fund with heavy crypto exposure that benefits if the bill passes, paying a few hundred thousand dollars for insurance against it failing.

So is plain conviction, because plenty of people with no special information thought this bill was dead by late July, and the ones in this story are, at the moment, up money on that view.

The truth might be different for each of the five accounts. Nothing in this piece establishes that they know each other even if there’s some interesting overlap in their process.

If the bill clears its vote on September 15, then the positions documented here become large, fast, wrong bets, and this piece becomes a case study in how confident-looking money can be confidently wrong.

The vote is at 2:15 PM on September 15, the day after the Senate returns. We will cover the results here on BETINT.net.

Wallet traces are from Etherscan and Polygonscan across Ethereum, Base, and Polygon; trade data from Polymarket’s public records and BETINT’s own monitoring; Kalshi figures from parallel price capture on both venues. Every funding chain above is documented transaction by transaction in the underlying BETINT brief. Nothing here is an allegation of unlawful conduct.

BETINT: bettingintelligence.ai · betint.net

A White House teleprompter operator made a reported ~$100,000 betting on the words he was scrolling.

We went back through Kalshi’s public records to try and identify the mention markets he traded.

What our system found:

On 16 July, ABC News reported that Gabriel Perez, President Trump’s teleprompter operator since 2016, was under CFTC investigation for trading Kalshi’s Mentions markets: contracts that pay out on whether a specific word gets said in a specific speech.

If true, it would amount to trading on advance knowledge of the exact words that would be spoken. It is difficult to imagine a cleaner alleged example of informational advantage.

Kalshi’s surveillance flagged and froze the account in March. The profit figure reported ranges between $90,000 (CNBC) and $100,000 (ABC).

ABC’s sources also say the CFTC alerted federal prosecutors in Manhattan at some point, and that those prosecutors declined to open a criminal investigation, which is a step short of any decision about charges. Perez was put on unpaid leave the day the story broke and, per Politico on 28 July, no longer works for the federal government. Settlement talks with the CFTC continue, on terms that would have him give back the profits and stop trading these markets.

Kalshi’s trading data is anonymous. There are no wallets to follow the way there are on Polymarket. Every account is a number that only Kalshi can resolve into a person.

So we went looking for the trades instead. We knew we couldn’t find a name, but instead focused on the shape of the positioning.

We targeted contracts that exhibited the unusual trading patterns described in the reporting.

We found some interesting results.

Across 3,166 Trump mention contracts, six words consistently stood out:

• Crypto (three separate speeches)

• Pelosi

• Rare earths

• Somalia

• Elon

• Olympics

These were among the most significant examples identified by our research.

What is actually visible

Kalshi’s live API serves tick data and candles for current markets, and stops serving them once a market is more than about eight weeks old. We went looking anyway and got 404s across the entire December-to-March window. In its high-resolution form, the record of this scandal is already gone.

What did survive, however, is a compliance artifact. Kalshi is compelled to and does file a daily record for every contract into a CFTC reporting bucket: volume, open interest, high, low, status. One row per contract per day, and it does not expire.

It is much coarser than an API feed, but it turned out to be enough to reveal some interesting patterns.

We swept all 126 daily files covering 1 December 2025 through 5 April 2026 and reconstructed the full universe of Trump speech mention markets in the window: 131 speech events, 3,166 individual mention contracts, 129 events with usable data.

From BETINT Brief BI-2026-0716-KMM, issued 16 July 2026.

Then we put four questions to each of those 3,166 mention contracts.

• Did it settle YES?

• Did it trade before the speech as a longshot, under 45 cents?

• Did it carry real size beforehand, at least 200 contracts?

• And was that size unusual next to the other words in the same speech?

The method is meant to hunt for one thing: somebody buying a cheap word in size, shortly before that word gets said.

Price falling while open interest climbs is the shape everything below is built on.

The result

41 contracts flagged across 22 speech events.

Aggregate profit ceiling on the flagged pre-speech positioning: $84,253.

The reporting says $90,000 to $100,000.

Davos is the cleanest example in the dataset

Trump’s address at the World Economic Forum, 21 January. The contract: will Donald Trump say the word “crypto.”

Three days of the “crypto” contract, straight off the exchange’s daily files.

Read the middle row twice. In one session the price fell by more than half while open interest went up sixty-fold, which means somebody absorbed roughly 6,900 YES contracts into a falling market - the crowd increasingly believed he would not use the word.

Trump DID speak the word CRYPTO the next day. About $5,500 on that block.

You can get a big position on a cheap word from conviction about the news cycle, but what you don’t usually get is the price sliding the whole time you are buying.

That is the signature of one side knowing the answer while the other side does ordinary probability estimation, and the crowd here grew more confident it was right up until the moment it wasn’t.

The State of the Union is where the money is

24 February. The largest cluster in the scan: roughly $30,000 of flagged positioning across six contracts in the “who and what will Trump mention” families.

The ticker codes are the exchange’s symbols and the word decodes are ours - the last two are inferences rather than confirmed contract terms.

Pelosi is an interesting one. Open interest on that contract went from 4 to 4,500 starting in mid-January, while the price walked down from 45 cents into the low teens. This opens the door to weeks of quietly buying a word the market kept marking down, and it settled YES on speech night.

Everything else in the window

Detroit Economic Club, 13 January: 2,978 contracts on “rare earths” bought the day before at 34c to 48c. YES the next day. “Somalia” alongside it.

Tech Roundtable, 4 March: 1,419 contracts on “crypto” at 7c to 22c the day before. Opened at 6c on speech day, settled YES.

The weekly “what will Trump say” market for the first week of January: about $14,000 of longshot-YES positioning on “Elon” and “Olympics.”

Worth noting that the cheap crypto word shows up three separate times across the window, on three different speeches.

Where we go blind

Two of the five named speeches are mostly invisible to this method.

The December primetime Address to the Nation was voided and relisted on speech day. The original listing traded thinly for a couple of days before the reset, and the scan did flag one small position there, about $600 of the total.

But the relisted markets, where the real volume landed, only ever existed on speech day: 186,000 contracts traded on the word “Biden” alone, and a single daily row cannot tell you which of that was bought before he started talking. The March Medal of Honor ceremony has the same problem.

The two speeches the method cannot see, and why.

Blank is not the same as clean. Those two speeches are simply outside what we were able to take a stab at.

The same limit buries what is probably the most damning detail in the whole story.

ABC describes Perez pulling out of positions mid-speech when Trump skipped a scripted word, which is about as close to a confession as market behavior gets. At daily resolution it is invisible. On tick data you couldn’t miss it.

Some Caveats

We cannot attribute anything. The data is anonymized, we see positioning and not accounts, and “consistent with the pattern that was reported” is the strongest claim available to us.

We are stuck at daily resolution, so the mid-speech exits are gone and same-day markets cannot be scanned.

The dollar figure is a ceiling on each contract and an undercount across the window, for the reasons above. Best treated as an order of magnitude.

And settlement is inferred from final-day prices, which works well for liquid contracts but not as well for thin ones where a word got said but nobody bothered repricing it.

This piece draws on BETINT brief BI-2026-0716-KMM, a four-page internal briefing on the scan, its method and its limits. It is not published.

Sources and method. BETINT internal scan, 16 July 2026, with reporting rechecked 5 August 2026.

Universe reconstructed from Kalshi trade-api v2 event enumeration and the kalshi-public-docs S3 CFTC reporting files, 126 daily files covering 1 December 2025 through 5 April 2026, series KXTRUMPMENTION, KXTRUMPMENTIONB, KXTRUMPSAY, KXPRESMENTION, KXDJTJOINTSESSION, KXWEFMENTION and related.

Reporting: ABC News, CNBC, NPR, NBC News, all 16 July 2026, plus Politico, 28 July 2026, on his departure from government. Nothing in this analysis attributes any trade to any individual.

BETINT produces this level of coverage on the markets that move your business, your sector, and your stakeholders. To point it at the markets that affect you, reach out at bettingintelligence.ai or contact dan@betint.ai.

1. Executive summary

During the 2026 World Cup, a set of Polymarket accounts traded the tournament at whale scale and, when it ended, moved their balances off the platform within days of the final. Public reporting in July 2026 first flagged a group of these accounts as a probable single operator. We did not discover the cluster. What follows is an independent verification and extension of it, built entirely from public on-chain data and Polymarket’s own APIs.

The findings:

• The cluster is eight accounts: six opened between 5 June and 13 July for the tournament, plus two older, higher-volume accounts folded into the same exit. The eighth member, copa1970, surfaced only when every inbound leg into the consolidation wallet was reconciled.

• Net profit across the eight is $6,409,589 on $82,777,299 of volume. Two of the eight accounts are net losers over their lifetime; one lost $795,933.

• All eight consolidated into a single Ethereum wallet, 0xc14e6dc9afa2850a86f8a17f5874944470ccc0b1, which took in $14,254,855.47 across the tournament window and now holds $0.47.

• The funding loop closes. The same consolidation wallet sent $500,000 to one account’s deposit address on 28 June 2026, the exact transaction that created that account. One wallet both capitalizes the accounts and harvests their proceeds.

• The consolidation evidence is probabilistic, not cryptographic. Every leg matched on amount and timing within a 7 to 21 second window, at transfer sizes that were unique on the platform in their window by a wide margin. We explain in Section 10 why the settlement rail in use here does not permit a deterministic proof, and we state the case accordingly.

The operator’s identity is unknown. The consolidation wallet has fanned out to eleven unattributed wallets, and following further would require resources beyond chain analysis. What the case does establish is common control across the eight accounts, and it doubles as a working demonstration of which tracing techniques still function on Polymarket’s current funding architecture and which no longer do.

2. Provenance and scope

The cluster was surfaced publicly before our analysis; versions of the claim circulated widely in July 2026, naming seven accounts. This report is not a rebuttal of that reporting and does not relitigate it; it is our own reconstruction from primary sources. Where our figures differ from circulated ones, Section 7 notes the differences briefly. The bulk of the report concerns what the chain shows and how the cluster membership was established.

Everything here derives from public sources: Polymarket’s data APIs for account PnL and volume, Etherscan v2 across Ethereum and Polygon for on-chain flows, and direct measurement of Polymarket’s withdrawal infrastructure. No privileged or platform-internal data was used, which also means the analysis inherits the limits of public data. Those limits are flagged where they matter.

3. What the chain shows

3.1 The cluster

Net: $6,409,589 on $82,777,299 of volume.

Note the shape. Two older accounts opened in February and March, carrying enormous volume ($40.7M combined) and losing money. Six accounts opened between 5 June and 13 July, carrying less volume and making all the profit. copa1970 surfaced during the exit-rail reconciliation described in Section 5.3. The name is not subtle: copa is Spanish for cup, and 1970 is the most celebrated World Cup ever played.

3.2 The Consolidation Wallet

0xc14e6dc9afa2850a86f8a17f5874944470ccc0b1 (Ethereum, externally owned account)

Every large inbound leg matched a Polygon-side withdrawal from one of the eight accounts, arriving 7 to 21 seconds later, with fee drift of 0.02% to 0.05%.

3.3 The funding loop

This is the strongest single piece of evidence in the case.

On 28 June 2026 at 17:16 UTC, the consolidation wallet sent $500,000 to 0xbbfa1a7cdae85c619561302aabff97f11ee1b4f5. That address is asparagus2012’s dedicated Polymarket deposit address, and that transaction is the funding event that created the account. Twenty-two days later the same account sent $3,346,472.51 back through the withdrawal rail into the same hub.

One wallet capitalizing an account and later collecting its winnings is very difficult to reconcile with independent traders who happen to use the same infrastructure. It is the kind of edge the rest of the correlational evidence cannot manufacture on its own, because it is a direct transfer on a single chain, visible in full.

3.4 Downstream

The consolidation wallet drained to eleven addresses between 30 June and 26 July: $2.90M, $2.83M, $2.50M, $2.50M, $1.30M, $600K, $500K, a further $500K recycled back into a Polymarket deposit address, $300K, $300K, and $25K. None are attributed. Following further is possible but each hop multiplies the work, and the realistic endgame is an exchange deposit, where attribution requires legal process rather than analysis.

4. What they traded

The chain shows the money moving. Polymarket’s own activity feed shows what the money did in between. We reconstructed the complete trading history of all eight accounts, just under 80,000 trades across roughly 570 distinct markets, and computed realized profit per market from every trade and every redemption. The per-account totals reconcile with Polymarket’s official PnL figures to within about 4%; the residual is maker rebates, trading rewards, and positions still open on the two surviving accounts.

The picture is not eight variations of one strategy. It is one book, run through two kinds of vehicle, and most of the money came from a single conviction.

4.1 Three-fifths of the profit was one position: Spain to win the World Cup

Across three accounts, the operator accumulated 5,099,330 shares of “Will Spain win the 2026 FIFA World Cup?” for $1,165,516, an average entry of 22.9 cents. Spain won. Every share paid out at $1.00, for a profit of $3,933,814, which is 61% of the cluster’s entire net.

The entries, in order:

Three details in that table carry the story. First, asparagus2012 began buying Spain the same day the consolidation wallet’s $500,000 arrived and the account was created; the account existed to buy Spain at 11 cents. Second, copa1970, the account whose name is Spanish for “cup,” deployed essentially its whole stake into this one market three days after its own creation and touched almost nothing else: six markets lifetime, one of them a $227 cricket flutter. Third, the ladder keeps climbing: the operator kept adding as the price tripled, including over half a million dollars at 59 cents once Spain had reached the final. That is not scalping a mispricing; that is conviction held from 11 cents to settlement.

None of the three accounts sold a single share into the rally. Every share was held to expiry and redeemed at $1.00. The redemptions landed within hours of the final: asparagus2012 and copa1970 redeemed 60 seconds apart, at 01:47 and 01:48 UTC on 20 July, one more small tell of a single hand on the controls.

4.2 The semifinal harvest

The single most profitable match was the France vs. Spain semifinal on 14 July. Four of the accounts traded it, and together they netted $1,990,078 on about $1.75M staked, the cluster’s best day by far:

• asparagus2012 put $518,660 on Under 2.5 goals and made +$521,775.

• therighteousdog, one of the two “losing” accounts, took Spain to advance for +$408,952, its largest win ever recorded, on a World Cup market rather than its usual club-football fare.

• stubblyballs took Spain to advance (+$263,055), the Under (+$101,000), and No on both teams scoring (+$89,999).

• The daily “Will Spain win on 2026-07-14?” market added +$251,103 across two accounts.

The other semifinal, England vs. Argentina on 15 July, is the honesty check: the cluster lost $26,268 net on it. The corner bets won, and they are the same “Over/Under 8.5 Total Corners” market flagged in the behavioral fingerprint of Section 5.1: asparagus2012 and hampertime held the Under together and collected about $133,000 combined. hampertime’s bet against England won another $137,121. But stubblyballs bet the match to be low-scoring three different ways, No on both teams to score (−$217,057), Under 2.5 goals (−$57,691), and 0-0 exact score (−$35,984), and the goals came anyway. Right on corners, wrong on goals, net zero. Sharp, not psychic.

4.3 The shape of the whole book

Realized profit by market type, all eight accounts combined:

Read the first and fifth rows against each other. The futures row made $3.3M on $1.8M of turnover; it is the Spain position minus about $450,000 the operator lost backing Brazil and England to win the tournament, a useful reminder that the conviction was specific, not general. The daily match-winner row is the opposite: $17.1M of churn for $287K net, a grinder’s line, thousands of trades at short odds for a sub-2% margin. That churn is what made the accounts look like whales by volume; the futures are what made the operation worth running.

The style is consistent everywhere it shows: large positions at short prices, Unders on goals, No on longshots, favorites to advance. athelstan’s book is the purest example, +$559K betting against Türkiye on 19 June and +$410K against Czechia on 18 June, taking the “No” side of single-match markets in six-figure size.

And the book was not clairvoyant. Individual losses ran large: $461,923 backing England on 17 June (athelstan), $344,129 on Brazil futures across two accounts, $194,220 by copa1970 betting against France in the quarterfinal it then reversed at the semifinal. The edge, wherever it came from, was a few points per bet at scale, not foreknowledge.

4.4 Two kinds of account, one operator

The trading history also explains the cluster’s odd shape, the thing our first pass got wrong. The six accounts opened in June and July are tournament specialists: 3 to 42 markets each, World Cup almost exclusively, all profitable. The two older accounts are something else entirely. therighteousdog traded 272 markets and $12.5M of volume, NoLyon 180 markets and $8.0M, and their books from February through May are wall-to-wall European club football: Bundesliga, La Liga, Serie A, Premier League, daily match markets and totals, in the same short-odds style. Both ground out net losses doing it.

So the operator was not a World Cup tourist. This is someone who had been trading European football at six-figure clip sizes for months, losing at club level, and then concentrated everything on the tournament and won. The World Cup accounts were opened fresh for the occasion; the club accounts were folded into the same exit when it ended. Any membership screen keyed on “World Cup only” or “profitable only” excludes the two accounts that reveal the most about who this trader actually is.

5. How the cluster was established

No single technique carried the case. Three did, in sequence. Each is stated with its actual evidentiary weight, because they are not equal.

5.1 Behavioral fingerprint (suggestive, not sufficient)

The six 2026 accounts share a funding ritual precise enough to be a signature: a tiny test deposit of $77 to $100, then exactly two tranches of roughly $250,000 landing two to twelve minutes apart, totalling about $500,000 per account, over the same bridge route, repeated across six weeks. They traded World Cup markets almost exclusively, including obscure derivatives that most users never touch. Two of them independently concentrated in “England vs. Argentina Over/Under 8.5 Total Corners.”

This is strong circumstantial evidence. It is not proof, and on its own it produced a wrong answer in this very case. See 5.3.

5.2 Cross-chain amount-and-time correlation (the decisive technique)

Each Polygon-side withdrawal was matched to a destination-chain arrival by amount within a tight time window. Ten matched on the first pass, thirteen after reconciliation.

Why this works is arithmetic, not cleverness. We measured the full distribution of withdrawals leaving the platform over 24 hours:

A pooled rail hides a transaction in proportion to how many other transactions look like it. At $47 the crowd is thousands deep and the privacy is real. At $3,346,472.51 there is no crowd. On an ordinary day the platform does not process a single withdrawal above half a million dollars. The anonymity set for that transfer was one, not just in its hour but plausibly in its month.

The pooling is genuinely protective for the typical user and provides essentially nothing to a whale. Any operator moving seven figures through this rail is legible to anyone willing to look on both sides of the bridge.

One caveat on the measurement itself: the distribution is a single 24-hour sample taken in late July, after the tournament ended. Withdrawal volume during the World Cup settlement window was plausibly heavier at the top end. That would widen the candidate set for the largest legs somewhat, but not to a degree that changes the conclusion; even a tenfold increase in seven-figure withdrawals leaves the candidate set in single digits within a 60-second window.

5.3 Exit-rail reconciliation (the technique that corrected the record)

Our first pass matched ten withdrawals to five accounts and rejected therighteousdog and NoLyon, on the grounds that both had negative lifetime PnL, both were funded months earlier by a different route, and neither fit the funding fingerprint from 5.1.

That was wrong. The error surfaced only because we went back and reconciled every inbound leg into the consolidation wallet rather than stopping at the ones already explained. Thirteen legs in, ten accounted for, three unexplained. Tracing those three back across the bridge resolved them to therighteousdog ($1,105,700), NoLyon ($800,343.13), and an account we had never heard of, copa1970 ($936,000).

Three lessons generalize:

Reconcile the total, not the matches. The unexplained residual was the entire finding. A pass that only confirms its own hypothesis will confirm it and stop.

The exit rail beats the funding rail as a membership test. Funding patterns vary because an operator’s accounts are established at different times by different means. The exit is where everything converges, because the whole point of the operation is to end up in one place.

Losing accounts are still the operator’s accounts. Any screen that filters on profitability will systematically miss the losers, and in this case the losers carried nearly half the cluster’s total volume. If the question is an operator’s market footprint rather than their profit, excluding them is the larger error.

6. What this does and does not establish

Established: eight accounts under common control, to a high but explicitly probabilistic standard; a consolidation wallet that both funds and harvests; the profit and volume figures as reconstructed here; the timing of the exit around the final.

Not established: who the operator is. Whether the operation broke any rule. Whether any information advantage was involved. The destination of the $14.25M after the first hop out. Whether the cluster is complete; the reconciliation closed every inbound leg to this consolidation, but an operator running additional accounts that exit to a different hub would be invisible to this method.

We want to be precise on the rules question, because it is easy to overreach here.

Multi-accounting is not prohibited on Polymarket’s global platform. The integrity rules prohibit wash trading, self-dealing, fictitious transactions, spoofing, front-running, and manipulation. They contain no prohibition on holding multiple accounts. There is also no KYC on the global platform, so there is no identity substrate on which common control could be detected in the first place.

The 2024 precedent is instructive. When Polymarket confirmed that four accounts belonged to the French trader known as Théo, it found no manipulation and secured only a forward-looking commitment not to open further accounts without notice. That remedy only makes sense if the prior conduct was not a breach.

Polymarket US is a different matter entirely. As a CFTC-designated contract market, its rulebook imposes an affirmative disclosure duty and a common-control aggregation prohibition:

“This prohibition applies across all accounts under common ownership, control, or direction, whether Orders are entered directly, via API, or through an FCM Participant or Broker Participant.”

That rule is enforceable because every US account is KYC’d through an intermediary. The same conduct sits on opposite sides of the line depending on which entity the trader used.

So the accurate framing is: this operator ran eight accounts on a platform that does not forbid it, on a venue with no identity layer, and would have been in clear breach had they done the same thing on the regulated US exchange twenty feet to the left.

7. What the public account got wrong

The version of this cluster that circulated publicly asserted that seven accounts were “funded from the same initial wallet” and that profits were “consolidated in a single unlabeled wallet,” citing an address for each. The central conclusion holds up. The two cited addresses do not, and the mechanism is worth two paragraphs because it is the most common pitfall in prediction-market open-source work, one we have fallen into ourselves.

The cited “same initial wallet”, 0xf70da97812cb96acdf810712aa562db8dfa3dbef, is the Relay bridge solver: a liquidity wallet that pays out on the destination chain when anyone bridges into Polygon. It appears as the funder for 1,726 distinct recipients in our registry alone. Two accounts receiving money from it are no more connected than two people who received a package from the same courier.

The cited “single unlabeled wallet”, 0x4cd00e387622c35bddb9b4c962c136462338bc31, is Polymarket’s shared withdrawal aggregator. We measured it processing 542 withdrawals from 442 distinct wallets in one hour. It is not a personal wallet; it is a funnel every withdrawing user passes through.

Both assertions were substantively true anyway. There is a single wallet that funded the accounts, and a single wallet the profits consolidated into, and they are the same wallet. It is just not either address the public claim identified; the actual wallet sits one chain boundary away, on Ethereum rather than Polygon. Also true in the public account: the core one-operator claim and the World Cup concentration. Overstated: the $7.4M profit figure, which counted two net-losing accounts as winners, and the seven-account count, which missed one.

8. Context: this is a category, not an anomaly

Multi-account operation on Polymarket is well documented and the estimates are large.

The 2024 election whale. Four accounts confirmed by Polymarket, later expanded by Chainalysis to nine and then eleven wallets, roughly $80M deployed and $78.7M to $85M in profit. Identification came from funding patterns: every account traced back to Kraken deposits in $500,000 and $1,000,000 tranches at consistent times of day. Real-world identification was not on-chain at all; Polymarket engaged a corporate investigations firm.

Wash trading and Sybil farming. A Columbia study covering roughly three years found about 25% of Polymarket volume consistent with wash trading, peaking near 60% of weekly volume in December 2024, with one cluster of 43,000 wallets. Chaos Labs put the 2024 election market near one third. Solidus Labs found about 15% over a later window and noted that under 1% of wallets captured about half of all profits in key political markets. These are different windows and methods and should not be averaged.

Informed trading. Mitts and Ofir (Columbia and Haifa) screened over 93,000 markets and flagged 210,718 wallet-market pairs with a 69.9% win rate and roughly $143M in aggregate anomalous profit, explicitly framed as a lower bound and explicitly not synonymous with illegal insider trading.

Enforcement exists but is thin and new. In April 2026 the CFTC brought its first insider-trading action involving an event contract, against a US Army master sergeant who traded Polymarket contracts on Venezuela outcomes using classified planning information, with parallel SDNY criminal charges. Polymarket referred the activity. Note what made that case work: a motivated platform and a defendant reachable by US process. Neither condition holds for an anonymous wallet funded through a bridge from an offshore exchange.

And nobody is obliged to watch. Surveillance on the global platform is a commercial contract, terminable at will and answerable to no regulator. The integrity-vendor ecosystem that matured through 2026 is sports-shaped, because leagues had the commercial leverage to demand it. There is no equivalent counterparty for elections, geopolitics, or monetary policy, which is exactly where the anomalous profit concentrates. The DNC has no integrity desk.

9. An operational note: the payout wallet is under attack

Worth including because it is visible, unusual, and it has a practical lesson.

Of 964 token transfers touching the payout wallet, only 653 were canonical USDC. The remainder are an address-poisoning campaign:

• Counterfeit ERC-20 contracts whose symbol renders as “USDC,” several using Cyrillic homoglyphs so the string is visually identical but byte-different.

• Zero-value and one-cent dust from lookalike addresses that clone the first and last four hex characters of the payout wallet’s real fan-out destinations. The real 0x8d946bf7…be23 has a shadow at 0x8d947f17…be23.

The poisoner is watching the consolidation wallet’s genuine outflows in real time and manufacturing near-identical decoys, betting the operator eventually copies an address from their own transaction history and pastes it into a transfer. Wallets and explorers truncate the middle of addresses, which is the whole basis of the attack.

The academic baseline (USENIX Security 2025) counts 270 million such attempts against 17 million victims with at least $83.8M in confirmed losses, and over 1,100 counterfeit contracts impersonating USDC alone.

The lesson for anyone doing this work: filter to canonical token contract addresses and require non-zero value, or your tooling will report flows that never happened. Token names and symbols are not unique and are not verified on-chain. Only the contract address is authoritative.

The same technique contaminated our desk research. Text circulating in search results purporting to quote Polymarket’s terms on multiple accounts traces to polymakrets.com and polymarkets.co.il, lookalike domains that are not Polymarket. In this domain the counterfeits target the analyst as readily as the trader.

10. Verification notes

Every figure in this report was pulled directly from primary sources using BETINT.AI. Wallet PnL and volume come from Polymarket’s own APIs; all on-chain figures from Etherscan v2 across Ethereum and Polygon; the withdrawal distribution from a direct measurement of the aggregator.

One correction we made during the work and are carrying openly. We initially described the large settlement legs as Circle CCTP. They are Circle Gateway. The distinction is not cosmetic. A CCTP transfer commits its destination recipient on the source chain at burn time, making the hop cryptographically provable. Gateway mints against a unified multi-chain balance, so the link is correlational. Both appear identically in a block explorer as a transfer from the zero address, and only the minter contract in the transaction logs distinguishes them.

This matters for how strongly the case should be stated. Had these been CCTP transfers, consolidation would be provable by event data alone. Because they are Gateway, the evidence is amount-and-time correlation across thirteen legs, each within a 7 to 21 second window, at amounts that are unique in their window by a wide margin, plus a funding loop that closes. That is a very strong probabilistic case. It is not a cryptographic one, and this report does not describe it as such.

Appendix: addresses

Full account wallet addresses are in the table at Section 3.1.

A single trade on 27 July tripped BETINT alerting: 3,000,000 contracts on a Kalshi market we had never seen trade, bought for $12,000.

We were several hours into analyzing the activity when Fortune published at 11:24 PM and answered the one question the Kalshi data cannot: who.

The buyer is the prediction-markets conference company NEXTPredict, hedging its own summit. The seller is Susquehanna, underwriting the $3,000,000. Kalshi does not publish counterparties on block trades, so that reporting is the only source for it.

The rest we could check ourselves, against the Kalshi system, the full order book, and the CFTC certification behind the product. Several things there do not match the public account, and they all run in the same direction.

Let’s start with the timeline, because it reframes the controversy this contract has been carrying since it was first announced.

Kalshi filed the product with the CFTC on 14 July, with four clauses of exclusions already in it: sabotage, drones, lasers, bomb hoaxes, cyberattack, and any security-ordered closure.

Just days later, objection to the contracts landed in public. The sentiment was largely “a $3,000,000 payout for shutting down an airport is a bounty on shutting down an airport”. Kalshi put the airport contracts on ice.

The bounty was already drafted out of the certified contract, days before anyone complained.

From BETINT Brief BI-2026-0728-JFK, issued 28 July 2026.

The trade

On 27 July at 16:14:32 ET, a single block bought 3,000,000 YES contracts at $0.0040 on the market “Will at least 50% of scheduled passenger and cargo flights at JFK be cancelled October 21, 2026?”

Premium $12,000. Maximum payout $3,000,000. A payoff ratio of 250 to 1.

It was never really a market

The contract listed on 15 July and traded nothing for twelve days. But that is not a market shrugging at a product nobody wanted.

As best we can tell, Kalshi created it quietly, seemingly at NEXTPredict’s request, and did not announce it. Access was limited to roughly 1,000 institutional accounts. Block trades require a 25,000-contract minimum, which rules out the retail-sized flow that normally builds volume in a new listing.

One maker quoted it, 6 cents bid against 13 to 14 offered, for a few hours on the morning of 15 July, then pulled. After 14:00 UTC that day there are no candles at all until the block. Not just no trades. No quotes.

At the hour of execution, the book was 0.00 bid against 0.99 offered. A 3,000,000-lot could not have been filled on the public order book at any price.

So it was not a market that failed to attract interest. It was an instrument, built to order, that happened to be listed on an exchange. The single transaction in its history is the reason it exists.

The parties, per Fortune’s reporting and NEXTPredict’s own statement.

Susquehanna is taking the professional tail-seller side here: collect $12,000, underwrite $2,988,000. Kalshi is the venue, and self-certified the product template with the CFTC on 14 July under Regulation 40.2(a), rulebook AIRPORTDELAY.

The shape of that was legible before the names were. A block flag, an empty book, and one resting take-profit order is a hedger buying cover from a professional, not two traders disagreeing about JFK. The names confirmed the structure rather than changing it.

Where the reporting and the filing come apart is on what the contract does, and both gaps make it sound safer and broader than it is.

An excluded event does not refund your money

Fortune records a Kalshi spokesperson saying the excluded events would result in the exchange refunding bets.

The filing says something else.

The operative text: “If an Excluded Event determines whether or not the Expiration Value satisfies the Payout Criterion, the Contract shall settle at the last fair price pursuant to Rule 7.1 of the Rulebook.”

Not a refund or a zero, but a mark-out at the last fair price.

That distinction is the entire answer to the moral hazard objection, and it is a better answer than voiding would have been.

An attacker cannot manufacture the $3,000,000, because the event that would cause the cancellations is the same event that stops the payout. And Rule 7.1 lets Kalshi reach back to the last traded price before the circumstances became known or reasonably anticipated, which kills the obvious workaround: buy it cheap, run the price up, then trigger the event and collect at the inflated mark. The reach-back defeats that trade specifically.

Add the access restriction, roughly 1,000 KYC’d institutional accounts with clearing members recorded on every block report, and the practical gap closes. The July objection was aimed at a mechanism the document had already foreclosed.

The rest of it reads like reinsurance, because it is

Once you see the exclusion set, the drafting register gives the game away. Excluded Event. Schedule baseline. Fixed scheduled-flight total. Corrections and revisions. Reinstated flights. That is not exchange language. That is underwriting language.

The four clauses track AVN48B, the War, Hijacking and Other Perils Exclusion Clause carried by essentially every aviation insurance policy in the world. With one deliberate deletion.

The strikes and labour-disturbances limb is gone. And the filing closes the ambiguity directly: “cancellations arising from any cause, including weather, air traffic control action, staffing, mechanical issues, or strikes, are counted identically.”

That matters more than it looks. A controller sickout is the single most plausible non-weather path to a mass cancellation day, and it would otherwise read as a “deliberate act or omission” under exclusion clause (ii). The operative text forecloses the argument. Labour action is a covered peril.

So: a parametric insurance policy, drafted in reinsurance language, listed on a regulated exchange, and sold to a company hedging its own event.

That is the story, and it is a more interesting one than the argument the product picked up in July.

Which leaves the question the coverage skips.

Is it actually a good hedge?

On the exchange’s own terms, the cover is far narrower than the risk it is described as addressing.

The threshold is set at catastrophe. Fifty percent is roughly 6.7 times JFK’s worst single day during the 43-day federal shutdown that ended in November 2025, when 20% to 40% of controllers were absent nationally and the FAA cut scheduled operations by emergency order. JFK’s peak in that entire episode was 7.5%.

The worst figure at any New York airport was Newark at 13.3%. A conference arrival day is materially damaged somewhere around 10% to 15%, and the contract is silent across that whole range.

Delays do not count at all. Only cancellations, as classified by FlightAware at expiration. Diversions and gate returns that ultimately depart do not count, regardless of length.

That is not our reading of a grey area. The exchange’s own certification uses a six-hour ground stop where flights operate late as a worked example of an outcome that pays nothing.

Here is where that bites. On 27 July 2026, the same afternoon this block traded, the FAA ran staffing-driven ground stops at JFK, LaGuardia and Newark simultaneously. JFK carried the worst delays in the region: a 149-minute average ground delay.

That exact day, repeated on 21 October, would wreck a conference arrival flow and pay zero.

Two more gaps worth naming. The contract covers one day, 21 October, the inbound travel day. The summit itself runs 22 and 23 October, and disruption during the event is unhedged, as are departures on the 23rd. And it is a single-airport trigger, while delegates arrive through LaGuardia and Newark too. The correlation helps in a metro-wide ATC event like 27 July, and does nothing in a JFK-specific one.

What $12,000 bought

We put independent fair value on this contract at roughly 0.2% to 0.5%.

They paid 0.40%. Susquehanna has not obviously overcharged, and NEXTPredict has not obviously overpaid. The instrument is honestly priced. It simply pays in a very narrow and very extreme corner of the risk it is described as covering.

To get there you need a tropical system or a severe extratropical storm closing the airport, which under the deeming clause resolves at 100%. Hurricane Sandy made landfall on 29 October 2012, closed JFK for roughly a day and a half, and cancelled more than 20,000 flights. That is eight days later on the calendar than the covered day, inside the same late-season Atlantic window. It is the cleanest covered path there is, and it is still a fraction of one percent.

So for $12,000, NEXTPredict has bought a genuine, correctly priced far-tail contract, and a Fortune article about its own conference. Fortune itself raises the question of whether this is replicable risk management or, in large part, a marketing effort. On the numbers, the risk transfer is real but slight. The narrative value is large and certain.

Both are true at once, and there is nothing improper about that.

Why this matters beyond one contract

Kalshi says it is in talks with companies in freight and energy about similar airport-specific cancellation contracts. That converts a one-off into a product thesis, and it is the part of this story with the longest tail.

A regulated exchange is being used as a parametric insurance venue. The AIRPORTDELAY certification is an airport-and-period generic template. Any hub, any window, listed on request.

The bespoke-listing channel is the interesting surface. A counterparty can commission a contract, have a market maker take the other side, and hold cover without a broker, an underwriting cycle, or a claims process. Settlement is mechanical against a third-party data feed.

The regulatory line is still moving. The CFTC has been unusually active on this venue in 2026: insider-trading enforcement in April, a rare emergency-rule stay on 14 July, dedicated prediction-market rulemaking since June, and reporting this week that the Commission is pressing exchanges to abandon broad contract templates. AIRPORTDELAY is exactly the kind of broad template that guidance addresses. Those two trajectories are on a collision course.

Threshold design is where the value sits. If these contracts are going to function as risk transfer rather than lottery tickets, the strikes have to come down into the range where disruption actually hurts. A 10% or 20% JFK cancellation contract would be a real hedge, and would price in the single-digit cents.

That is the product to watch for.

What we are watching

A few things would settle the open questions here.

Whether a 22 or 23 October contract gets listed, which would close the gap over the conference days and confirm the travel-day reading was deliberate. Whether lower-threshold airport contracts appear, which is the difference between risk transfer and a lottery ticket. Whether the template shows up at other hubs with freight and energy counterparties, which tests the product-line thesis the exchange has stated out loud.

And on the tape itself: the buyer’s only visible instruction is a resting offer to sell all 3,000,000 YES at $0.95, an exact size match and a good-till-cancelled take-profit. Any movement in that order is the only statement of intent the hedger has made.

Below it sit unfilled bids: 116,666 contracts at $0.003 and 175,000 at $0.002. Someone is still trying to accumulate this thing at a third of a cent, as of 2:41AM ET today.

The gap worth reading for

Prediction markets are now being used to transfer real corporate risk, priced by real market makers, on templates that can be replicated at every major airport in the country. That is a genuinely new thing, and it arrived without much ceremony.

It also means the odds line is no longer the only interesting number. The interesting number is the distance between what an instrument is described as doing and what its filed terms say it does. On this contract that distance is two reported details and one threshold, and all three point the same way.

This piece draws on BETINT brief BI-2026-0728-JFK, a nine-page internal report on the block, the certification and the base rates. It is not published.

Sources. Kalshi REST v2, pulled 28 July 2026: full rules text, the 28-trade tape with block flags, full-depth order book, hourly candles from listing, and the superseded 14 July version of the contract. KalshiEX LLC, CFTC Regulation 40.2(a) notification, AIRPORTDELAY rulebook, filed 14 July 2026. Fortune, 27 July and 16 July. FAA emergency order and per-airport cancellation data from the 2025 shutdown. NEXTPredict’s summit page.

BETINT produces this level of coverage on the markets that move your business, your sector, and your stakeholders. To point it at the markets that affect you, reach out at bettingintelligence.ai or contact dan@betint.ai.

One anonymous wallet. Our reporting.

Fifty newsrooms across twenty countries in six days.

Here is what we actually found, and why this story is not over.

On July 1, NBC News ran an exclusive by National Law Enforcement and Intelligence Correspondent Tom Winter: an anonymous Polymarket account had quietly staked a fortune that Vladimir Putin would be out of power by the end of 2026. The reporting was sourced by Betting Intelligence.

We are the firm that found the wallet, mapped the position, decoded the operator, and handed NBC the intelligence behind the headline.

Six days later, that story had been picked up by more than 50 outlets across 20-plus countries and four languages. Forbes, The Telegraph, Yahoo Finance, Newsweek, Digi24, UNITED24, Financial Express, and dozens more, plus heavy amplification on X, where the prediction-market industry’s most-watched commentator framed it as the genre’s favorite question: “insider or donkey?”

This is the full account. The bet is the headline. The intelligence underneath it is the reason the story traveled.

The position

Our subject brief, BI-2026-0630-ZNS, opens on a single account: @ZnotluvuiSamez, trading through a Safe smart contract on Polygon, on the market “Putin out as President of Russia by Dec 31, 2026.”

As of our 30 June dossier, the operator had committed $331,226 across 67 buys, accumulating roughly 2.75 million YES shares worth about $371,000 at market. That figure did not stop climbing. Within days it had pushed past $400,000, and reaction accounts were quoting numbers as high as $500,000 as the operator kept adding (his position now totals $510K to win $3.3M), The world’s press rounded and re-rounded the number as it traveled.

Capital in, payout if YES, wallet concentration, and the market’s implied probability.

The math is stark. A YES resolution pays roughly $2.75 million, about 8.3 times the capital deployed, for about $2.42 million net. The Putin position is 84% of the entire wallet’s value. And the market disagreed: it priced Putin’s removal at just 13.5%, meaning 86.5% of the money on the board was betting the operator is wrong.

The most telling detail is behavioral.

The operator dollar-cost-averaged in, never sold, and accumulated into a market moving against the position.

This is not a punt. The operator averaged in between 10 and 17 cents, has never sold a single share, and added roughly $54,000 in the last 24 hours alone, buying into a price that was drifting against the bet, after most of the public discussion had already happened. That is the profile of conviction, not a flutter.

What the headlines missed

The bet is what got picked up. The analysis underneath it is what most of the 50 outlets never carried, because syndication kept the intelligence and dropped the byline. Here is the part that does not appear in the odds.

A coherent pro-Ukraine thesis, position by position

The Putin bet does not sit alone. Every other meaningful position in the wallet points the same direction.

Section 04. The wallet’s full thesis ledger.

Ukraine recaptures Crimea. Ukraine signs a peace deal. United Russia loses seats. Zelenskyy wins the Nobel. Ukraine joins NATO. YES on the pro-Ukraine outcomes, NO on the pro-Kremlin ones, straight down the book. A single trader expressing one worldview across seven markets.

A handle that is a coded signature

The username reads like keyboard noise in English. It is not.

Section 05. The handle decodes through latinized Cyrillic.

Read as latinized Cyrillic, Z notluvui Samez resolves to “Z, I don’t love, and same to you.” An anti-war message built around the Russian war symbol, aimed back at it. Crucially, the handle predates the account’s first public post. The ideological signature was in place from day one, before there was any audience to perform for.

The broadcast that followed fits the same pattern: a Ukrainian-flag avatar, posts in Ukrainian carrying a nationally recognized anti-Putin chant, and repeated flamingo emojis referencing Ukraine’s long-range FP-5 “Flamingo” cruise missile. One post is a screenshot of the operator’s own Crimea-recapture bet captioned “Crimea, UKRAINE!!!”, tying the broadcast directly back to the wallet.

A behavioral read that places the operator in Europe

We ran hour-of-day analysis across the entire trade tape.

Section 06. Behavioral forensics from the trade tape.

The rhythm is consistent and it is not Russian or American. Roughly 75% of dollar volume lands in a window that maps cleanly to Central European working hours, with a sleep gap that corresponds to roughly 10 PM to 7 AM CEST.

The pattern breaks in a revealing way: the operator pulled an all-nighter the night Ukraine struck, then went silent the morning after Putin admitted the fuel crisis, and fell quiet for 18 hours after placing the single largest trade. This is someone who treats the position as a job.

An OSINT timeline against the public record

We mapped the accumulation, trade by trade, against events on the ground.

Section 07. The position, built trade by trade against the record.

The sequence matters. EU intelligence reporting on Kremlin “coup fears” surfaces in early May. The operator’s first substantive trade lands on 22 May, one to two days before the mass drone-and-missile assault on Kyiv that pulled in the wider cohort of buyers.

In other words, the conviction was in place before the strike that catalyzed everyone else. Then come the assassinations of senior Russian military figures, Putin’s own fuel-crisis admission, and the heaviest accumulation, roughly a third of the entire position deployed in a 72-hour window as the broadcast began. At least 15 Russian generals have been killed since the war started. This operator was positioned early, and pressed hardest as the record turned.

The findings that make it stranger

The deeper the brief goes, the less this looks like a crowd trade.

One wallet, not a herd

@ZnotluvuiSamez is not the only wallet betting on Putin’s exit. But the drop-off behind it is a cliff.

Section 11. The YES leaderboard.

The second-largest YES buyer has committed barely a tenth of the whale’s capital. Every other fresh-capital YES position is a rounding error by comparison. This is one wallet’s conviction, not a market consensus.

The market is actively betting against him

This is the detail that makes the position more unusual, not less.

Section 13. Large NO buyers matching the position tick for tick.

Serious money is on the other side. A single NO buyer has staked more than $195,000 on Putin surviving the year, larger than any YES challenger by six times, with multiple six-figure NO positions behind it. This is not a case where “smart money” has quietly moved to Putin’s exit and our subject is riding the consensus. Our subject is the consensus-breaker, and the market is paying up to fade him.

How the contract actually resolves

The precise wording matters, and it widens the paths to a payout.

Section 16. What actually resolves this market YES.

This is not a bet on voluntary retirement. It resolves YES if Putin ceases to be president for any period of time before 31 December 2026. An announced resignation or removal resolves it immediately, regardless of when it takes legal effect. Detention, incapacitation, or being otherwise permanently prevented from serving all qualify. Death is not excluded. That is a materially different risk profile than a bet on orderly succession, and it is part of what makes a concentrated YES position this size worth a second look.

We also documented the mechanism live. The “Aleksandar Vučić out as Serbian president” market spiked the instant Vučić announced he would resign, resolving toward 99% on the announcement alone, not the effective date. A thin removal market can gap violently on a single headline. For a YES holder, the payout is binary and event-driven, which is exactly why timing and conviction, not consensus, define this trade.

Possible Explanations

We do not pretend to know who is behind this wallet. What we do is lay out every read the evidence supports, without prejudice, and mark what each one would take to prove. The dossier puts four on the table, and states plainly that the order does not imply likelihood. The data is consistent with all of them.

Why this is the work

Anyone can screenshot an odds line. What we do is different. We take a single anonymous wallet and return an intelligence product: the thesis behind the money, the identity tells hidden in a username, the operator’s time zone read off the trade tape, the position mapped against the geopolitical record, and the market structure around it.

We laid out four candidate explanations for who this operator is, from a diaspora individual betting loudly to a possible influence operation manufacturing a citable market signal, without pretending to certainty we do not have. That discipline is the product.

Prediction markets now price the outcomes that move companies, elections, and governments. When the money moves, the question is never just “what are the odds.” It is “who is behind this, what do they believe, and what do they know.” That is the question we answer.

This story is not over

Our dossier closes on open threads, not conclusions.

Section 18. What we are still chasing.

We are still tracing the funding origin: where the capital entered the Safe, and whether any hop upstream touches a known exchange or identifiable entity. We are still testing whether the late-May cluster was genuinely independent or lightly copy-trading. We are still asking whether the X broadcast was engineered for exactly the press pickup this story became, a citable “14% implied” artifact routed back toward Moscow, and whether that fits an influence-operation pattern. And the public X handle is a direct channel that may yet answer the one question the chain cannot: motive.

The position is still open. The operator is still buying. Congress has opened inquiries into prediction-market trading on geopolitical events. And the market itself resolves on a single headline that could arrive any day between now and New Year’s Eve.

We are watching the wallet in real time. When it moves, we will know first.

Read the full dossier

The complete eight-page brief, BI-2026-0630-ZNS, is linked here.

This is the level of coverage BETINT produces on the markets that move your business, your sector, and your stakeholders. If you want it pointed at the markets that affect you, reach out at bettingintelligence.ai or contact dan@betint.ai.

The short version:

If an insider knows something, the first thing they do is bet, not tweet.

They talked about how markets are starting to price war, politics, executive decisions, geopolitical risk, corporate events, and even outcomes that create serious security concerns.

A few timestamps:

00:38 — What Betting Intelligence is and why we’re building it

03:00 — Why this is much bigger than sports betting

05:01 — The insider trading problem prediction markets haven’t solved

09:16 — How rumors, AI media, and bot farms can move markets

13:39 — The BETINT terminal: alerts, whale trades, wallet tracing, and AI analysis

19:11 — Signal jamming and the Iran strike market example

21:20 — Why media outlets often use prediction market odds too simplistically

28:43 — Why prediction market intelligence may become as normal as stock market intelligence

This conversation gets into the upside, the danger, and the weird gray zone in between.

A military correspondent for The Times of Israel, Emanuel Fabian, began receiving death threats last month. His offense: reporting that an Iranian ballistic missile had struck Israeli soil on March 10. Gamblers on the prediction platform Polymarket had wagered more than $14 million on whether Iran would strike Israel on that day, and those who stood to lose flooded Mr. Fabian with demands that he change his story — that he reframe the missile as intercepted debris and let them collect. Some offered him a cut of their winnings. Mr. Fabian refused and contacted the police.

The story seems absurd, but it may become typical. Over the last few months, traders placed bets on a raid in Venezuela suspiciously close to the actual event….

Read the Full Article Here

Introduction: Gradually Then Suddenly

When we began publishing on BETINT.net in September 2025, the idea that geopolitical prediction markets posed structural national security risks was still niche. When we were invited to speak at the McCain Institute earlier this year, many senior national security professionals openly acknowledged this was a new domain of thought for them.

Then came the capture of Venezuelan leader Nicolas Maduro and the resulting speculation that an insider who knew the attacks were going to happen profited off of that classified information.

That episode became the first true mainstream inflection point. Media outlets and policymakers began treating prediction markets not as curiosities, but as potential insider-threat and national security vectors.

Rep. Ritchie Torres introduced legislation aimed at restricting insider trading by members of Congress and executive branch officials on prediction platforms. Six senators led by Adam Schiff called for banning contracts “involving deaths.” During the same period, thoughtful analyses by Alex Goldenberg and Matthew Wein further mapped how war-focused markets could be weaponized and explored regulatory responses.

However, the true dawn of Betting Intelligence (BETINT) where media, policymakers, and the public turned to prediction markets as a primary source for geopolitical tracking arrived with the buildup and anticipation of a U.S. strike on Iran.

Chart via internal systems showing Iran strike markets. Size of the data bubble denotes the size of the bet placed. Note times in UTC (6AM UTC = 1AM ET)

For weeks, traders and observers watched markets asking whether and when the United States would act. Prices oscillated through multiple false starts. Then, around 11:30PM EST the evening before the strike, relevant Iran markets began climbing sharply. Public confirmation did not begin circulating until approximately 1:15AM on February 28.

That 90+ minute window marked a paradigm shift: market participants held the information long before newsrooms did. Yet, the ensuing commentary remained reductionist, centering primarily on two questions: “Who were the insiders?” and “Are these markets a net positive or negative?” (though let us compliment Aaron Courtney’s thorough layout of those elements and Rajiv Sethi’s look into how these markets treat the idea of profiting off of violence). These are necessary questions but there is even more to talk about with the market information.

These markets revealed far more than potential insider activity. They provided structured, time-stamped, incentive-layered data about expectations, positioning, and second-order risks. What we hope to do with this paper is provide a primer for decision makers who want to move toward disciplined interpretation of this data source.

What follows is a primer on the core operating principles of Betting Intelligence (BETINT). These are the foundational lenses we use when interpreting prediction markets in real-world crises.

Each principle can be read independently. Taken together, they form the early architecture of a broader research agenda - one that treats markets as structured, incentive-layered intelligence systems.

1. Start With the Question, Not the Data

Jumping into prediction market data without a clearly defined goal is a fundamental analytic error. Like any scientific or intelligence enterprise, Betting Intelligence (BETINT) requires a structured starting point. With tens of thousands of non-sports event contracts now live across various platforms, an analyst without a hypothesis will quickly drown in noise. Without a specific threat model or a clear understanding of your organizational exposure, the data is just a Rorschach test where you will simply see what you want to see.

Not every decision-maker cares about the same signals. If you are at FinCEN or the DOJ, your focus may be on insider identification and prosecution. If you are in the petroleum industry, you are likely searching for early indicators of kinetic events that move crude prices. If you are in defense, you may care more about operational timing and cascading retaliation, while a finance lead might prioritize volatility transmission across asset classes.

Different questions require different tradecraft. One field to turn to for possibilities is how intelligence professionals utilize structured analytical techniques like the Analysis of Competing Hypotheses (ACH) to remain objective. For example, if a single wallet wins $3 million on a geopolitical strike, you must weigh competing explanations: was it genuine insider knowledge, or was it a result of high-conviction open-source analysis, simple luck, wash trading, or even “signal jamming” (which we talk about more in later sections)?

By defining your hypotheses and the criteria for confirming them before touching the data, you avoid the lazy analysis of assuming every big winner is a mole. Other intelligence analysis methodologies and decision analysis tools can then be used to confirm or deny these theories but what matters is that you define hypotheses, classification criteria, and potential response actions before you immerse yourself in the data. Define the hypotheses first; only then do you collect the data.

2. Read the Rules. Every Word.

Market wording can be identical across platforms while tracking fundamentally different risks. The “Will Ayatollah Khamenei leave office?” contracts illustrate this: Polymarket allowed resolution via death, while Kalshi explicitly excluded it to avoid being classified as an “assassination market“. Because bettors prioritize profit, a Kalshi trader will not price in a kinetic resolution if the platform won’t pay out for it. Consequently, you cannot treat the data from these two platforms as a 1-to-1 comparison of the same reality.

And since we are on the subject of semantics, ambiguous wording creates both analytical distortion and legal exposure. This ambiguity creates incongruity of interpretation as different traders may connote the same contract differently. We foresee a future where specialized litigators exploit these linguistic loopholes for class action lawsuits. Controversial resolutions (like those surrounding Zelensky’s attire or Cardi B’s Super Bowl “performance”) are precursors to class-action lawsuits. When lawyers begin hunting for semantic ambiguities, the threat of litigation will force platforms to tighten rules, but until then, the “fog of the rules” remains a primary analytical hurdle.

3. Poly-Pump Fakes & Alarm Fatigue

In the weeks leading up to the February 28th strike, the information environment was defined by a series of false starts. Since mid-January, media chatter and prediction market spikes repeatedly suggested an attack was imminent, only for the odds to sharply deflate.

This scenario opens up for a technique we’ve previously written about called the Poly-Pump Fake, a technique where an actor seeks to create a false consensus by leveraging multiple information sources to profit from the resulting market volatility. While we don’t have confirmation that this was a deliberate White House directive, the tactical utility of such a maneuver in a monetized reality is undeniable.

This iteration of the Poly-Pump Fake leverages the same mechanics we’ve previously analyzed but shifts its objective to repeatedly pump faking the audience until it is time to actually go through with the action. By repeatedly triggering the market “alarm” without an ensuing “strike,” an actor induces alarm fatigue which is a phenomenon where the sheer frequency of alerts causes observers to become desensitized. Much like healthcare workers who eventually ignore critical monitors due to constant false positives, bettors and analysts habituated to “false starts” become the perfect victims of strategic surprise.

The hypothetical Poly-Pump Fake in this scenario has some other interesting elements to consider:

• Narrative Weaponization: Repeated delays reinforced the “TACO” (Trump Always Chickens Out) narrative. Traders and analysts began to bake “inaction” into the price, assuming the administration was merely posturing about attacking.

• Tactical Stealth: When Operation Epic Fury finally launched, the initial market movement was met with skepticism. Retail traders and betting intelligence analysts, conditioned by previous pump fakes, hesitated to react thus widening the window of tactical surprise for operational actors on the ground.

By keeping volatility just below the threshold of serious attention, a sophisticated actor can “cry wolf” until the adversary and the market stops listening. Sometimes volatility can be the ultimate camouflage.

4. Timing Often Matters More Than The Odds

In the Iran strike markets, price movements told only part of the story. Timing told the rest. Around 11:30 PM EST on February 27th, we observed a clustering of heavy, high-conviction “Yes” bets.

Screenshot from our own internal tool showing the timing of the volume of # of traders and the money volume for these Iran strike markets.

In national security and supply chain security, a 90 minute window can provide the lead time necessary for:

• Asset Protection: Repositioning high-value personnel or hardening digital infrastructure against retaliatory cyberattacks.

• Information Maneuver: Preparing a pre-emptive counter-narrative or a “rally around the flag” message before the adversary can frame the strike.

• Operational Security: Identifying potential leaks by tracing the exact moment conviction entered the market relative to internal briefing cycles.

Remember that while the price/odds are likely the most important indicator for traders looking to profit, the “when” is usually much more important when it comes to actionable betting intelligence.

5. Don’t Ignore the Losing Side: Signal Jamming

A common analytical trap is focusing exclusively on the winning “Yes” bets. However, looking at the “losing” side is often more instructive for identifying counter-intelligence efforts and market manipulation.

During the Iran strike buildup, we noticed many big “No” bets coming in about 5 hours before the market resolved to “Yes” (see screenshot from the Intro section) and we tracked a single position of over $1.4 million betting “No” on an imminent strike (see picture above). In a vacuum, this looks like a trader making a massive, incorrect bet (which it may very well be) but in an intelligence context, it forced our team to consider that it could be a technique our team calls Signal Jamming.

Just as electronic warfare units jam radar to mask a physical advance, a sophisticated actor can place massive, counter-intuitive bets to disrupt the market signal. When a government or insider has foreknowledge of a resolution, they have a powerful incentive to defray and obfuscate the BETINT value that other “sharps” might be extracting. Signal Jamming intentionally loses capital by flooding the order book and driving the price away from the market result a group is intending to happen. This serves to:

• Mask Insiders: Dilute the impact of true insider “Yes” bets to prevent the price from moving too early and alerting adversaries.

• Create Narrative Confusion: Mislead OSINT analysts, newsrooms, and competitors into believing the strike has been called off.

• Economic Sabotage: Wipe out retail traders or opposing “sharks” who follow the “big money” into a trap.

We are only scratching the surface of this concept of signal jamming and we are considering making a longer article similar to our Poly-Pump Fake article to more fully explain it.

6. Not Every Insider is a Whale

When traders spot a suspiciously large position, the instinct is to assume the wallet belongs to an insider. However, the most sophisticated actors know how to hide their edge.

Polymarket’s most powerful differentiator from any betting platform that came before it is the fact that one person can have an unlimited amount of wallets linked to polymarket profiles. Practically, that means that a true insider could spread out their inside bet across 10, 50, 100+ wallets if they prioritize privacy which means a true insider can spread a million-dollar bet across hundreds of wallets. This is a form of insider trading that simple whale tracking systems are not built for but expect to see more “schools of minnow” in the near future after enough whales get caught.

Conversely, we must challenge the assumption that all insiders are high-net-worth oligarchs or executives. Insiders are often “everyday” individuals like a helicopter pilot, a low-level clerk, or a barracks technician who lack the capital to move the market but possess definitive operational knowledge.

Consider a servicemember who knows a strike is coming. They may not have $50,000 to wager, but they might deploy $500 through a cousin’s crypto wallet or a proxy account. While these “micro-bets” don’t shift the odds, they represent a significant moral and security failure. Betting that individuals will succumb to the “greed devil” is a more productive intelligence posture than assuming perfect institutional integrity.

7. Not Every Winner Is an Insider

While we have a proven track record of identifying genuine insider trading (see our work tracking the same insiders that led to Israeli authorities’ arresting IDF soldiers or the Institute for the Study of War (ISW) manipulated maps case), blanketly labeling every large winner an “insider” is lazy analysis.

The Iran strike scenario possessed a high Visibility Index, a composite metric we use to track open interest alongside media and social discourse frequency. High visibility naturally invites heavy retail participation and high-conviction “sharps” who synthesize open-source data more effectively than the average observer. When a scenario has weeks of mainstream buildup, the probability of “retail” being the primary driver increases.

Distinguishing between a lucky trader and a mole requires tradecraft that moves past basic blockchain tracing into behavioral profiling and attribution. To assess insider probability, we utilize a multi-variable assessment:

• Media Visibility Metrics: Does the trade timing correlate with media and public discourse spikes?

• Volume and Liquidity Depth: Did the trade “crash” the price or fill naturally within existing depth?

• Unique Trader Counts: Was the price moved by a “crowd” or a coordinated “cluster”?

• Cross-Platform Price Convergence: Do regulated and offshore prices align, or is one “leading” the other?

• Historical Performance: Does the wallet consistently “guess” correctly across unrelated geopolitical events?

While we are developing advanced attribution tools for our platform to map wallets to persons, the immediate lesson for the decision-maker is caution: market visibility often explains what looks like an “inside” edge.

8. Mapping Correlating Markets Before They Happen

A common mistake in interpreting prediction markets is treating each event as isolated rather than as a node in a network of cross-correlated markets. After the Iran strike, for example, correlated markets moved in the Strait of Hormuz, oil-linked contracts, Bitcoin pricing, and even how many times Elon Musk will tweet this week.

Serious BETINT practitioners should aim to pre-map likely second- and third-order markets before a primary event resolves. We are currently developing tools to identify and test cross-market correlations and causality where we overlay multiple layers: open interest, cross-platform pricing, media chatter, and historical response patterns. The resulting correlation maps highlight which markets are likely reactionary, which are predictive, and where anomalies suggest potential insider influence or strategic manipulation. By structuring these dependencies in advance, analysts move from reactive observation to predictive insight, translating raw market data into forward-looking intelligence.

9. New Market Creation Is Signal

Markets rarely appear randomly; they are typically timed around anticipated events, insider knowledge, or heightened public interest. When a new contract appears, the first analytical question must be “Why now?”.

Months ago, the “Will Israel attack Yemen?“ market appeared roughly one week before real-world operations began. The creation timestamp and the speed at which liquidity filled were indicators we paid attention to on top of when we started to see insider betting action.

“When” the markets are created will become even more critical with the rise of permissionless markets, which are platforms where any user (not just the prediction market operator) can deploy a question if they provide the liquidity. Polymarket developers have already alluded to this shift, and some traders have claimed early access. Suffice it to say that Polymarket offering permissionless markets would lead to the same kinds of threats mentioned in headlines about prediction markets coming to a neighborhood near you.

Polymarket currently does list the date each market is created, including different time horizons on the same event. Pay close attention to these timestamps as valuable data.

10. Account for the Cultural and Spiritual Artifacts

Human behavior often follows cultural logic and dates matter. The strike on Iran coincided with the Jewish holiday of Purim; North Korea launching intercontinental ballistic missiles on July 4th, and our team has noted that President Trump has frequently announced/conducted major initiatives on Fridays after the stock market has closed.

Rationality is culturally bounded and why people do certain actions or choose certain days to do something could be with a logic that is wrapped up in cultural or spiritual reasons and it is on the betting intelligence analyst to be aware of these elements to best model/predict what could happen. Ignoring these artifacts risks misreading signals (even if they are seen as “superstitious”), while incorporating them allows analysts to detect subtle cues embedded in price movements and emerging contracts.

11. Cross-Platform & Demographic Intelligence

Kalshi and Polymarket dominate English discourse, but platform ecosystems are fragmenting.

Users migrate based on incentives. Emerging platforms will cater to specific cultural, political, or demographic niches. Over time, attribution and demographic profiling will mature beyond self-reporting.

Future BETINT will involve:

• Cross-platform arbitrage analysis

• Demographic inference modeling

• Geographic wallet clustering

• Monitoring offshore and privacy-enhanced platforms

Each platform is a sensor. The closer the sensor is to the population you care about, the stronger the signal. Assuming today’s top prediction market platforms remain dominant is strategically naive.

Conclusion: As Dawn Breaks

The dawn of Betting Intelligence marks a fundamental shift in how information flows, decisions are made, and risks are assessed. Even two years ago, cable news was seen as the slower news source that people used to double check if something they saw online was real.

Today, prediction markets have become the primary source for real-time tracking, while online news sources are relegated to the role of lagging validators. For this shift to fully materialize, decision-makers and the public must become fluent in what Betting Intelligence can reveal.

This fluency is also a call for competency in seeing prediction markets for what they truly are in the context of geopolitics: a non-kinetic weapon. Experts in national security treat the information environment (which includes online social media) as a battlespace where wars are won or lost (see this paper by J.D. Maddox for an overview on this framing). In this frame, prediction markets act like a sniper’s laser scope; directing attention to specific actors, topics, or signals to extract information or leverage for profit. Today, these “scopes” focus on adversaries like Iran or China, but permissionless platforms will inevitably turn them inward. Imagine markets predicting when and where the next mass shooting or school shooting will occur in the U.S.; that’s a horrifying yet plausible future.

The ultimate trajectory of prediction markets is clear from Kalshi’s CEO: to “financialize everything.”

Much as the internet has absorbed all facets of information, prediction markets are poised to absorb reality itself. By developing fluency in Betting Intelligence, analysts, policymakers, and enterprise leaders can move from reactive observation to anticipatory insight, transforming raw market activity into actionable intelligence and, ultimately, a sharper understanding of the world before it unfolds. You reading this far is hopefully another step towards that better future.

Prediction markets were supposed to make the world smarter. The pitch was that by attaching real stakes to uncertain events, markets would reward those who sought truth, punish those who guessed, and when prediction markets scale up to the masses, they would produce an infrastructure of radical transparency.

We suspect that this was the thinking that these markets would foster an efficient, collective search for truth is what motivated partnerships that both CNN and CNBC now have with Kalshi.

However, this rose-colored pitch fails to account for the core mechanic of profit for prediction markets:

Prediction markets don’t reward truth; they reward those who shape the momentum of truth.

It doesn’t matter if what ends up being believed is the “truth” or not. Markets measure consensus; they do not measure the absolute truth.

We discussed in our previous work that as the U.S. economy begins to migrate from transactional purchases to purchasing probabilities (hypergamblification) and how there is a race for these companies to try to turn every conceptual category of life into a betting opportunity (what we called “monetized reality” but also encapsulated in Kalshi CEO Tarek Mansour to “financialize everything”).

As this system overlays the economy, profound incentives appear. For traders, the profit motive dictates strategy: they will pursue any tactic that moves the odds. Profit is realized when the odds shift favorably, and since this price action can be driven by factors other than the event’s true resolution before the market closes, accuracy is secondary to influence.

And this is where the critical insight emerges: in an economy increasingly built on gamblified incentive loops, the greatest profits will flow to those who can shape beliefs across different populations. This is the context for what we call in this paper the Poly-Pump Fake and this is a technique that depends on a crucial distinction between two fundamental concepts: accuracy and confidence.

II. Accuracy Versus Confidence: Why Markets Mistake Conviction for Truth

Prediction markets measure the intensity of belief, not the correctness of belief. They aggregate collective conviction efficiently, but this is not a guarantee that the resulting confidence is justified. This is why so-called “bonds” in prediction markets (a term used by the PM community for markets trading with probabilities between 80% and 95%) are not a guarantee of resolution, as many might assume.

The structural weakness of relying on confidence is famously documented in intelligence analysis. Chapter 5 of The Psychology of Intelligence Analysis shows that as analysts receive more information, their confidence in their conclusions often rises sharply, while their actual accuracy barely moves.

One example from the chapter describes horse-race experts where they grow more certain about their picks as they gather more data, but their win rate remains flat.

For the market manipulator, this Accuracy vs. Confidence distinction provides two primary avenues of attack:

1. Manipulating Accuracy (Kinetic or Direct Non-Kinetic Intervention): This involves taking an active hand in changing how an event will resolve.

   
   As we have explored in our papers on Assassination Semantics and The Importance of Understanding Non-Kinetic Intervention, this ranges from costly “kinetic interventions” (violence, direct action) to forms of “non-kinetic intervention” where a participant with access directly influences the outcome (e.g., bribing a referee, influencing a policy decision).

   
   Another recent example comes days ago of this paper’s publishing with the capture of Nicolás Maduro by U.S. forces (Operation Absolute Resolve) where Polymarket’s on-chain data shows at least three “insider” wallets that made over $630,000 on Polymarket by betting on his ouster when odds were at just 6%.
   

2. Manipulating Confidence (Indirect Non-Kinetic Intervention): This involves changing people’s beliefs about reality, which is almost exclusively achieved through non-kinetic means targeting the information ecosystem. This is about manufacturing the consensus that drives the trade.
   
   Consider Bill Ackman’s infamous 2020 TV appearance: while he spent nearly half an hour stoking public panic over the impending economic devastation of COVID-19, his fund sat on a massive $27 million bet that the markets would collapse. The resulting sell-off transformed that position into a staggering $2.6 billion profit, proving that in a panic, the person who defines the nightmare owns the market.

This second category where the manipulation of confidence induces a profitable trade will be the focus of this paper and is the operational core of the ‘Poly-Pump Fake’.

III. The Poly-Pump Fake: Convergence of Classic Market Manipulation Techniques

The Poly-Pump Fake is not a revolutionary concept; rather, it is a sophisticated convergence of four tried-and-true internet-age market manipulation strategies tailored for the hyper-liquidity of prediction markets.

We have named it the Poly-Pump Fake (a term we use without prejudice toward any specific platform) because of the multi-dimensional complexity of the attack. The “Poly” acknowledges that a successful manipulation requires multiple information channels to be “pumped” simultaneously to create a false but profitable consensus.

The concept draws its structure from four distinct progenitors of online influence:

1. Political Disinformation for Profit (The Macedonian Model): In 2016, teenagers in Macedonia created sensationalist political narratives (such as the “Pope Endorses Trump” hoax) not out of ideological conviction, but purely to drive Facebook traffic and AdSense clickthrough revenue and profiting handsomely in the process. This is also the model that people who accuse certain parties of being a “grifter” are believed to be operating where the media personality doesn’t believe or care what they say as long as it is profitable with their audience. In both cases, the goal isn’t to change the world, but to profit from the friction created by a polarized public.
   

2. Stock Market Head Fakes: This involves the use of fabricated content (hacked accounts, deepfakes, or fake press releases) to create artificial market signals. The goal is to generate rapid, short-term volatility based on false information, allowing the manipulator to enter or exit a profitable position before the deception is exposed. Here are four examples:
   

   1. The 2013 AP Hack: A single hacked tweet from the Associated Press claiming an explosion at the White House had injured President Obama caused a 143-point drop in the Dow Jones in seconds.
      
      

   2. The 2022 Eli Lilly Hoax: A parody “verified” account tweeting that “insulin is free now” erased $15 billion of the company’s market cap in hours.
      
      

   3. The 2023 Pentagon Deepfake: An AI-generated image of an explosion near the Pentagon briefly tanked the S&P 500, illustrating how synthetic media can trigger algorithmic sell-offs before the truth can catch up.
      
      

3. Sports Betting Head Fakes: Professional betting syndicates have long used “head fakes“ where they plant rumors or what people believe to be inside information to move a betting line. By influencing the public’s perceived knowledge, they shift the odds to a favorable entry point before the truth is revealed. Conversations with sportsbook operators reveal a constant “cat-and-mouse” game against these sophisticated groups that trade on noise rather than news.
   

4. The Crypto “Rug Pull” and “Pump and Dump”: The world of alternative cryptocurrencies likely provides the most relevant blueprint for the Poly-Pump Fake because many people coming into the prediction market space come directly from the cryptocurrency and NFT world. Using many means to get attention and belief towards their projects, crypto influencers hype a token (see the ill-fated Squid Game (SQUID) coin or the recent Hawk Tuah ($HAWK) coin) to drive up the price through manufactured “fear of missing out” (FOMO). Once the market hits peak confidence, the insiders dump their holdings (the “rug pull”), leaving retail investors with worthless assets.

The Poly-Pump Fake is the natural evolution of these strategies.

It is a politically agnostic operation that seeks to create a false consensus by leveraging multiple sources to profit from the resulting volatility.

We have already seen the first tremors of this kind of technique: the November 2025 “Institute for the Study of War Map Manipulation“ incident, where an unauthorized edit to a frontline map briefly showed the capture of Myrnohrad, triggered a $1.3 million payout on Polymarket before the correction was issued.

Even following the recent capture of Nicolás Maduro, we have seen people trying to capitalize on the attention of these geopolitical prediction markets by trying to come off as an insider putting down a lot of money (like on China capturing Taiwan before the end of 2026) and trying to get other bettors to copy-trade in order to try to pump up the market prices.

If this seems overwhelming right now, we want to point out that we are still at the VERY beginning of the potential of the Poly-Pump Fake with the main catalyst for the bigger explosion going to be the ever improving nature of generative AI.

IV. Generative AI: The “Splitting of the Atom” for the Poly-Pump Fake

While the Pentagon deepfake and recent crypto “rug pulls” utilize AI, they remain largely “hand-spun” operations. As AI capabilities evolve, the friction of human oversight is being removed. A single actor can now deploy a synthetic crowd to manufacture market confidence at scale through the following methods:

1. Persona Multiplexing: Using Multimodal LLMs to generate thousands of unique, context-aware social media accounts, “independent” blogs, and forged documents. These synthetic voices act in concert to echo a market-moving narrative, creating a false sense of consensus that is nearly impossible to distinguish from genuine grassroots belief.
   

2. High-Fidelity Forgery: The 2013 AP hack relied on a simple text tweet; the 2023 Pentagon deepfake was a crude image. Today, generative audio and video can simulate a “leaked” briefing or a “live” incident report with enough fidelity to trigger high-frequency algorithmic trading before human fact-checkers can even begin to investigate.
   

3. Weaponizing the “Fog of War”: AI doesn’t simply spread blatant lies; it creates plausible noise in information vacuums. During active kinetic conflicts where bullets and bombs can make verified reporting difficult, the public and the 24-hour news cycle refuse to accept silence. In these moments of peak uncertainty, bettors crave any “insider” signal they can find to possibly profit off of. AI is uniquely suited to fill this vacuum with hyper-realistic, fabricated intelligence that feels authoritative, allowing a manipulator to plant a rumor that “sticks” simply because it is the only information available in the chaos.

V. Incentivized Insurgency: The Geopolitical Worst-Case Scenarios

The convergence of Generative AI and prediction markets creates a “Splitting of the Atom” moment for national security because it financializes the anticipation of tragedy. We are moving toward a reality where attackers do not just seek to destroy; they seek to harvest the volatility they create.

1. The “Trading on Terror” Precedent: History provides a grim blueprint for this. Following the October 7, 2023, attacks on Israel, researchers Robert J. Jackson Jr. and Joshua Mitts documented a massive, “extraordinary” surge in short-selling of Israeli ETFs and stocks just days prior. On October 2, short-selling volume in the MSCI Israel ETF (EIS) shot up to nearly 100% of off-exchange volume which exceeded the activity seen during the 2008 financial crisis or the COVID-19 pandemic.

In a Poly-Pump Fake scenario, an attacker could use AI to amplify this profit. By “pumping” a narrative of regional peace or stability across social media, they can artificially depress the price of “Attack Occurs” shares. They buy the “Yes” shares at a discount while the world is distracted by a synthetic calm or sustained uncertainty of what’s going on, then execute the kinetic strike. The market doesn’t just predict the event, it funds the perpetrator.

2. The Reverse Pump: The “Cry Wolf” Exploit: Conversely, the Poly-Pump Fake can be used to manufacture “Pearl Harbor” moments that never happen. By using high-fidelity deepfakes and persona multiplexing to simulate a credible, imminent threat to US soil, an actor can spike the price of “Attack on US” markets. They exit their positions at peak panic, realizing massive gains from a crisis that was entirely hallucinatory. This creates a “Cry Wolf” effect that degrades the signal-to-noise ratio for actual intelligence agencies relying on OSINT, making the public and the markets numb to real warnings (see the phenomenon of “alarm fatigue”).

3. The Rise of Offshore “Attack Markets” on the U.S.: Recent cases of “insider betting” on military strikes have largely involved US or allied actions against foreign targets. However, we must prepare for a future where these markets focus on kinetic strikes against the United States. While US-regulated platforms like Kalshi enforce strict KYC (Know Your Customer) mandates under CFTC oversight, the global landscape is shifting toward total obfuscation. Even on platforms like Polymarket (where international users trade without KYC), the public nature of the blockchain allows for chain analysis that can eventually link a wallet to an identity. To circumvent this, the next generation of “Attack Markets” is migrating toward deeper layers of the stack:

• Total Anonymity via Privacy Coins: Expect to see a shift toward decentralized platforms that utilize privacy-focused assets like Monero (XMR) and Zcash (ZEC). These tokens use ring signatures and zero-knowledge proofs (zk-SNARKs) to hide transaction amounts and participant identities, making traditional financial forensics impossible.

• The Deep-Web Convergence: Betting platforms are increasingly running adjacent to dark-web marketplaces. By hosting these markets on Onion-routed servers (Tor) and utilizing decentralized oracles, adversaries can create a liquid, anonymous betting markets that essentially run like a bounty system for US national security failures.
  
  

• Insider Intelligence as a Weapon: We have been fortunate that our adversaries have not yet fully weaponized “Betting Intelligence” (BETINT) on these insider bets around US-led military attacks. But when nation-states begin monitoring these signals to front-run US military responses, it puts the lives of our soldiers in immediate, quantifiable danger.

While a profitable “9/11” or “Pearl Harbor” market opportunity has not yet reached full scale, the infrastructure is already operational (as explored in our previous Semantic Assassination paper). As our economy and reality become further “gamblified,” these US attack markets will become increasingly more local and specific.

VI. Establishing Frameworks for Assessing the Threat

To counter the Poly-Pump Fake and its associated non-kinetic interventions, national security agencies require a formalized architecture, ideally a BETINT (Betting Intelligence) Framework similar to the MITRE ATT&CK matrix for cyber threats. While this field of study is still nascent and we encourage grant agencies to fund more study around betting market mechanisms, BetBreakingNews is actively working on codifying the methodology used by adversarial actors to exploit the “Confidence-Accuracy Gap.”

Specifically with the Poly-Pump Fake in mind, an ideal model for assessing the risk of an attempt would likely combine two core analytical structures: a Trust/Influence Chain and a Market Vulnerability Score.

Potential Framework Components:

• The ATHENA Kill Chain (Trust and Influence): BetBreakingNews CEO Sean Guillory published this model that focuses on how adversarial actors establish influence over a target using AI. The phases (Access → Trust → Hook → Enrage/Entice → Normalize → Action) map directly onto the psychological steps required to get a betting community to accept a false narrative and act on it. When it comes to betting markets: the ATHENA Kill Chain maps the psychological and operational steps required to hijack a betting community’s conviction:

• Access & Trust: The manipulator doesn’t just “post”; they embed. Using Persona Multiplexing, they bypass “bullshit detectors” by building long-term credibility or compromising existing trusted nodes.

• The Hook & Enticement: During a “Fog of War“ event, the actor introduces a high-fidelity signal (e.g., a deepfake “leak”). This appeals to the trader’s desire to be “first” and “right”.

• Normalize & Action: Once the market moves, the price action itself becomes a “proof of truth,” creating a feedback loop that entices the broader public to “buy the pump” while the manipulator prepares their exit.

• Market Vulnerability Factors: Andrew Courtney’s work on assessing the riskiness of a market identifies factors that expose a market to manipulation, including: Wide public interest (25%), Social usefulness of probability (20%), Breadth of information surface (10%), Resistance to manipulation (10%), Clear resolution criteria (10%), Hedge utility (10%), Market uniqueness (5%), Right level of difficulty / randomness (5%), and Useful path volatility (5%). An effective framework must leverage factors like these to identify high-value, high-risk targets.

Core Elements of Poly-Pump Fake Analysis:

Beyond the above mentioned frameworks, an effective operational model for conducting, assessing, or mitigating a Poly-Pump Fake must include the following critical components:

1. Goal and Audience Profiling: The attacker must understand more than just “making money.” They must profile the target betting community like what are the sources they trust, what are the topics they find plausible, and which groups (demographics, political leaning) do they deem as easy to trick, often out of spite or prejudice?

2. Information Exchange Access: Success is dependent on finding access to the community’s information exchange spaces (e.g. online forums, messenger groups, publications, or even real-life clubs). The attacker must gain access to where people trust receiving and sharing information, even if they harbor skepticism about certain parts of it.

3. Trust-Building and Staking: This is the phase that takes the longest. The attacker must conduct sufficient legwork to either become a trusted source within the community or gain the trust of the main influencers. Success is achieved when one knows exactly what messages will be believed, which channels and sources to push the information through, and when the market will react.

4. Exit Strategy: Any model must consider a clean egress from both the market and potentially the community. If the established alias staked its reputation on the false information, an immediate exit from the market and the digital community is a mandatory contingency.

VII. Conclusion: How BETINT Can Help

In a world where everything is a bet, everyone is a participant, and all information has price impact, the most profitable strategy is no longer predicting the truth; it’s shaping the consensus long enough to profit from the wave you created in the “fog”.

As we have seen, the “Truth Machine” pitch of these prediction market platforms fails the moment an adversary realizes they don’t have to be right; they only have to move people. Truth pays eventually, but confidence pays immediately.

The infrastructure for an “Incentivized Insurgency” is already operational. From the Macedonian Model to potential Offshore Attack Markets running on Monero and Onion-routed servers, the threat to US national security is no longer theoretical. If we do not develop robust BETINT capabilities to track the coordinated movement of price, sentiment, and synthetic persona credibility, we leave our economic and kinetic security at the mercy of those who can pull off a successful Poly-Pump Fake.

BetBreakingNews is actively developing countermeasures and specialized workshop materials for government organizations, NGOs, and platforms. Understanding that we are living in a monetized reality is the first step; securing that reality is the next.

Betting Intelligence (BETINT): The use of betting market behavior as an intelligence signal of intent, insider knowledge, and pending real-world action.

This new form of intelligence collection joins a family of' ‘INTs’, such as SIGINT, OSINT, HUMINT, VISINT, and more.

As the world rapidly evolves into a global casino, the need for warning intelligence only rises.

Join us here in our mission to collect, uncover, analyze, and distribute BETINT across the modern world.

Why Betting Data Matters

Betting intelligence is more than odds, volume, or profit and loss sheets. It is the heartbeat of a platform: who bets, when, at what stake, on which outcomes. That data can be very dangerous in the wrong hands.

Consider the type of folks who might want that data. Competitors and insiders are eager to detect emerging trends before the public or before markets adjust, using that early signal to front-run or recalibrate their own models. State actors might seek to map the networks behind a market: identifying sharp bettors, reverse-engineering predictive models, or pinpointing structural vulnerabilities. And then there are malicious actors, who could breach, extort, or manipulate the system by leaking identities, placing insider trades, or injecting disinformation to distort outcomes. All of them recognize the same thing: betting data isn’t just a reflection of opinion, it’s actionable intelligence, and that makes it a target.

And don’t think that a blockchain or TLS encryption is the silver bullet of protection when the modus operandi for threat actors is shifting to “Harvest now, decrypt later”. Adversaries intercept and store encrypted traffic today, waiting for quantum computers to break it in the future. Chinese and U.S. labs have already made strides in quantum decryption: see reports on China breaking RSA-like codes and the push to quantum-resistant systems. This is not speculative, cryptographic primitives once considered safe are being challenged, and legacy systems are vulnerable to retrospective decryption.

And note that casinos and betting institutions are currently on the radars of threat actors looking for a payday. Hacks at major casinos such as Caesars Palace or MGM show that systems thought protected can still be breached. If trading records, bettor identities, or internal algorithms leak, w, regulatory exposure, and possibly personal risk to insiders.

When betting platforms ignore the value of their data, they are handing over their strategic backbone. As the world begins to treat BETINT as an intelligence asset, attackers will elevate their methods. Platforms must anticipate, not react.

GABRL as a Defense Layer for BETINT Systems

When I first encountered GABRL, it struck me as unusually well aligned to the risks that prediction markets face. Born from national security thinking, GABRL offers a network-layer security solution that many platforms currently lack.

GABRL encrypts traffic at Layer 3 (the network layer), so every packet between endpoints, apps, APIs, and devices is protected — not just the ones that speak TLS or sit behind VPNs. In contrast to many tools that focus at the application layer, GABRL minimizes the “attack surface” by securing everything at a deeper level.

It is Post-Quantum Cryptography (PQC) compliant, meaning it uses algorithms designed to resist quantum decryption. That is exactly the kind of foresight a betting platform needs: if adversaries are storing traffic today, GABRL helps ensure they can’t break it later.

It works across infrastructure types — bare metal, cloud, hybrid, fragmented architectures — and can coexist with existing VPNs or replace them seamlessly. Because of its network-level design, latency overhead is minimal and scaling is efficient. An additional camouflage dimension: traffic obfuscation / spoofing. To outside observers, protected traffic can mimic innocuous flows (Zoom, video, generic streams) to reduce detection risk.

Currently, GABRL is licensed for use by U.S. entities under ITAR restrictions. Non-U.S. platforms may need alternative but analogous solutions — feel free to reach out to us for guidance. When I saw GABRL in action, the first vertical I thought of was betting and casino platforms — not just for protecting financial and transactional data, but because the intelligence layer (betting metadata, VIP flows, sharp bettor patterns) is exactly what adversaries target. In short: GABRL was built for high-stakes, high-risk environments, and betting fits that mold perfectly.

Why Platforms Must Act Now

The world of prediction markets is no longer nascent. With platforms like Polymarket recently valued in the billions, the competitive stakes are rising. As the conversation around BETINT matures, so too will the threats. At BetBreakingNews, we argue that every serious platform should not only build new markets, but also build defenses. That’s why we emphasize roles like a Global Risk Officer (as we discussed in Assassination Semantics) — someone whose job is to worry about data threats before they become crises.

We don’t want to be the functionaries of fear — we want the field to succeed. The global event betting ecosystem has potential for huge insight, innovation, and social impact. But it will collapse if data is harvested, trades are manipulated, or insiders are exposed. That’s why we introduce tools like GABRL: not to stifle growth, but to protect it.

If you run a prediction market, sportsbook, casino, or any platform handling predictive data flows, here are key priorities:

• Make data security a board-level imperative. Having encryption is not enough; you need leadership with cryptographic literacy and threat awareness.
  
  

• Audit your architecture deeply. Which endpoints are exposed? What traffic is recorded? What happens if someone decrypts your past logs?
  
  

• Deploy quantum-resistant solutions now (like GABRL) rather than later. In the U.S., GABRL is production-ready; globally, look for equivalent alternatives or partnerships.
  
  

• Prepare to partner with security and national-security experts. Betting groups rarely have full in-house cryptographic or threat modeling depth — collaboration is essential.
  
  

If you’re building a market, a data product, or an intelligence pipeline around prediction, you can’t afford to ignore the data threats — especially those evolving from quantum advances. GABRL is not the only answer. It won’t stop every hack or manipulation. But it is precisely the kind of technology serious platforms should adopt before the next wave of threats hits.

If you want to talk through how GABRL or related defenses could integrate into your architecture or strategy, drop me a message at betbreakingnews@protonmail.com . This isn’t hype. It’s about protecting value — yours, your users’, and the future of predictive markets.