Design and scope

We use a qualitative, purposive case design to examine mechanisms, not to estimate prevalence. Six trading episodes concern Venezuela, Iran, Ukraine, Russia, France, and Hungary, and two further illustrations concern contract wording and settlement rules. The case material covers November 2025–May 2026. A case was included if it was relevant to information use, settlement integrity, or attribution and had an identifiable documentary source. Selection was exploratory, with no systematic search denominator or exhaustive log of exclusions.

The analysis distinguishes episodes, markets, and addresses. It covers seven individually specified binary markets in the Venezuelan, Iranian, Ukrainian, and Hungarian episodes, a Russian market described in reporting, and French temperature contracts linked to two event dates. The two contract-design illustrations concern separate binary questions. For the Russian and French cases, we analyse the reported mechanism rather than individual trades.

Independent trading analysis covers the Venezuelan account identified in a regulatory complaint, five Iranian accounts named in reporting, one Hungarian proxy wallet, and twenty-eight Ukrainian addresses that bought in the focal interval. The Venezuelan dataset comprises nineteen activity records: thirteen purchases, two sales, and four redemptions; the Iranian accounts made 190 purchases in the focal market. Hungarian data comprise 145 activity records (141 of them trades), one closed-position record, and four Polygon transfers documenting funding and withdrawals. For Ukraine, the dataset comprises 1,196 price observations and 2,000 retrieved trade records, of which 115 purchases meet the focal filter.

Sources and procedures

Market data come from Polymarket’s (2026) application programming interfaces (APIs) and from Polygon transaction records. The Gamma API supplies market descriptions and identifiers, the central limit order book (CLOB) endpoint supplies price history, and the Data API supplies trades and account activity; Polygon records document transfers. API records are a historical extract and remain subject to changes in indexing and pagination, whereas ledger records provide transaction evidence. Amounts are denominated in USD Coin Ethereum/Bridged (USDC.e), a stablecoin pegged to the US dollar.

All analytical times are in Greenwich Mean Time/coordinated universal time (UTC), and prices are used without interpolation. Ukrainian trades are filtered to purchases (side BUY) of the YES outcome on 6 March 2026, from 16:05:00 inclusive to 16:11:00 exclusive. Records identical in transaction hash, wallet, asset, side, size, price, and timestamp are collapsed, which leaves 1,974 of the 2,000 records; none of the twenty-six collapsed records meets the focal filter. Price history covers 00:00–20:00 UTC on 6 March 2026 at fidelity = 1, and four pages of 500 records each. Hungarian activity covers 8–24 April 2026 (limit = 500, offset = 0), and the activity of twenty-eight Ukrainian addresses covers 1 February–1 April 2026 in pages of 500 records; four of them exceeded the record limit of that endpoint, so their focal purchases are not reachable. Iranian accounts were located among trades of at least USD 500 and matched to reported share counts. Trades are ordered by timestamp and summed by side, and non-trade activity is excluded from cash flow. Sale proceeds minus purchase expenditure are reported separately from the closed-position profit given by the platform. Gamma records are labelled v1, whereas the CLOB and Data API endpoints publish no version identifier.

Behavioural screening considers recent account activity, concentration, unusually large executions, and changes in execution price. These are candidate cues rather than calibrated thresholds: first activity within the analysed window does not prove when an account was created, and activity in one market says nothing about the concentration of a whole portfolio. Polygon tracing follows the four documented transfers through Relay’s public request records and the USDC transfer logs of the addresses they reveal. A shared infrastructure address is not treated as evidence of common beneficial ownership.

For each episode we distinguish direct observations, reported claims, interpretation, and legal status. Confidence is qualitative and attached to a specific proposition: high for a reproducible observation or the existence of a document, moderate for an interpretation with incomplete corroboration, and low or indeterminate for an untested attribution. Wherever relevant, we consider public information, chance, hedging, coordination, market making, and account migration. An allegation is not a conviction, and the absence of a publicly identified suspect does not imply legality. Table 1 summarises the evidence.

Reported information advantages

The Venezuelan episode shows the difference between detection and legal identification. In United States v. Van Dyke (United States District Court for the Southern District of New York, 2026, pp. 5–6), the indictment alleges that a member of the US service used restricted information about an operation involving Nicolás Maduro to trade-related contracts, committing approximately USD 33,900 on thirteen occasions across four markets for approximately USD 409,900 in profit (p. 8). A parallel civil complaint gives the account’s truncated wallet address (Commodity Futures Trading Commission, 2026, p. 12), which matches one Polymarket account. Its public records show thirteen purchases in the same four markets between 27 December 2025 and 3 January 2026 (UTC), amounting to USD 33,934.34, and sales and redemptions that exceed this cost by USD 409,880.95. Public data thus reproduces the alleged trading exactly, but the link between the account and the defendant comes from the legal filings.

Timing and concentration would have justified scrutiny, but public reporting of a months-long US military build-up, strikes on alleged drug boats, and a strike on a Venezuelan dock in late December 2025 (Associated Press [AP], 2025) signalled that the US action was possible and thus offered an alternative explanation for a bullish position. Confidence is high in the reconstructed trades and in what the filings allege, while culpability remains a matter for the court.

In the Iranian episode, Rodrigues (2026) reported that six recently funded wallets took positions before the strikes of 28 February 2026 and made substantial profits, and Bubblemaps named the accounts (Abrams, 2026). We matched five of them with public account records. Between 25 February 2026 and 04:48 UTC on 28 February 2026, before the market price jumped at 06:13 UTC, these accounts bought 1,065,775 YES shares for USD 137,216 and redeemed them for a net gain of USD 928,559, close to the reported estimates, and four of them show no platform activity in the retrieved window prior to 24 February 2026. The clustering and timing are consistent with coordination, but we did not test common funding, and nothing in the records shows access to restricted information. A common service, lawful coordination, or a rapid reading of public signals could produce the same picture, so coordination remains a reported hypothesis and the origin of any advantage is indeterminate.

Ukrainian price movement

The Ukrainian contract asked whether Ukrainian forces would re-enter Novomykolaivka in Dnipropetrovsk Oblast by 31 March 2026. Its rules named the Institute for the Study of War’s (ISW) map as the primary settlement source, and the market resolved YES on 8 March 2026. On 6 March 2026 the price increased from 0.380 at 16:05:24 UTC to 0.905 at 16:10:23, an increase of about 138% (Figure 2). The focal filter identifies 115 purchases by twenty-eight distinct proxy wallets, and confidence in these calculations within the analysed dataset is high.

Figure 2.

Ukrainian YES price on 6 March 2026 from 00:00 to 20:00 UTC. Source: Authors’ calculations from Polymarket price history; 1,196 observations.

Institute for the Study of War’s assessment for 6 March 2026, with a data cut-off of 16:15 UTC, cites a report by the Ukrainian observer Kostyantyn Mashovets that Ukrainian forces had advanced into central Novomykolaivka, and ISW’s map timed 18:30 UTC shows these advances as claimed Ukrainian counteroffensives, a layer that the contract accepted for settlement (Institute for the Study of War, 2026). The cited Telegram post appeared at 06:06 UTC, about 10 hours prior to rise in price, and the channel posted nothing further on the town that day (Mashovets, 2026). Public information thus preceded the move but does not explain its timing. Coordinated trading remains an alternative explanation; so, confidence that public information drove the move is moderate.

The twenty-eight addresses are the complete set of buyers in the focal window, which permits a contrast without choosing cases. Each of them traded other contracts between 1 February 2026 and 1 April 2026, from nine to 1,664 distinct markets, so none was opened for this question alone. Among the twenty-four addresses whose focal purchases are reachable, three ended below cost, although the market resolved YES, eleven gained less than one-tenth of what they spent, and the largest position, 11,174 USDC.e, returned 3.4%. Buying during the spike therefore does not separate informed trading from ordinary activity.

Simpler rules behave differently on the same series. A volume rule ranks the focal interval only fourth, because the three largest 6-minute volumes fell on 8 March 2026, the day of settlement. A count of distinct participants separates it unambiguously, ninety-six addresses against at most thirty-eight elsewhere. Public reporting preceded all of them by at least 10 hours; so in this episode, open-source monitoring would have been earlier than any market rule. This is a comparison on one contract, not a measure of performance.

Interference with settlement sources

The Russian episode concerns an edit to ISW’s interactive map on the night of 15–16 November 2025 that showed a Russian advance in Myrnohrad and allowed a related Polymarket question to resolve (Gault, 2025). ISW stated that the edit was “unauthorized and unapproved” and removed it before its next update (Cleveland-Stout, 2025); the market itself could not be located. The episode shows how interference with a settlement source can affect a contract without conveying any knowledge of the battlefield, and the rules of the Ukrainian contract exclude temporary glitches or errors in the map. Confidence is high that an unauthorised edit occurred, while the link between its author and the accounts that benefited remains indeterminate; assigning responsibility would require evidence connecting the alteration to control an account.

A similar problem of source integrity arose with temperature contracts settled on readings at Charles de Gaulle airport. After sudden spikes on 6 and 15 April 2026, Météo-France filed a complaint for tampering with an automated data processing system (Kennedy et al., 2026), and from 19 April 2026, the rules of Polymarket’s Paris contracts named the Le Bourget station instead. Altering a measurement used for settlement could thus change contract outcomes. Equipment malfunction and deliberate interference remain competing explanations, because no cause or perpetrator is established publicly; confidence in its relevance is high, and responsibility is indeterminate.

These episodes link the integrity of external information to the procedure by which it is accepted. Polymarket’s (2026) documentation describes outcome proposals submitted to the UMA Optimistic Oracle (OO) and a dispute mechanism that can escalate to a vote of UMA token holders. Thus, a map or sensor reading is evidence under the contract rules rather than an automatic trigger for payment, and an investigation must follow the source and the process of proposal, challenge, and resolution.

Contract interpretation

Two contract illustrations show why a market title cannot always be read as a simple statement of probability. The published rules for a question on the return of Jesus Christ rely on a consensus of credible sources, which leaves room for judgement about evidence and interpretation. An analyst must therefore identify the decision rule that the contract actually implements and ask whether it matches the event of intelligence interest.

The second illustration asks whether Jesus Christ will return before Grand Theft Auto VI is released; if neither occurs by 31 July 2026, the contract settles at 0.5. In a simplified undiscounted model, a YES share is therefore worth the probability of a YES outcome plus half the probability that neither event occurs; so a price near 0.5 may reflect this substitute clause rather than a belief that the nominal event is possible.

Hungarian trading and tracing

In the Hungarian case, we independently reconstruct the recorded activity of the account labelled pcpc on the NO side of the question whether Viktor Orbán would become the next prime minister. Ninety-five purchase records between 8 April 2026 and 10 April 2026 total 405,156.796641 shares for an expenditure of 280,952.240363 USDC.e. The largest purchase record, 140,000 shares at 0.72, dates from 10 April 2026 at 14:35:29 UTC (Figure 3). Forty-six sale records on 12 April 2026 yield proceeds of 399,105.158284 USDC.e, which exceed purchase expenditure by 118,152.917921 USDC.e. The platform’s separate closed-position field reports 118,158.563 USDC.e; the discrepancy of 5.645079 USDC.e remains unexplained.

Figure 3.

Hungarian NO position and hypothetical monitoring interval. Source: Authors’ calculations from Polymarket activity; ninety-five purchases and forty-six sales.

Two inbound Polygon transfers on 8 April and 9 April 2026 total 399,919.995093 USDC.e. Relay’s public request records show that these were swaps within Polygon rather than cross-chain transfers: a smart-contract account paid 150,000 USDC and 250,000 USDC, which Relay delivered to the Hungarian account as USDC.e. Both tranches reached that account seconds before each swap from one unlabelled address, which also received both outbound transfers of 24 April 2026, amounting to 518,163.649481 USDC.e and swapped back to USDC. The capital therefore left from, and returned to, the same address. Each tranche had reached that address after a small test transfer: 150,000 USDC from an unlabelled high-volume address and 250,000 USDC from an address labelled Binance: Hot Wallet 34. These transfers are not trading profit, because they include principal and other account balances. Thus, the trace reaches an exchange whose customer records could identify the account holder, although public data does not. Confidence is high in the documented transfers, the common address, and the exchange link, and indeterminate for personal attribution.

The large purchase is consistent not only with conviction or an informational advantage but also with a reaction to polling, liquidity needs, or a trader moving activity to a new account. Selling before resolution can release capital, reduce settlement risk, or reflect inexperience, and is not in itself evidence of concealment. A hypothetical monitoring decision could have followed that execution, which preceded scheduled polling closure at 17:00 UTC on 12 April 2026 by 50 hours, 24 minutes and 31 seconds (National Election Office, 2026). This is a retrospective interval to a known schedule, not a measured warning, and no alert was generated or prospectively evaluated.

What the framework establishes

The answer to the first research question is limited. Public data allowed us to detect observable movements, reconstruct reported trades, and trace the Hungarian account’s capital through a single address to an exchange, but not to identify the natural person controlling it. Tracing an address, attributing a service, and identifying a person in law are therefore separate achievements.

For the second question, Table 2 separates information-based hypotheses, interference with settlement sources, and the interpretation of contractual payoffs. These categories concern different intervention points and are not interchangeable types of trader. An information-based hypothesis may involve public, non-public, or uncertain sources; a settlement-source incident may benefit an unrelated opportunist; and a confusing payoff can produce unusual prices without any deception. Instead of inferring illegality from a behavioural signature, the framework specifies what further evidence is needed.

Disinformation and strategic deception

An adversary could deliberately build a concentrated position on a newly used address, accept an unfavourable price, and publicise the trade as evidence of privileged knowledge. Such activity might divert analytical resources, shape expectations, or reinforce a deception campaign, with trading losses accepted as the cost of influence. Conversely, an informed actor could evade a screening rule by splitting activity, using established accounts, or trading through intermediaries. Neither the presence of an anomaly nor its absence is therefore a sufficient basis for a security conclusion.

Different mechanisms require different data. Spoofing consists of orders placed with no intention of execution and cannot be diagnosed from executed trades alone; studies that detect it rely on order-book messages (Debie et al., 2023; Martínez Miranda et al., 2019). Wash trading creates apparent activity between accounts under related control (O’Leary, 2018), and shared funding infrastructure alone does not prove such control. Deliberate signalling uses genuine, risk-bearing trades to influence observers, whereas data poisoning or interference with a settlement source targets the information accepted under the contract rules. The present datasets do not test these mechanisms but they indicate what evidence an investigation would need.

Manipulation need not produce a lasting forecasting error. Hanson and Oprea (2009) show that, under certain market conditions, informed traders’ responses can offset manipulation. This does not remove the security concern, because a transient disturbance may mislead an observer before it is corrected. Treating each alarm as a revisable hypothesis separates market correction from analytical success and exposes repeated false signals aimed at the monitoring process itself.

Domestic markets and jurisdiction

One response to the limit that stopped the Hungarian trace at an exchange beyond domestic reach would be a regulated domestic prediction market with identity verification, but it is a policy hypothesis, not a proven remedy. Differences in population, liquidity, incentives, contract wording, and access to information would prevent its automatic use as a control sample. A useful comparison would match contracts and horizons, measure participation and liquidity, and assess alternative explanations before inferring leakage or manipulation. We do not claim that such a market would be better calibrated or could replace conventional polling.

Cross-jurisdictional enforcement would remain difficult. A domestic regulator may supervise a licensed operator and local intermediaries, yet lack direct authority over foreign participants, records, or infrastructure. Blocking a website or payment provider need not prevent trading by other routes. Public settlement, the operator’s domicile, and its regulatory status are separate questions and should not be collapsed into a single jurisdiction. Cooperation and lawful access to records may support identification but neither guarantees that all relevant evidence can be recovered. A domestic venue would also compete with global liquidity.

Identity verification cannot prevent informed trading, guarantee that the account holder controls the activity, or persuade informed actors to use the regulated venue. Any proposal must address the eligible sensitive contracts, restrictions for public officials and military personnel, position limits, surveillance, auditability, data protection, and anti-money-laundering duties. Independent oversight would be particularly important for contracts concerning government decisions.