Prediction Markets: Polymarket CFTC Review, Myriad Voids 10 Markets

On 27 October 2026, Reuters reported that the US Commodity Futures Trading Commission (CFTC) is examining whether Polymarket has complied with the 2022 settlement's restriction on serving US users; the review focuses on geolocation, advertising in the United States, and client onboarding and protections at its US exchange. Earlier, on 26 October, the prediction market Myriad on BNB Chain had voided 10 markets and triggered automatic refunds after its admin wallet was compromised.

Seen together, the two events sketch the sector's two core risks in 2026: regulatory compliance and settlement authority. This article explains prediction markets in three layers: what they settle on, where regulation stands in 2026, and which pitfalls ordinary users actually hit.

First, the 2022 settlement, explained

To understand this year's review, you have to go back four years. On 3 January 2022, the CFTC issued an order against Blockratize, Inc. d/b/a Polymarket.com (Docket No. 22-09), charging violations of Section 4c(b) of the Commodity Exchange Act (7 U.S.C. § 6c(b)) and Section 5h(a)(1) (7 U.S.C. § 7b-3(a)(1)), as well as CFTC Regulations 32.2 and 37.3(a)(1).

The core fact: Polymarket offered event-based binary options to US persons without registering as a SEF or a designated contract market (DCM), and such products constitute "swaps".

The penalties and obligations were specific:

• A $1.4 million civil monetary penalty (reduced for "substantial cooperation").
• Stop providing access to non-compliant markets before 2022-01-14.
• Facilitate the "winding down" of all non-compliant markets and allow participants to redeem in full.
• Certify compliance in writing to the CFTC before 2022-01-24.

The order also disclosed the scale at the time: about 900 event-based binary option markets since June 2020, with cumulative volume above $130 million; opening an account required only an email and a username, with no other identity information; and settlement was decided unilaterally by Polymarket's internal "Markets Integrity Committee".

This year's review: so far, media reports only

The strength of the evidence has to be stated clearly. We found only Reuters' report of 2026-10-27 and its derivatives; we found no CFTC press release, order or any official confirmation. The report's key points:

• The review is part of a broader CFTC investigation opened earlier in 2026, not a new enforcement action;
• It focuses on whether the 2022 settlement terms were violated: whether geolocation is effective, whether marketing to the United States continues, and whether onboarding and client protections at the US exchange are adequate;
• The CFTC, Polymarket and the DOJ all declined to comment;
• The report also notes that "an investigation by itself does not necessarily indicate wrongdoing", meaning being investigated is not the same as being in violation.

There is also an often-ignored timeline: in 2024 the CFTC investigated whether Polymarket was complying with the settlement, and the DOJ ran a related investigation; both ended in July 2025 without charges. In the meantime, the FBI searched the home of CEO Shayne Coplan in November 2024. In other words, "being investigated" has already happened once in this case, and it ended without an indictment.

Polymarket's legal identity today: the offshore site is not the US site

This is the most easily confused point and must be kept separate:

1. 2025-07-21: Polymarket announced the acquisition of QCEX for $112 million (including the CFTC-licensed QCX, LLC exchange and the QC Clearing LLC clearinghouse).
2. 2025-07-09: the CFTC granted its US entity a DCM designation, a point cited in 2025 court filings.
3. 2025-11-25: the CFTC approved an Amended Order of Designation, allowing it to operate in an "intermediated" manner, meaning US clients are onboarded through a futures commission merchant (FCM), subject to all CEA/CFTC rules applicable to DCMs.

So two different things exist today: offshore Polymarket (not CFTC-regulated, the one now being reviewed for whether it still serves US persons) and Polymarket US (DCM-licensed, accessed through an FCM intermediary). The same event may have different prices and depth at the two venues; this is not a bug but the result of two regulatory regimes coexisting.

The Myriad incident: take away settlement rights and the market is void

The second event shows better what keeps a prediction market alive. According to multiple media reports (we could not obtain a direct link to Myriad's official incident report):

• Timing: the attack began at 2026-10-26 06:07 UTC.
• Method: what was compromised was the admin wallet Myriad used internally to create and settle some markets. The attacker used it to buy positions, declare those positions winners, and then collect payouts. This was not a liquidity grab but a direct rewrite of outcomes.
• Root cause: Myriad attributed the key exposure to an unnamed third-party library vulnerability and said the exposure had occurred weeks earlier.
• Response: 10 markets were voided; holders on both sides of affected markets were refunded automatically at "shares × last price before the attack", with bonuses already collected from the fake settlement deducted from refunds; funds came from "recovered assets plus market pools"; users did not need to file a claim and payments went to wallets automatically.
• One verifiable example: BscScan records show an admin transaction settling market 105144 ("OpenAI vs Anthropic IPO"), after which about 11,609 USDT moved from the market contract to that wallet, and then about 11,715 USDT was sold and transferred to another address.

One caveat: Myriad claims that "the attacker withdrew no funds and the funds have been recovered", but The Defiant points out that on-chain records cannot independently confirm this, since a transfer alone does not prove who controls the receiving address. And the total loss, the number of affected users and the refund completion time have not been disclosed.

The technical lesson of this incident matters more than the amount: in a prediction market, "who can declare the result" matters more than "who can trade". If trading permissions are stolen, the worst case is someone front-running; if settlement permissions are stolen, the whole market is voided outright.

Settlement mechanics: you are really betting on who declares the result

Settlement paths differ widely across platforms, and that directly determines your exposure:

• Polymarket (offshore): relies on the UMA optimistic oracle. A result is proposed first, a challenge window opens, and disputes escalate to UMA's DVM arbitration. The risk: if the proposal is wrong and nobody disputes it within the challenge window, the wrong result settles.
• Kalshi: holds a CFTC DCM licence, so its rules and settlement are bound by the federal regulatory framework.
• Myriad: a hybrid off-chain/on-chain order book, with an oracle field in its API; for "markets Myriad settles itself" that field is empty, meaning the platform can settle on its own. This incident struck exactly there.

There is also a layer of "share economics": winners settle at $1 per share and losers at 0, so the price itself is the market-implied probability. That means price is not the true probability; it is only the result of participants voting with money, and when liquidity is thin or someone holds non-public information, prices deviate systematically.

Regulation in 2026: federal agencies advance, states enforce, courts split

This is the structural fact most worth remembering this year: holding a CFTC licence does not mean you are clear in every state:

1. 2026-03-12: the CFTC's Division of Market Oversight issued a Staff Advisory on DCM listing of event contracts (with a focus on sports contracts), and published an ANPR for comment the same day.
2. 2026-06-12: the CFTC published a proposed rule, "Prediction Markets; Public Interest Determinations" (RIN 3038-AF65, 91 FR 35806), intended to clarify which event contracts may be found contrary to the public interest and therefore may not be listed or cleared, and to define concepts such as "gaming"; comments closed on 2026-07-27.
3. 2026-04-06, Third Circuit: KalshiEX v. Flaherty (No. 25-1922) upheld a preliminary injunction, finding that the CEA likely preempts New Jersey's gambling law.
4. 2026-08-28, Ninth Circuit: KalshiEX v. Assad (No. 25-7516) affirmed the dissolution of a preliminary injunction, finding that the CEA likely does not preempt Nevada's gambling law because its sports event contracts are not "swaps", so Nevada may continue enforcing.

Two circuits reached opposite conclusions, which means the same product can be legal in state A and banned in state B: geographic inconsistency remains the biggest uncertainty for prediction markets in 2026.

Six real risks for ordinary users

1. Settlement disputes: a wrong or premature proposal settles if nobody disputes it within the challenge window. Polymarket's UMA mechanism gives you the right to dispute, but you need to watch the market and post margin.
2. Compromised internal platform permissions: a single Myriad incident voided 10 markets. Even with a promise of full refunds, you bear the time cost and the credit risk of "the company says it recovered the funds".
3. Jurisdictional and enforcement risk: using a VPN to reach offshore platforms may itself create enforcement risk. On 23 April 2026, the CFTC and the DOJ brought parallel civil and criminal actions against active-duty Army Special Forces sergeant Gannon Ken Van Dyke, alleging he used confidential information about "Operation Absolute Resolve" to buy about $33,000 of "Yes" shares on Polymarket, earning about $409,881, and used a VPN to mask his location (criminal case No. 26 Cr. 156).
4. State-level takedowns: the Ninth Circuit has allowed Nevada to enforce against Kalshi's sports contracts, while other states have contrary rulings, so a platform may be restricted state by state.
5. Insider information asymmetry: the Van Dyke case shows that those with non-public information can profit reliably. What you face is not a "pure probability market" but a market with information asymmetry.
6. Fragmented liquidity: offshore Polymarket holds only 4% and Polymarket US 12%, so the same event trades at different prices and depth at the two venues, and cross-venue arbitrage is not open to ordinary users.

If you want to compare other "real on-chain usage" data, look at the actual x402 call volume in AI agents made 138 million on-chain payments in a year; and for the other side of "who settles for assets", the AI compute derivatives idea mentioned in a review of Arthur Hayes' 2026 views is essentially a design for a new settlement and pricing mechanism.

Frequently asked questions

Is Polymarket legal in the United States?

You have to separate the entities. Offshore Polymarket was fined $1.4 million in 2022 for offering event-based binary options to US persons without registering, and was ordered to stop providing access to non-compliant markets; the DCM licence is held by a different entity, Polymarket US, which received CFTC approval on 2025-11-25 to operate through an FCM intermediary. Before accepting the conclusion that "Polymarket is legal now", check which site you are using.

Does being investigated by the CFTC mean it is about to get into trouble?

You cannot infer that. This review is a compliance check of "whether the 2022 settlement terms were violated", and the report explicitly says being investigated is not the same as a violation; the similar 2024 round of investigations (including the DOJ's) ended in July 2025 without charges. The evidence currently goes no further than "media reports"; the CFTC has not publicly confirmed anything.

Myriad voided those 10 markets. What happens to my money?

Per the official account: holders on both sides of affected markets are refunded automatically at "shares × last price before the attack", bonuses already collected are deducted from refunds, and no claim is required. But note three points: (1) refunds are computed at the pre-attack price, not your purchase cost; (2) funds come from "recovered assets plus market pools", and the payout order if the pool is insufficient has not been disclosed; (3) the claim that "the attacker withdrew no funds" cannot be independently confirmed from on-chain records.

Why is settlement authority more dangerous than trading authority?

Because if trading permissions are stolen, the worst case is that someone trades at a wrong price; if settlement permissions are stolen, the platform can simply declare who the winner is. In the Myriad case, the admin wallet bought positions, declared them winners and collected payouts in one step. When choosing a platform, look first at its settlement path (optimistic oracle, external oracle, or self-settlement), and only then at fees.

Is the $118.5 billion in volume real?

It is "contract notional", not the amount actually wagered. On the same page, cash actually paid over 30 days was $28.7 billion, and $3.8 billion in 24 hours. Citing notional as cash flow exaggerates the sector by about 4x.

Risk notice: Prediction market contracts are high-risk products and you may lose your entire principal; this article is not investment advice. The content about the CFTC's 2026 review comes only from media reports and has not been publicly confirmed by the regulator; the total loss, number of affected users and fund recovery in the Myriad incident are all stated by the project team and have not been independently verified; sector volume data come from third-party statistics and involve definitional differences (contract notional versus cash actually paid). Different jurisdictions take inconsistent positions on the legality of event contracts, so before participating, confirm the legal status in your region and the platform's licensing situation.