Kalshi and Polymarket cleared roughly $44.8 billion in combined trading volume in June, and both now operate as federally regulated venues in all 50 states. What neither has, and what no US regulator has yet written, is a functioning rule against trading event contracts on secret information.
A Bloomberg Businessweek investigation put a number on the gap this month: a review of Polymarket activity flagged at least 34,000 trades between August 2025 and June 2026 as potential insider trades. That is not a rounding error on a fringe venue. That is a structural hole in a market that just spent a year winning the argument that it is real finance.
The Scale Arrived Faster Than the Rulebook
The growth is the reason this matters now rather than eventually. Kalshi did $31.5 billion in volume in June, up 87.4% month over month on World Cup contracts, and added 3 million users during the tournament. Polymarket printed a record $10.8 billion in the same month. Kalshi holds roughly 90% of the US market.
The private valuations track it. Kalshi raised at $22 billion in May and is reportedly seeking capital near $40 billion, while Polymarket has been fielding interest above $20 billion. Kalshi’s chief executive told CNBC in June that an IPO is on the table but not for this year. These are late-stage financial infrastructure companies now, priced accordingly.
We flagged the trajectory when prediction markets started eating sportsbook volume earlier this year. The eating continued.
Why Securities Law Does Not Map Onto This
Insider trading enforcement in equities rests on a specific theory: someone owed a duty to a company or its shareholders, breached it, and traded on what they learned. Decades of case law hang off that hook.
Event contracts frequently have no company in the picture at all. The material nonpublic information is a military deployment, a clinical trial readout, a teleprompter script, a pardon under discussion. There is no issuer, no shareholder, and often no securities-law duty to breach. The conduct is obviously wrong and the existing machinery does not straightforwardly reach it.
The case list makes the point better than the theory does. Prediction markets have surfaced a US special forces soldier betting on the fall of Nicolás Maduro, a presidential teleprompter operator, and former Congressman George Santos, whom Kalshi referred to regulators. In Israel, an air force major has been charged with using classified information to place Polymarket bets on strikes in Iran and Yemen, part of a wider defense-establishment betting scandal in which one indicted officer claimed the practice was widespread among aircrew.
None of those look like a classic 10b-5 case. All of them are people trading on information the rest of the market could not have.
Corporate America Has Started Writing Its Own Policy
With no federal rule to point at, employers are improvising. CNBC reported in July that Goldman Sachs and other firms are adding internal policies covering what staff may wager on, because compliance departments worked out that an employee betting on their own company’s earnings is a problem regardless of whether the CFTC has named it one.
The exposure runs further than earnings. NPR reported this month that Kalshi and Polymarket now list contracts on clinical trial outcomes and FDA approvals, which means anyone inside a drug trial, a data safety monitoring board, or a regulatory review team holds a tradeable asset. Biotech compliance was not built for that.
Kalshi, to its credit, has spent years building surveillance, refers suspected misconduct to federal authorities, and struck a partnership this month to help companies police insider betting by their own employees. That is a venue doing enforcement work a regulator has not defined. It is also a venue whose revenue is a function of volume, which is why it should not be the only party doing it.
The Regulator Is Busy Fighting a Different War
The CFTC has not been idle, but its energy has gone somewhere else. It issued an insider trading advisory in February and a proposed rule on event contracts in June. Meanwhile it has been in court defending its jurisdiction, suing Arizona, Connecticut and Illinois and later New York, and filing in the Massachusetts Supreme Judicial Court to assert exclusive authority after a Suffolk County judge enjoined Kalshi’s sports contracts in January.
In July, 44 state attorneys general told the agency it has no authority over sports event contracts at all. Europe has been less patient: Spain simply blocked both platforms as unlicensed gambling in May.
So the agency that would write the insider rule is spending its institutional capital on whether it gets to be the regulator, not on what the regulation says. That is the structural why. Federal legitimacy and a federal conduct standard were supposed to arrive together, and only one of them showed up.
Kalshi chief executive Tarek Mansour has made the industry’s case directly and repeatedly, including on the insider question.
Prediction markets, he argues, cut through polarization and show you what the wisdom of the crowds actually believes, backed by real money, not rhetoric.
The wisdom of the crowd is a fair description of a market where everyone is guessing. It is a poor description of one where a meaningful slice of participants already knows.
What Breaks First
The midterms are the pressure test. Election officials have already told Votebeat they are worried about prediction market odds shaping perceptions of races, and Kalshi launched an election hub in July aimed squarely at that volume. An election contract moved by someone with early access to county returns is not a compliance footnote. It is a legitimacy event, for the venue and for the count.
The commercial logic points the same direction. A company preparing an IPO at a valuation near $40 billion cannot carry an unpriced legal exposure of this shape into an S-1, and underwriters will ask what the insider policy is long before the CFTC does. The likeliest sequence is that the venues and their bankers write the rule the regulator has not, and Washington ratifies it afterward.
That is how it usually goes. It is also the version where the people who profit from the volume get to define what counts as cheating.