TL;DR: Prediction markets running on public blockchains create manipulation, settlement-integrity, and insider-exploitation risks that periodic review was not built to catch, according to Blockaid, especially as CFTC-registered trading volume exceeded $25 billion in 2025. Real-time behavioral surveillance, not retrospective compliance sampling, becomes the control that matters when settlement and trading move within seconds.
At a glance
What this is: Blockaid argues that onchain prediction markets need continuous transaction-level monitoring because manipulation, oracle abuse, and insider-style exploitation can occur faster than periodic surveillance can detect them.
Why it matters: This matters to security, risk, and compliance teams because market integrity controls now need to operate in real time when blockchain settlement, wallet behavior, and external data feeds are all part of the attack surface.
By the numbers:
- CFTC-registered trading volume exceeded $25 billion in 2025, according to Blockaid.
Context
Prediction markets on public blockchains shift trading, settlement, and fund movement into an environment where adversarial behaviour can be visible in real time but also resolve very quickly. That changes the governance problem from periodic surveillance to continuous control design, because manipulation, oracle compromise, and misuse of non-public information can all affect contract outcomes before a manual review catches up.
For IAM and NHI practitioners, the identity lesson is not about human logins but about the credibility of wallets, funding paths, and delegated transaction authority as control points. When access is expressed through addresses, bridges, and transaction patterns, governance has to focus on behavioural trust signals, not only static allowlists or post-event investigations.
Key questions
Q: How should teams handle prediction market surveillance when settlement happens onchain?
A: Teams should treat onchain settlement as a live risk window, not a periodic-review problem. That means monitoring transaction behaviour, oracle dependencies, and wallet coordination continuously so suspicious activity can be challenged before a contract resolves. Retrospective compliance is still useful, but it cannot be the primary control when execution and settlement happen within minutes.
Q: Why do wallet patterns matter more than static blocklists in onchain markets?
A: Because many abuse patterns emerge from fresh wallets, indirect funding, cross-chain movement, and coordinated timing rather than from previously identified bad addresses. Static blocklists only catch known actors, while behavioural analysis can surface manipulation, wash trading, and hidden coordination before the market outcome is finalized.
Q: What breaks when prediction market surveillance is only periodic?
A: Periodic surveillance misses the fast path from trade to settlement. A manipulated price signal, a compromised oracle input, or a coordinated wallet cluster can complete its objective before the next review cycle begins, which means the market may already have resolved incorrectly by the time analysts look.
Q: Which control matters most when onchain market integrity is at stake?
A: The key control is continuous verification of trading behaviour and settlement dependencies. That is what turns surveillance into prevention. Without it, operators are left relying on after-the-fact investigation, which may explain the incident but cannot stop the contract from settling on bad data.
Technical breakdown
Why onchain markets outpace periodic surveillance
Onchain markets compress the time between action and settlement, which weakens control models that rely on sampling or after-the-fact review. A transaction can be broadcast, confirmed, and economically consequential in seconds, while monitoring teams may only see the issue once the market has already moved. That creates a governance gap where the market integrity signal is generated faster than the control can validate it. Continuous monitoring closes that gap by evaluating activity at the point of execution rather than after the fact.
Practical implication: Treat transaction-level monitoring as a pre-settlement control, not a post-settlement detective control.
How manipulation and wash trading show up in wallet behaviour
Manipulation in prediction markets does not always look like a classic compromised account. It often appears as coordinated self-crossing, related-wallet wash trading, layered activity, or rapidly timed positions that distort price discovery. Because blockchain data is public, these patterns can be modelled as behavioural anomalies across wallets, funding sources, and timing, rather than relying on a list of known bad addresses. That is the practical difference between address screening and market surveillance.
Practical implication: Build behavioural detections that look for coordination patterns, not just blocked addresses or sanctioned entities.
Why oracle and settlement integrity need continuous dependency monitoring
When settlement depends on an external data source or oracle, the integrity of the contract inherits the integrity of that dependency. If the input can be influenced, delayed, or selectively exposed, the market can resolve incorrectly even when the trading layer itself appears healthy. This is a dependency-risk problem, not just a platform-risk problem. The correct technical response is to monitor both the onchain resolution path and the external feed behaviour continuously, because either layer can fail first.
Practical implication: Monitor settlement dependencies as part of the control plane, not as an external assumption.
Threat narrative
Attacker objective: The attacker wants to profit from distorted prices or incorrect settlement while masking coordinated control of the trade path.
- Entry occurs through participation in the market and, where relevant, through wallets, bridges, or fund flows that hide the actor's relationship to the trade.
- Credential or identity abuse takes the form of wallet coordination, indirect exposure, or newly created addresses that obscure who is actually controlling the positions.
- Escalation happens when coordinated trading, wash trading, or oracle influence is used to distort pricing or contract resolution before surveillance detects it.
- Impact is an incorrect settlement outcome, manipulated probability signal, or financially harmful market disruption that undermines trust in the market's integrity.
Breaches seen in the wild
- Miasma and Hades Supply Chain Worms: Self-propagating supply chain worms Miasma and Hades compromise npm, PyPI, and Azure credential stores.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Real-time surveillance is becoming a market-integrity control, not just a compliance function. Blockaid's comment shows that prediction markets running on public blockchains collapse the old assumption that review can happen safely after the fact. When trading, settlement, and fund movement all occur onchain, the integrity question becomes whether controls can evaluate activity before the market has already moved. For practitioners, the practical conclusion is that surveillance must be designed as a live control plane.
Behavioral trust has replaced static allowlisting as the useful unit of analysis: in onchain markets, the signal often sits in wallet creation, funding routes, timing, and cross-chain movement rather than in a named identity. That matters because a static blocklist sees only known bad actors, while manipulation often comes from fresh infrastructure and coordinated patterns. Security teams should therefore treat behavioural clustering as a governance requirement, not an analytics enhancement.
Settlement integrity is now a dependency management problem. The article makes clear that an external oracle or data feed can become the weakest link even when the market interface appears sound. That is the same structural issue identity teams face with delegated credentials and third-party access: the system inherits the trustworthiness of an upstream dependency. Practitioners should map who or what can influence each settlement input and what evidence proves that influence is bounded.
Market surveillance and NHI governance are converging on the same control logic. Although this article is about prediction markets, the underlying pattern is familiar to identity teams: ephemeral participants, indirect trust, and hidden delegation chains create governance blind spots. The named concept here is transaction-level trust gap, the gap between visible market participation and the actual actor controlling the flow. Teams should design controls that verify behaviour at the moment value moves, not only after attribution is possible.
What this signals
Transaction-level trust gap: onchain market governance fails when operators can see activity but cannot yet prove who controls it or whether settlement inputs are trustworthy. That pushes teams toward controls that verify behaviour before value transfers, not just audits after the fact.
Prediction markets are a useful stress test for broader identity governance because they combine delegated control, hidden coordination, and rapid economic finality. Where wallet behaviour, cross-chain routing, and oracle inputs decide outcomes, practitioners need governance models that bound trust in the moment of execution.
For practitioners
- Implement continuous transaction monitoring Use behavioural analytics on every onchain transaction so suspicious patterns are evaluated before settlement, not after a manual review cycle.
- Model wallet coordination and funding paths Correlate wallet creation, timing, bridge usage, and funding provenance to detect wash trading and coordinated control that static address lists miss.
- Treat oracle and settlement dependencies as monitored assets Inventory every external data source, oracle, and resolution path that can change contract outcome, then alert on anomalies that could alter settlement integrity.
- Separate compliance sampling from live surveillance Keep periodic reviews for governance reporting, but use always-on detection for manipulation, insider-style exploitation, and rapid settlement events.
Key takeaways
- Onchain prediction markets compress trading and settlement into a short control window, which makes periodic review too slow to protect market integrity.
- Behavioural signals such as wallet timing, funding routes, and cross-chain movement can reveal manipulation patterns that static allowlists will miss.
- Continuous monitoring of trading activity and settlement dependencies is the practical control that reduces the risk of distorted prices and incorrect contract resolution.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | The article focuses on coordinated abuse and value movement patterns that resemble adversarial operational tradecraft. |
| Recommendation — Map suspicious wallet and transaction patterns to TA0006 and TA0010 to prioritise behavioural detections. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks, Systems and Assets Are Monitored to Find Anomalous Events | Continuous monitoring of trading and settlement activity is the central control theme. |
| Recommendation — Extend DE.CM-01 monitoring to onchain activity, oracle dependencies, and settlement events. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The article depends on evidence from continuous transaction and behavioural logging. |
| Recommendation — Centralise immutable logging for onchain transactions so surveillance can reconstruct manipulation attempts. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Real-time analysis of transaction evidence is the core operational requirement discussed. |
| Recommendation — Apply AU-6 to review onchain activity continuously and escalate anomalous settlement dependencies. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Oracle and settlement dependency failures behave like misconfigured trust inputs. |
| Recommendation — Treat oracle and resolution paths as exposed interfaces and harden them against misconfiguration and manipulation. | ||
Key terms
- Onchain Market Surveillance: Onchain market surveillance is the continuous monitoring of blockchain transactions, wallet behaviour, and dependency inputs for manipulation or abuse. It differs from periodic compliance review because it has to detect suspicious activity before settlement, not merely explain it afterwards.
- Settlement Integrity: Settlement integrity is the assurance that a contract resolves against the correct and intended outcome data. In onchain markets, it depends on the reliability of external feeds, oracle logic, and the resolution process itself, which can be compromised even when trading appears normal.
- Behavioural Wallet Analysis: Behavioural wallet analysis is the practice of inferring risk from timing, funding routes, cross-chain movement, and transaction clustering rather than from a static blocklist. It is useful when abuse is coordinated through fresh or indirect infrastructure that does not yet appear on traditional deny lists.
- Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners translate identity controls into operational decisions across modern security programmes.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org