Introduction
In modern conflicts, information does not move only through classified briefings or official statements. It also moves through markets. Financial signals and price movements can reveal collective expectations long before events become public, and in some cases, before governments intend them to be known.
As digital platforms increasingly turn geopolitical uncertainty into tradable assets, the line between forecasting and disclosure has begun to blur. Platforms designed to aggregate belief and reward informational advantage can, under certain conditions, expose sensitive insights through observable price signals, available to anyone watching, including adversaries.
Blockchain-based prediction markets sit directly at this intersection. Polymarket allows participants to buy and sell “Yes” or “No” shares on real-world outcomes, with prices commonly interpreted as implied probabilities. While intended to reflect public information, these markets also create incentives for participants with access to non-public information to act early, and for others to infer meaning from their behavior.
Given rising international tensions, and how real world events determine crypto terror-financing focuses, NOMINIS examined blockchain-based financial systems where information asymmetry can create real-world risk. This report analyzes trading activity on Polymarket ahead of two sensitive military events: the Israeli strike on Iranian targets during the June 2025 escalation, and the Israeli strike in Doha targeting Hamas leadership in September 2025. The issue examined here is not whether markets were accurate, but whether early, informed conviction became visible, and therefore actionable, before the events themselves occurred.
Methodology
NOMINIS conducted a forensic, behavior-driven analysis of Polymarket activity surrounding the two events: Israeli strikes on Iran, beginning the 12 Day War of June 2025, and the Israeli strike on Hamas leadership in Doha, in September 2025. All trades were aligned against confirmed execution timelines.
The Iranian strike occurred between approximately 23:30 and 00:00 UTC on 13 June 2025.
The Doha strike occurred at approximately 13:00 UTC on 9 September 2025.
The analysis deliberately excluded last-minute bets and high-price entries placed close to resolution. Instead, it focused on trades executed hours in advance, particularly those entered when prices were still between approximately 1 and 20 cents. At these levels, markets are explicitly signaling uncertainty. Committing large amounts of capital under such conditions is inconsistent with typical retail behavior and suggests either exceptional risk tolerance or confidence derived from information not yet public.
To assess risk, NOMINIS examined entry timing, price tolerance, position size, patience, and repetition across events. On-chain activity was contextualized using the NOMINIS intelligence database, including wallet funding patterns, wallet reuse, and historical behavior across unrelated geopolitical markets. No single trade was treated as conclusive. Suspicion was assessed through convergence of indicators.
Findings
Establishing a Behavioral Benchmark
Two accounts, User 'R' and User 'B', emerged as central reference points.
User 'R' placed multiple large bets several hours before the June Iran strike, entering when prices were still in the low-teens to low-twenties. Positions were unhedged and held patiently through uncertainty, with no visible effort to wait for confirmation or manage short-term downside risk. This behavior is atypical of retail traders, but closely mirrors how informed trading presents in traditional financial investigations. Shadow Intelligence on the NOMINIS platform when screening User ‘R’s wallet indicates the attention User R has received. Observers noted User ‘R’’s 100% win rate, over 7 months, while only betting on particular geopolitical events.
User 'B' exhibited a similar pattern. Positions were taken early, at low implied probabilities, and repeated within the same event window. The consistency of this behavior materially reduces the likelihood of coincidence. A single well-timed trade can be dismissed as luck; repeated early conviction is more difficult to explain without informational advantage. Online, as indicated by NOMINIS Shadow intelligence, Chinese X posts have speculated User ‘B’’s ‘crazy win rate’, and User B’s wallet address has been featured in websites claiming to track the activity of users with ‘insider information’.
Together, User 'R' and User 'B' establish a behavioral benchmark for early, informed conviction on prediction markets.
Accounts Exhibiting Similar Characteristics
Once this benchmark was established, other accounts drew attention not because of their identities, but because their behavior closely aligned with the same structure.
During the Iran escalation, an account known as User 'P' entered large positions hours before execution, at prices in the low-teens and sub-20-cent range. There was no probing behavior and no hedging. Capital was committed early and allowed to sit while uncertainty remained unresolved.
Their later trades were more aggressive and visibly moved the market, suggesting either lower discipline or a greater willingness to express conviction publicly. This distinction does not reduce suspicion; it suggests either direct access to sensitive information or proximity to someone who had it.
Another account, User 'F', exhibited a quieter but notable pattern. Approximately $22,000 was deployed early at prices around 22 cents, before consensus or confirmation. There was a single decisive entry, no laddering, no follow-up trades, and no reaction to market noise. The behavior reads as confidence rather than speculation: enter once, early, and wait.
In the Doha market, similar structures appeared at a smaller scale. User 'A' accumulated positions days in advance at prices between 6 and 8 cents, doing so patiently and without chasing price.
Another account, User 'O', followed a comparable approach, gradually increasing exposure at approximately 8 cents over multiple days. In both cases, the structure of the behavior mirrored the same early, low-price, patient logic established by User 'R' and User 'B', differing primarily in magnitude rather than method.
Individually, none of these behaviors proves insider access. Collectively, and when measured against the established benchmark, they raise legitimate concern.
The Insider Playbook
Viewed together, these accounts appear to follow a recurring pattern that NOMINIS has observed in other forms of financial abuse.
Activity often begins with a previously dormant or newly created wallet. Capital is introduced shortly before a specific geopolitical market becomes active. Bets are concentrated on a narrow set of outcomes where access to sensitive information would confer a clear advantage. Entry occurs early, when prices are still low and uncertainty is high, maximizing potential upside. The position is then held patiently until the event occurs and the market resolves.
Implications for Intelligence and Security
From the perspective of a hostile intelligence service, Polymarket is less a forecasting tool than an open-source sensor.
Such services would not need to identify insiders with certainty. They would monitor for early conviction: large capital commitments at low prices, well before execution. Accounts like User 'R' and User 'B' stand out immediately, given their behavior signals such confidence that it is strong enough to tolerate prolonged uncertainty.
Once these signals appear, secondary effects follow, as we saw with both the Doha and Iran strikes by Israel. Prices spiked, and additional users read signals, placing further bets on ‘Yes’. The market begins to converge on an outcome before any public confirmation exists. Because market data is machine-readable, this process can be automated and repeated across events. Over time, the market itself becomes a probabilistic early-warning system.
For military and intelligence operations, this creates a structural risk. Surprise depends on uncertainty, and when prediction markets begin to reflect privileged knowledge, even indirectly, that uncertainty erodes, creating risk to national security. As tensions between the Iranian Regime and the US continue to rise, as of February 2026, one could even expect the Ayatollah regime to track Polymarket bets on the likelihood of a US strike on Tehran, to assess the probability of such an event in the near future, for example.
Conclusion
This analysis suggests that prediction markets can unintentionally function as both a monetization channel for insider knowledge and a signaling mechanism for others. User 'R' and User 'B' demonstrate how early, informed conviction appears. The behavior of User 'P', User 'F', User 'A', and User 'O' shows how similar patterns propagate outward.
The national security concern is not limited to individual actors. It is systemic. Even a small number of informed participants can alter the informational environment by allowing sensitive expectations to surface publicly. Once visible, these signals can be interpreted by traders, analysts, journalists, and hostile intelligence services alike.
Prediction markets were designed to forecast the future, but not designed to handle asymmetric access to operational intelligence. As these platforms continue to expand into geopolitical and military domains, the question is no longer whether they reflect reality accurately, but whether they reveal it too early, putting matters of national security at serious risk.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
.png)
