💰 quantitative finance

Per-Market Information Leakage and Order-Flow Skill: Two Methodological Lenses on Informed Trading in Decentralized Prediction Markets

This paper argues that three distinct methodological approaches to detecting informed trading in decentralized prediction markets—account-level skill screening, heuristic insider flagging, and per-market information leakage scoring—are complementary layers of detection rather than competing methods, and demonstrates how integrating them improves precision through a combined pipeline.

Original authors: Maksym Nechepurenko

Published 2026-05-05

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Maksym Nechepurenko

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, global betting hall called Polymarket. People here bet on everything from "Who will win the Super Bowl?" to "Will a specific politician be impeached?" to "Will it rain in London tomorrow?"

Recently, a big question has haunted this betting hall: Are some people cheating? Are there "insiders" using secret, private information to win money before the rest of us even know the news has happened?

In April 2026, three different groups of researchers showed up with three different flashlights to find these cheaters. This paper is a guidebook that explains how these flashlights work, why they are all different, and how you need to use them together to actually catch the bad guys.

Here is the breakdown in simple terms:

The Three Flashlights (Methodologies)

The paper argues that these three methods aren't competing; they are looking at the problem from three different angles.

1. The "Career Detective" (Sign-Randomization)

Who uses it: Gomez-Cram and colleagues.
How it works: Imagine you are a coach watching a basketball player over an entire season. You ask: "Is this player actually good, or did they just get lucky?"
- They take a trader's entire history of bets.
- They run a computer simulation where they randomly flip the "Win/Lose" button on every bet 10,000 times.
- If the trader's real winnings are way better than what you'd get by just guessing randomly, they are labeled "Skilled."
The Catch: This only works for people who have made many bets (at least 10 different events).
- Analogy: If a thief breaks into a bank once, steals a million dollars, and then disappears, this "Career Detective" won't catch them. The detective needs a long track record to prove the thief is "skilled" rather than just lucky.
- The Problem: The paper notes that Polymarket has many different types of bets (Sports, Crypto, Politics). A "skilled" sports bettor (who knows about player injuries) looks the same as a "skilled" political insider (who knows about secret military plans). Mixing them all together makes it hard to know who is actually cheating.

2. The "One-Time Visitor" Detector (Lifecycle Heuristic)

Who uses it: Gomez-Cram and colleagues (a second tool from the same team).
How it works: This looks for the "One-Shot" cheater.
- It flags accounts that:
  1. Were created just days before a big event.
  2. Bet heavily on only that one event.
  3. Stopped betting immediately after the event finished.
The Catch: This is a "suspicious behavior" alarm, not a proof of guilt.
- Analogy: Imagine a security guard seeing someone buy a ticket, walk straight to the VIP box, bet everything on one horse, and then vanish. That's suspicious! But it could also be a new fan who got excited, a bot program, or someone trying to hide their identity for privacy. The paper says we don't know exactly how many of these "suspicious" people are actually guilty insiders.

3. The "Leak Meter" (Information Leakage Score - ILS)

Who uses it: Nechepurenko.
How it works: This doesn't look at people; it looks at the betting lines (the odds).
- Imagine a news story breaks at 10:00 AM saying "The President has resigned."
- This tool checks the betting odds at 9:59 AM.
- The Question: "How much did the odds move before the news hit the public?"
- If the odds were 50/50 at 9:00 AM and jumped to 90% by 9:59 AM, the "Leak Meter" says, "Hey, someone knew this was coming before the news broke!"
The Catch: It tells you that information leaked, but it doesn't tell you who leaked it. It's like hearing a loud crash in the kitchen but not knowing which child broke the vase.

The Real-World Test Case: The "Maduro" Operation

The paper uses a real-life example to show how these tools stack up. In early 2026, there was a secret US military operation involving Venezuela.

The Legal Case: The US Department of Justice (DOJ) arrested a soldier named Gannon Van Dyke. They proved he used secret military plans to make $409,881 in bets.
The "One-Time Visitor" Detector: This tool flagged three accounts. One of them made exactly $409,882. The timing and the money matched the soldier's crime perfectly. This tool successfully found the "needle in the haystack."
The "Career Detective": This tool failed to flag the soldier. Why? Because the soldier only made bets on this one event and then stopped. He didn't have a long history, so the "Career Detective" didn't have enough data to call him "skilled."
The "Leak Meter": The paper suggests this tool could have been used to measure exactly how much the betting odds moved before the news broke on each specific contract, but they didn't actually run the numbers in this paper.

The Lesson: The "Career Detective" missed the soldier because he was a one-time player. The "One-Time Visitor" detector caught him. But neither tool could tell us how much the odds moved before the news (which the "Leak Meter" would do).

The Proposed Solution: A Three-Stage Security Pipeline

The author suggests that instead of relying on just one flashlight, we should build a security system with three stages:

Stage 1 (The Filter): Use the "One-Time Visitor" detector and the "Career Detective" (but separated by category, e.g., don't mix sports bettors with political insiders) to create a "Watch List" of suspicious accounts.
Stage 2 (The Meter): Take the markets where these suspicious accounts are betting and use the "Leak Meter" to see if the odds moved strangely before the news.
Stage 3 (The Human): If an account is on the Watch List AND the odds moved strangely, send it to a human investigator (like a police officer or regulator) to decide if it's actually a crime.

What the Paper Says We Still Don't Know

The paper ends by admitting there are still three big holes in our knowledge:

Confusing Rules: Sometimes the market moves because people are confused about the rules of the bet, not because someone has secret info. We don't have a good way to tell the difference yet.
Missing Data: To catch cheaters in real-time, we need to track every single bet as it happens. Currently, we often only see the data after the event is over.
Teamwork: We don't have a good way to spot if a group of people are working together across different markets to move the odds.

Summary

The paper is a "User Manual" for catching cheaters in prediction markets. It says: Don't just use one tool. You need the "Career Detective" to find the pros, the "One-Time Visitor" detector to find the sneak thieves, and the "Leak Meter" to measure the damage. Only by using all three together can you get a clear picture of what's really happening.

1. Problem Statement

Decentralized prediction markets (e.g., Polymarket) have accumulated significant evidence of informed trading, including cases involving classified government information (e.g., the 2026 U.S.–Venezuela operation). However, the academic literature lacks a unified framework to detect such trading. Existing approaches often conflate different types of "skill" (e.g., sports betting expertise vs. insider trading) or operate at incompatible levels of granularity (wallet-level vs. market-level).

The core problem addressed is the methodological fragmentation in detecting informed trading. Three distinct approaches emerged in April 2026 (Mitts & Ofir; Gomez-Cram et al.; Nechepurenko) that address the same empirical reality but operate on different layers. The paper argues these are not competing methods but complementary detection layers that must be combined to form a robust surveillance pipeline.

2. Methodological Framework

The paper organizes detection methodologies into three structural layers based on granularity, timing, and output:

A. Layer 1: Wallet-Level Anomaly & Skill Classification

Composite Anomaly Screen (Mitts & Ofir, 2026): Aggregates features (bet size, profitability, timing) to score (wallet, market) pairs. It is retrospective and estimates aggregate anomalous profit ($143M) but cannot distinguish skill from luck or provide real-time signals.
Sign-Randomization Skill Classifier (Gomez-Cram et al., 2026):
- Mechanism: For accounts trading $\ge$ 10 events, it randomizes the buy/sell direction of trades 10,000 times while holding event, size, and timing fixed. It compares realized PnL against this null distribution.
- Output: Classifies accounts as "skilled winners," "lucky winners," "unlucky losers," or "unskilled losers."
- Limitation: It measures persistent directional skill conditional on opportunity selection, not insider trading. It excludes "one-shot" insiders (accounts created for a single event) by design.
Lifecycle-and-Conviction Heuristic (Gomez-Cram et al., 2026):
- Mechanism: Flags accounts created within 7 days of an event, trading exclusively that event, with high volume/profit, and going dormant post-resolution.
- Output: A binary flag for suspected "one-shot" insiders.
- Limitation: High recall for insider patterns but unknown precision (high false-positive risk from Sybil farms or new users).

B. Layer 2: Market-Level Information Leakage

Information Leakage Score (ILS / ILSdl) (Nechepurenko, 2026b,a):
- Mechanism: Quantifies the fraction of the terminal price move ( $p_{T_{resolve}} - p_{T_{open}}$ ) that was priced in before the public news event ( $T_{news}$ ).
- Formula: $ILS(M) = \frac{p(T_{news}^-) - p(T_{open})}{p_{T_{resolve}} - p(T_{open})}$ .
- Scope Conditions: Requires substantive uncertainty at opening, a non-trivial total move, and robustness to anchor perturbations.
- Output: A per-market score (e.g., 0.6 implies 60% of the move was front-loaded).
- Limitation: Does not identify which wallets caused the leakage; relies on accurate recovery of public event timestamps.

3. Key Contributions

Taxonomy of Detection: The paper establishes that these methods answer different questions:
- Sign-randomization: "Has this account demonstrated repeated directional ability?"
- Lifecycle heuristic: "Does this account exhibit the behavioral signature of a one-shot insider?"
- ILS: "How much information was front-loaded into this specific contract?"
Critique of "Platform-Wide" Skill: The author argues that a single "skilled winner" classification is mechanism-ambiguous because Polymarket mixes categories (Sports, Politics, Crypto) with fundamentally different information technologies. A "skill" in NBA props (news ingestion) is distinct from geopolitical insider trading. The paper advocates for category-conditioned decomposition before using these metrics for surveillance.
Reproducibility & Data Constraints: The paper highlights that while the methodology of Gomez-Cram et al. is reproducible in principle, the specific account labels (the 1,950 flagged insiders) and category-conditioned decompositions are not yet released, limiting immediate operational use.
Case Study Integration (Maduro/Venezuela Cluster): The paper analyzes the January 2026 U.S.–Venezuela operation (Operation Absolute Resolve) and the subsequent indictment of Master Sergeant Gannon Van Dyke.
- Alignment: The lifecycle heuristic flagged three accounts; the lead account's PnL ($409,882) matched the DOJ indictment's alleged profit ($409,881) to the dollar.
- Gap: The sign-randomization classifier missed these accounts (as they were one-shot traders), and the DOJ indictment did not quantify per-contract leakage.
- Synthesis: The layers stack: the heuristic identifies the who, the legal investigation confirms the what (MNPI), and ILS would quantify the how much per contract.

4. Results & Findings

Skill Persistence: The sign-randomization classifier found that 3.14% of accounts are "skilled winners," capturing >30% of platform gains. These skilled accounts showed 44% out-of-sample persistence, significantly higher than mutual fund managers.
Heuristic Validity: In the Maduro case study, the lifecycle heuristic successfully identified the accounts associated with the indicted insider, demonstrating high recall for enforcement-aligned cases, though precision across the full 1,950-flagged population remains unverified.
Methodological Gaps:
- Resolution-Criteria Uncertainty: Markets can misprice due to ambiguity in resolution rules (e.g., "Did forces enter Iran?"), which statistical models may misinterpret as insider trading or lack of skill.
- Infrastructure: Real-time surveillance is currently blocked by the lack of continuous per-trade data collection (The Graph subgraph limitations), forcing reliance on retrospective analysis.
- Cross-Market Coordination: Current methods do not detect coordinated trading across related markets (e.g., multiple Venezuela contracts) prior to an event.

5. Significance & Proposed Pipeline

The paper proposes a three-stage surveillance pipeline to integrate these layers:

Stage 1 (Triage): Category-conditioned account risk scoring. Combines sign-randomization (for multi-event skill) and lifecycle heuristics (for one-shot patterns), weighted by category (e.g., geopolitical risk > sports risk).
Stage 2 (Quantification): Per-market ILSdl scoring on markets where flagged accounts hold significant positions. This quantifies the magnitude of information leakage.
Stage 3 (Review): Human compliance review of contracts that pass both Stage 1 (suspicious wallets) and Stage 2 (high leakage).

Conclusion:
The paper concludes that no single methodology is sufficient. Sign-randomization identifies persistent skill but misses one-shot insiders; lifecycle heuristics catch one-shots but lack precision; ILS quantifies leakage but lacks wallet attribution. A combined approach, grounded in category-specific analysis and supported by legal enforcement benchmarks (like the Van Dyke indictment), offers the most robust path for regulatory technology (RegTech) in decentralized prediction markets. The work emphasizes that while the academic contributions are substantial, their operationalization requires releasing underlying data labels and addressing infrastructure gaps in continuous data collection.