OAK — OnChain Attack Knowledge

Worked example · 2025-20

Polymarket Subjective-Oracle Resolution Manipulation Cohort — 2025–2026

OAK Techniques observed
OAK-T9.006.001, OAK-T9.006.002, OAK-T9.006.003, OAK-T9.006.004
Attribution
unattributed (aggregate cohort).
Loss
~$258M+ in disputed market volume across the three cases with sourced volume (Ukraine mineral deal ~$7M per CoinDesk, Zelenskyy-suit ~$237M, Iran-strike >$14M per The Block). Van Dyke / Operation Absolute Resolve has no verified market-volume figure; the sources report alleged insider profit of >$404K (CFTC). Realised extraction is bounded by attacker-position-size in each market.
Key teaching point
Prediction markets whose resolution depends on a subjective oracle (UMA DVM, Kleros, Reality.eth) expose four structurally distinct attack surfaces — vote capture by economically-interested tokenholders (T9.006.001), resolution-spec ambiguity exploitation (T9.006.002), off-chain resolution-source coercion (T9.006.003), and operational-insider trading on classified-information access (T9.006.004). Each surface is load-bearing independently; a market can be defended against three and still fall to the fourth.
Corrected 2026-10-11
Ukraine mineral deal volume is ~$7M (not ~$12M); Iran-strike market is >$14M (not ~$5M); the unverified Van Dyke ~$91M volume was replaced by the sourced ~$404K alleged profit; no US–Iran ceasefire UMA case is used as an anchor (it is quarantined).

Summary

Timeline

2025-03 (Ukraine mineral deal — DVM vote capture) → 2025-07 (Zelenskyy-suit — spec-ambiguity exploitation) → 2025-12 to 2026-01 (Van Dyke / Operation Absolute Resolve — operational-insider trading) → 2026-03 (Iran-strike / Fabian — off-chain resolution-source coercion). The four canonical cases span 12 months, demonstrating that the subjective-oracle resolution surface is systematically exposed, not incidentally.

Public references

Techniques demonstrated (4)