OAK — OnChain Attack Knowledge

Worked example · 2026-02

Polymarket Iran-strike timing market — operational-insider trading by IDF Air Force reservist — 2026-02

Loss
~$162,663 in profits extracted by a two-person scheme on the timing of Israel's June 2025 opening strike against Iran (the first bet of an ongoing scheme that continued through additional Iran-conflict markets until arrest). The economically operative finding is the second confirmed criminal indictment of an operational-insider Polymarket bettor in distinct national jurisdictions, establishing the operational-insider sub-pattern as a multi-jurisdictional class rather than a single-case anomaly.
OAK Techniques observed
OAK-T9.006.004 — Operational-Insider Trading on Subjective-Resolution Prediction Markets. Cohort case alongside the Van Dyke / Venezuela canonical anchor at examples/2026-01-polymarket-venezuela-maduro-soldier-insider.md. Parent Technique: OAK-T9.006 (Subjective-Oracle Resolution Manipulation).
Attribution
confirmed (Tel Aviv District Court indictment; Shin Bet, Defense Ministry investigative unit, and Israel Police arrested both defendants). Specific defendants are not publicly named at OAK v0.1 in deference to ongoing Israeli proceedings; case is documentable from indictment-stage public reporting.
Key teaching point
The IDF reservist case (Tel Aviv District Court, February 2026) — the second jurisdiction in four months to file criminal charges against operationally-involved bettors — establishes T9.006.004 as a structural recurrence rather than a single-case anomaly. The case introduces the lateral-briefing variant: the cleared person (IAF major reservist) passed operational knowledge to a civilian co-conspirator who placed the bets, decoupling the on-chain wallet identity from the cleared-personnel identity. This makes detection structurally harder — purely on-chain signals (account-age, deposit-time) do not identify the operational insider; the linkage runs through human intelligence on the briefing chain.

Timeline (UTC unless noted)

When Event OAK ref
2025-06 (pre-strike) Israeli Air Force major (reservist) briefs civilian co-defendant when Israeli warplanes are already en route to Iranian targets for the opening strike of the 12-day Israel–Iran war T9.006.004 (operational-insider briefing — cleared person passes operational knowledge laterally to civilian co-conspirator)
2025-06 Civilian co-defendant places Polymarket bets on the timing of Israel's opening strike using the briefed operational knowledge; bets resolve YES T9.006.004 (operational-insider trading via lateral briefing — decoupled wallet identity from cleared-personnel identity)
2025-06 Pair extracts ~$162,663 in winnings; civilian opens digital wallet for reservist and transfers reservist's share in cryptocurrency per agreed even split T7.001 (proceeds distribution — civilian-to-reservist wallet transfer)
2025-06 → 2025-12 Pair continues to place Polymarket bets across additional Iran-conflict markets, including a winning bet on the end-date of the 12-day war T9.006.004 (sustained operational-insider pattern — multiple bets across correlated markets)
2026-02 (early) Shin Bet (Israel Security Agency), Defense Ministry investigative unit, and Israel Police execute joint arrest operation (law-enforcement action — joint agency arrest)
2026-02 Tel Aviv District Court indictment: both defendants charged with severe security offences, bribery, and obstruction of justice; IDF characterizes conduct as grave but says no operational harm resulted T9.006.004 (Israeli indictment — second jurisdiction in four-month window to charge operational-insider trading on prediction markets)
Continuing Establishes T9.006.004 sub-pattern as multi-jurisdictional (US + IL) and structurally recurrent; demonstrates lateral-briefing decoupling of on-chain wallet from cleared-personnel identity as a detection-hardening variant (canonical reference — multi-jurisdictional operational-insider sub-pattern confirmed)

Summary

In June 2025, Israel launched its opening strike of the 12-day Israel–Iran war. The strike's timing was a closely-held operational secret circulated only inside Israeli military and intelligence channels.

According to charging documents filed in Tel Aviv District Court and reported by Israeli and international media in February 2026: an Israeli Air Force major serving as a reservist briefed his civilian co-defendant when Israeli warplanes were already en route to Iranian targets, and the civilian placed Polymarket bets on the timing of the opening strike. The bet resolved YES; the pair extracted approximately $162,663 in winnings, which they agreed to split evenly. The civilian opened a digital wallet for the reservist and transferred the reservist's share in cryptocurrency.

The pair continued to place Polymarket bets across additional Iran-conflict markets — including a winning bet on the end-date of the 12-day war — until their arrest in early 2026. Israeli prosecutors filed indictments charging both with severe security offences, bribery, and obstruction of justice, and sought to keep the defendants in custody until the conclusion of proceedings.

The IDF publicly characterised the case as serious but said no operational harm resulted, and stated that the conduct was inconsistent with IDF values.

Why this case matters for OAK

This is the second jurisdiction in a four-month window (Israel February 2026; United States April 2026) to file criminal charges against operationally-involved bettors using subjective-resolution prediction markets to monetise classified knowledge of military operations. The pair-of-cases establishes the operational-insider sub-pattern as a structural recurrence rather than a single-case anomaly:

  • Two distinct national jurisdictions (US, IL).
  • Two distinct military events (Maduro capture, January 2026; Israel-Iran opening strike, June 2025).
  • Two distinct classes of operationally-involved insider (US Special Forces NCO directly involved in operation; Israeli Air Force major reservist with classified briefing access).
  • The same on-chain venue (Polymarket).
  • The same betting structure (YES on a specific outcome in a narrow time window before public disclosure).
  • Detection through a combination of on-chain forensics + KYC at the off-ramp + counter-intelligence on the operational-actor side.

The Israeli case differs from the Van Dyke case in one structurally important way: the briefing was passed laterally to a civilian co-conspirator who placed the actual bets. This decouples the on-chain wallet identity from the cleared-personnel identity and demonstrates that purely on-chain detection (account-age, deposit-time, bet-cluster) does not by itself identify the operational insider — the linkage runs through human intelligence on the briefing chain. The forensic challenge is structurally harder than the Van Dyke case for this reason.

What defenders observed

  • Pre-event: the civilian co-defendant's account profile would not, on its own, have raised an obvious operational-insider flag — he was not a cleared person; his accounts were pre-existing or normal-aged. The signal was the timing alignment of multiple bets across Iran-conflict markets with a 93-94%-class win rate (consistent with the broader cohort flagged by Bubblemaps in early 2026 and the Anti-Corruption Data Collective's spring 2026 report finding 51.8% longshot win rates in military / defense markets vs. 14% baseline).
  • At-event: the strike timing itself, when correlated with bet-placement timestamps reconstructed by Israeli investigators, established the operational-knowledge linkage. Israeli prosecutors traced the cryptocurrency transfer pattern (civilian → wallet opened on behalf of reservist) which ties the Polymarket account to the cleared individual.
  • Post-event: Shin Bet (Israel Security Agency), the Defense Ministry's investigative unit, and Israel Police executed a joint operation to arrest both defendants. Indictment was filed in Tel Aviv District Court. The IDF characterised the conduct as "grave" but said no operational harm resulted.

Detection signals (cohort across Van Dyke + IDF reservist cases)

The two confirmed cases together establish the following signal hierarchy for the operational-insider sub-pattern:

  1. Multi-bet pattern across functionally-correlated markets on a single underlying event — present in both cases (Van Dyke held YES across four Venezuela markets; the IDF pair bet on opening-strike-timing and end-of-war markets).
  2. Win-rate against published longshot baselines — military / defense markets show 51.8% longshot win rates (ACDC) vs. 14% across all Polymarket categories. Account-level deviation against this baseline is a high-precision flag.
  3. Off-ramp KYC linkage — Van Dyke's profits were routed through a brokerage account; the IDF reservist's share moved through a civilian-opened wallet. Both cases relied on KYC reconciliation at the fiat off-ramp.
  4. Behavioural-asymmetry signature — operational insiders withdraw faster post-resolution and bet more conservatively pre-event than confidence-driven whales (the Théo / Fredi9999 contrarian pattern at the 2024 election is the structural counter-class — that whale held large positions for weeks against the polling consensus, with no operational stake in the underlying election).
  5. Off-chain corroboration is load-bearing — purely on-chain detection identifies the position; identifying the operational insider requires either KYC reconciliation, counter-intelligence on the briefing chain, or platform-side cooperation with regulators.

Mitigation surface

The Israeli case strengthens (not weakens) the mitigation argument in examples/2026-01-polymarket-venezuela-maduro-soldier-insider.md:

  • KYC at threshold and identity-cluster forensics — necessary but not sufficient. The IDF case shows that briefing chains can decouple bet identity from operational identity; KYC alone does not solve the lateral-pass case.
  • Counter-intelligence integration — defense and intelligence ministries with cleared personnel placing bets on adversary-action markets need an internal-monitoring process that includes lateral disclosure-chain monitoring, not just direct-bet monitoring.
  • Market-design constraints on operationally-correlated markets — markets resolving on classified-event timing (military strikes, special-operations actions, classified diplomatic events) face an unsolved adverse-selection problem: by definition, the only participants with information are the participants the market most needs to exclude. The strongest defense is platform-side de-listing of these markets, which is what some legislative proposals (BETS OFF Act in the US) contemplate.
  • Detection-tooling deployment — Polymarket's April 2026 Chainalysis partnership is the platform-side response. Effectiveness depends on real-time flag-and-freeze rather than retrospective analytics.

What this example tells contributors

Contributors writing OAK-T9.006.004 should treat the Van Dyke and IDF reservist cases as the two-jurisdiction structural anchor for the operational-insider sub-pattern. The pattern is now multi-jurisdictionally documented; future cases are likely to continue surfacing as KYC-cluster forensics become standard.

The unresolved tension is whether subjective-resolution markets on classified-event timing should exist at all. The market-design literature treats this as an adverse-selection problem with no clean solution: the participants the market most needs to attract for honest price discovery (informed bettors) are categorically the participants the market most needs to exclude (operational insiders). The best documented defense is venue-level prohibition on the underlying market class.

Public references

Techniques demonstrated (2)