On December 26, the day after Christmas, a 38-year-old soldier at Fort Bragg moved $35,000 from his personal bank account into a cryptocurrency exchange. According to the Justice Department, he was one of the people planning Operation Absolute Resolve, the mission to capture Venezuela's Nicolás Maduro. On that particular Friday he knew something almost nobody else alive knew.

The next day he started buying shares on Polymarket, a crypto betting site, in a contract titled "Maduro Out by January 31, 2026?" A share paid $1 if Maduro was gone by the deadline and nothing if he wasn't, and since the crowd figured he'd still be there, some shares sold for about a nickel. Prosecutors say he placed about 13 bets on Maduro-related contracts, $33,034 in all, under the handle Burdensome-Mix. I don't know whether he picked that name or the site picked it for him.

Before dawn on January 3, the operation went and Maduro was taken. Prosecutors put the soldier's profit at about $409,881, and the CFTC says the winnings went back into a personal bank account in his name.

Two days later, after traders on X flagged a brand-new account that had bet only on Maduro's fall, Fortune wrote it up. On April 23, the Justice Department charged Gannon Ken Van Dyke with 3 counts of violating the Commodity Exchange Act, 1 count of wire fraud, and 1 count of engaging in an unlawful monetary transaction. The wire fraud count alone carries up to 20 years. He hasn't been convicted of anything.

Last week the fraud ran through a trusted room, a church fellowship hall where a lab swabbed everyone holding a Medicare card. This week it runs through information: who has it, who trades on it, and which of them ever pays. First, the people betting on government secrets. Then a reader's call from a fake detective who asked for nothing, which turned out to be the point.

We've never dug into betting markets here, and this newsletter doesn't run their ads. What you do with your own money is your business, and I mean that. I just won't sell you a seat at a table where the other player might already know how it ends.

The Bet on the Raid

These sites call themselves prediction markets. You buy Yes or No on a question with a deadline, the price floats between $0 and $1, and the price is the crowd's guess at the odds. A nickel means about a 5% chance. If you already know the answer, every nickel comes back as a dollar.

The CFTC, the federal agency that polices futures and commodities markets, sued Van Dyke the same day he was charged, and its chairman, Michael Selig, didn't talk about it like a gambling case.

The agency called it its first insider trading case over event contracts, the regulators' term for these bets, and the first time it had ever used the Eddie Murphy Rule, a 2010 Dodd-Frank provision against trading on misappropriated government information. The nickname comes from Trading Places, where two old brokers try to corner the orange juice market with a stolen government crop report. If you haven't seen it, it holds up better than most of Dodd-Frank.

Van Dyke's lawyers argue the CFTC has no business here, because a bet on Maduro's fate isn't a "swap" under commodities law. A federal judge in New York has paused the CFTC's civil case until the criminal case is done, and when the agency asked to weigh in anyway, the defense called it "a regulatory wolf."

The Man Behind the Teleprompter

The second case sits closer to the Oval Office. Gabriel Perez had run the White House teleprompter since 2016, and the job meant he saw the President's remarks before the President read them.

Kalshi, a betting exchange the CFTC regulates, used to offer mention markets, contracts on whether a speaker will say a particular word during a scheduled appearance. The CFTC says Perez "misappropriated that information" in breach of "his duty of trust and confidence" and traded on words he'd already read. From December 2025 to February 2026 he won 39 of 43 contracts across 14 markets, for about $107,500 in profit.

After ABC News reported the trades in July, the White House put him on unpaid leave. On August 28 he settled with the CFTC: the profit back, a $65,000 penalty, about $172,000 in all, and a 3-year trading ban. ABC reported that federal prosecutors declined to bring a criminal case. Last week the CFTC called mention markets "presumptively readily susceptible to manipulation."

I want to be fair about the difference. The soldier is accused of trading on a classified military operation, where a leak can get people killed, and the teleprompter operator traded on a speech that was about to be public anyway. The law should treat those differently, and it does. But both men traded through accounts tied to their own names and money, and both left a pattern you could see from across the room: a brand-new account betting only on Maduro, and 39 wins in 43 tries.

The Trades With No Names

Now look at the trades nobody has been charged for. On Saturday, March 21, the President threatened to "obliterate" Iran's power plants. Shortly after 7 a.m. Eastern on Monday, March 23, he posted that talks with Iran had been "productive," and oil tumbled while the Dow jumped more than 1,000 points. Between 6:49 and 6:50 that morning, about 6,200 Brent and West Texas Intermediate oil futures contracts changed hands, roughly $580 million worth, according to CBS News. The average for that minute over the previous 5 trading days was about 700.

A lawyer at Troutman Pepper Locke told CBS the spike was "certainly enough to raise eyebrows, and I think to launch an investigation." The White House said federal employees are bound by rules that "prohibit the use of nonpublic information for financial benefit." Nobody has been named or charged. In April, Representative Ritchie Torres, a New York Democrat, asked the CFTC to investigate a $760 million oil futures trade placed about 20 minutes before Iran's foreign minister announced the Strait of Hormuz would reopen. I couldn't find a public result.

The oldest example is still the cleanest. At 9:37 a.m. on April 9, 2025, a week after new tariffs knocked about $5 trillion off the S&P 500 in 2 trading days, the President posted "THIS IS A GREAT TIME TO BUY!!! DJT." At 1:18 p.m. he paused most of those tariffs for 90 days, and the S&P closed up 9.5%. That afternoon in the Oval Office, on camera, he talked about 2 businessmen in the room, one of them reportedly Charles Schwab.

Six senators asked the SEC to investigate, and I can't find a public response. Legal experts told PBS the public post probably protects him, because information posted to millions of people isn't inside information. But the post didn't say a pause was coming at 1:18. Whoever knew that, knew it before you did.

We Only Catch the Careless Ones

I spent years building financial cases, and most of them started with a bank record. Somebody moved money out of an account with his name on it and back into another one, and the paperwork told the story. The Maduro bettor, according to the CFTC, funded his bets from his personal bank account and moved the winnings back to it. The teleprompter operator won 39 of 43. Neither of them is a mastermind, and both ended up in a press release.

The careful insider doesn't open a fresh account the day after Christmas and bet on the one outcome only an insider would bet on, and he doesn't route the winnings back to a bank account in his own name. He works in the deepest markets in the world, through people whose names never lead back to his. I'm not going to draw you a diagram. Every investigator already knows the cases you read about are the ones that were easy to see.

And enforcement is shrinking while the market grows. Senator Elizabeth Warren wrote in June that CFTC enforcement actions fell from 58 in fiscal 2024 to 11 over the following year, a claim in a letter rather than a finding. Pew says trading volume on these markets doubled between May and July, and a CNN headline last week called the midterms "the first prediction-market election."

The President's family has a stake, too. Donald Trump Jr. has advised Kalshi since early 2025 and sits on Polymarket's advisory board, and on September 1 Forbes reported that his venture firm, 1789 Capital, would put about $300 million into a Polymarket funding round valuing the company at $21 billion. In July 2025 the Justice Department and the CFTC closed their Polymarket investigations without charges. None of that has been shown to be illegal. It does mean the family has money in an industry the President's appointees regulate.

Congress has noticed from both sides. Torres has a bill that would bar federal officials from betting on government actions they have inside knowledge of, and it hasn't moved. In May, House Oversight Chairman James Comer, a Republican, opened an investigation into government employees trading on these markets. As of this week the tally is 1 soldier charged, 1 teleprompter operator fined, and hundreds of millions of dollars in well-timed oil trades with nobody's name on them.

The Call That Asked for Nothing

The soldier, if the government is right, cashed in a secret he already had. The man who recently called one of my readers was still out collecting his.

The reader works in digital security infrastructure, so he's nobody's idea of an easy mark, and he calls it one of the most sophisticated scam calls he's ever taken. The caller said he was with the Chicago Police Department, investigating identity theft. He gave a name, a badge number, and a case number, and he told the story in detail: police had arrested someone holding personal information on hundreds of potential victims, the reader included. The reader has spent a good deal of time in Chicago, he notes, none of it in a police station. Maybe the caller picked the city at random. I doubt it.

He knew one of the reader's email addresses, which proves nothing in 2026. He also knew the reader had once used a particular hardware wallet, one of the small devices people buy to keep cryptocurrency offline. That's a more private fact.

Then the caller did something scammers almost never do. He didn't threaten, and he didn't ask for money, passwords, account numbers, a recovery phrase, or a code. He gave good advice, again and again: report it to your local police, call your banks yourself, change your passwords, turn on two-factor authentication. I'd give you the same list, and the reader says that advice is what made the call believable enough, and interesting enough, to keep listening.

Then the questions shifted. Did the reader know crypto? Yes. That wallet? He used to. And what other companies did he use?

He wouldn't say. The caller explained he only needed company names, not account numbers, so investigators could warn the companies about the breach. The reader said no again. The caller explained again, then a third time, and the reader ended the call by telling him that a detective who keeps pushing for the names of your banks starts to sound like the thief he's chasing. Afterward the reader called the Chicago Police Department. No officer by that name and badge number existed, and the badge number wasn't even in a valid format.

From the Mailing Label to the Front Door

Why work that hard for a few company names? Because they tell the next caller who to pretend to be. A name, a phone number, and one confirmed crypto holding make a lead. Add the bank, the brokerage, and the exchange, and the next call comes from "your bank's fraud department," placed by someone who knows exactly which one you'll believe. The reader's conclusion was that privacy is part of security, and the thing worth protecting isn't always a credential.

And 2026 has been a bad year for anyone who ever ordered a hardware wallet. Ledger disclosed a customer data exposure through a payment partner in January, and SafePal disclosed one affecting 39,798 customers in August. Trezor said a breach at its shipping partner exposed 13,689 customers, then on September 4 added 67,000 more in the US, for 80,689 names, emails, phone numbers, and shipping addresses going back to 2019. Trezor's notice warned the data "could be used for scam emails, fraudulent calls or letters, and could potentially expose affected individuals to physical security risks." I don't know which company the reader bought from. It doesn't much matter.

Physical security risk looks like this. On January 31, 2 California high school students, 16 and 17, forced their way into a home in Scottsdale, Arizona, dressed as delivery drivers, police say, then duct-taped 2 adults and demanded crypto. They were after $66 million. According to court documents cited by local reporters, someone using the names "Red" and "8" contacted them on Signal, supplied the home address, and sent $1,000 for supplies. The kids were hired muscle. Somebody else did the research.

Chainalysis counted more than $30 million stolen in what the industry calls wrench attacks, where criminals use force to make someone unlock their crypto, in the first half of 2026, against $58 million in all of 2025, and says home invasions are now 37% of incidents, up from 26% in 2023.

The older version needs only a phone and a courier. The FBI counts $1.6 billion lost to fake police and officials from January 2025 to July 2026, across about 61,000 complaints, with couriers on its list of how victims paid. New York's Attorney General says the NYPD has investigated more than 100 cases in 2 years, with over $100 million lost, where a fake agent persuades an older person to turn savings into gold and hand it to a courier at the door. In one Missouri case, a woman was told she owed back taxes on a PayPal deposit that had supposedly landed in her account by mistake, and was instructed to buy $200,000 in gold bars. A single courier in that case, prosecutors say, made at least 65 pickups worth $5.4 million.

Field Manual

Five controls for the call that asks for nothing, and one for whoever runs the company.