CertiK warned that hybrid security risks and expanding state regulation could fragment liquidity and pressure long-term sustainability.
The surge in prediction markets is masking deeper structural strains, with inflated volumes, fragile security architecture, and state-level regulation increasingly testing whether prices, liquidity, and access can hold up as the sector scales.
That’s according to a new report from blockchain security firm CertiK, which said that trading volumes quadrupled in 2025 as activity concentrated around a small group of dominant platforms, even as security and regulatory risks intensified.
Annual trading volume climbed from $15.8 billion in 2024 to about $63.5 billion in 2025, with liquidity consolidating around three platforms: Kalshi, Polymarket, and Opinion.
That growth, however, has been heavily driven by incentives and event-driven spikes rather than steady organic demand, raising questions about sustainability once subsidies fade.
CertiK cites academic research showing wash trading on Polymarket rose sharply in 2024, peaking near 60% of reported volume as traders farmed incentives through circular trades.
While this inflated liquidity metrics, CertiK claimed prices have largely remained reliable, with manipulation affecting market appearance more than forecasting accuracy.
To CertiK, the distinction between inflated activity and broken markets comes down to whether artificial trading begins to affect how prices are formed rather than how volume is reported.
“The key indicators would be persistent price divergence between platforms on the same event that arbitrage doesn’t close, probability movements without corresponding news or data releases driven by concentrated wallet clusters, and systematic bias in how markets price outcomes relative to actual resolutions,” CertiK told Decrypt in an interview.
If prediction markets remain “consistently off by 5-10 points in one direction” and such a pattern “correlates with identifiable whale or wash trading activity” that could be evidence that “fake volume is bleeding into price formation,” CertiK said.
CertiK maintains it has not seen evidence of wash trading distorting prices at scale on major platforms, with market probabilities remaining broadly reliable even during periods of elevated artificial activity.
It cautioned, however, that the data remain limited and that lower-liquidity markets could become more vulnerable as incentive programs draw in more sophisticated traders.
Beyond market integrity, CertiK warned that the prediction market sector’s rapid growth has outpaced the maturity of its security architecture, leaving structural weaknesses that become more consequential as platforms scale and attract more users.
Hybrid Web2/Web3 designs exist to balance ease of onboarding with on-chain transparency, but combining them “creates exposure to both attack surfaces simultaneously,” CertiK said.
In December 2025, attackers exploited a flaw in the authentication flow of Magic Labs, a third-party login service used by Polymarket for email-based access. The vulnerability allowed attackers to bypass two-factor authentication and take control of user accounts created through Magic’s email login.
The Polymarket incident shows that a failure in authentication can put user funds at risk even when smart contracts are secure, CertiK said.
“Addressing this requires treating the full stack as a single security surface, auditing and testing authentication, key management, and settlement together rather than in isolation,” the security firm said.
Looking ahead, CertiK said the prediction market sector is entering 2026 at a crossroads, with functioning infrastructure and clearer U.S. federal policy offset by unresolved questions around sustainability and oversight, as prediction market platforms continue to tussle with regulators.
The security firm expects the current dominance of Kalshi, Polymarket, and Opinion to persist, but says growth will hinge on whether platforms can retain users without incentives, navigate state-level restrictions, and adapt as jurisdictions weigh their own regulatory frameworks.
Still, CertiK cautioned that inflated activity only becomes a systemic risk once it begins to affect how prices are formed.
Decrypt has reached out to Polymarket for comment and will update this article should they respond.
