The two largest prediction market platforms by trading volume are both moving into perpetual futures trading, per reports arriving within hours of each other on Tuesday, April 21.

Polymarket’s move is official. The on-chain prediction marketplace posted on X Tuesday evening: “Perps are coming to Polymarket.” The platform is accepting early access sign-ups for the product, which will allow traders to take leveraged long or short positions on assets including BTC, stocks, and gold without a fixed expiration date.

Separately, The Information reported on Tuesday morning that Kalshi plans to launch crypto trading, beginning with perpetual futures, citing people familiar with the matter.

According to the report, Kalshi will start with crypto perps and may expand to perps tied to other asset classes over time.

Perp trading has exploded in popularity over the past year, notably on decentralized platforms, mostly led by Hyperliquid. But centralized platforms, led by Binance, still dominate in terms of volumes and open interest, per CoinGecko data.

Commodity Futures Trading Commission Chairman Michael Selig said last month that the agency plans to allow regulated perpetual futures in the United States, to attract trading volume back from offshore platforms.

The Information’s report notes that Kalshi recently secured a CFTC margin trading license, positioning it to offer the product.

The move would put both Polymarket and Kalshi in more direct competition with both centralized and on-chain exchange platforms, several of which, like Coinbase, have begun adding prediction markets.

Combined monthly trading volumes on Kalshi and Polymarket last month reached over $23 billion, an all-time high. Since the start of this year, both platforms have consistently seen near or over $2 billion in trades each week, per Token Terminal data.

Regulatory Questions

The launches come amid rapid regulatory change for the sector. The CFTC launched a sweeping review of prediction markets in March, after Chair Selig clarified that the agency thinks such platforms should be regulated federally, not by each state. At the same time, both platforms continue to face state-level legal pressure, as gambling is a state-regulated activity in the U.S. and multiple states have alleged that the platforms need gambling regulator licenses to operate in the state.

This article was written with the assistance of AI workflows. All our stories are curated, edited and fact-checked by a human.

Security researchers have linked a new macOS malware campaign to the Lazarus Group, the North Korea-linked hacking operation behind some of the crypto industry’s biggest thefts.

Flagged on Tuesday, the new “Mach-O Man” malware kit is distributed via “ClickFix” social engineering schemes across traditional businesses and crypto companies, according to Mauro Eldritch, offensive security expert and founder of threat intelligence company BCA Ltd.

Victims are lured into a fake Zoom or Google Meet call where they are prompted to execute commands that download the malware in the background, allowing attackers to bypass traditional controls without detection to gain access to credentials and corporate systems, the security researcher said in a Tuesday report.

Researchers said the campaign can lead to account takeovers, unauthorized infrastructure access, financial losses and the exposure of critical data, underscoring how Lazarus continues to expand its targeting beyond crypto-native companies.

The Lazarus Group is the main suspect in some of the largest-ever cryptocurrency hacks, including the $1.4 billion hack of Bybit exchange in 2025, the industry’s largest so far. 

“Mach-o Man” kit seeks to implement hidden stealer malware

The final stage of the campaign is a stealer designed to extract browser extension data, stored browser credentials, cookies, macOS Keychain entries and other sensitive information from infected devices.

After collection, the data is archived into a zip file and exfiltrated through Telegram to the attackers. Finally, the malware’s self-deletion script removes the entire kit using the system’s rm command, which bypasses user confirmation and permissions when removing files.

The novel malware kit was reconstructed by the security expert through cloud-based malware sandbox Any.run’s macOS analysis capabilities.

Related: CZ sounds alarm as ‘SEAL’ team uncovers 60 fake IT workers linked to North Korea

Earlier in April, North Korean hackers used AI-enabled social engineering schemes to steal about $100,000 worth of funds from crypto wallet Zerion, after gaining access to some team members’ logged-in sessions, credentials and the company’s private keys, Cointelegraph reported on April 15. 

Magazine: 53 DeFi projects infiltrated, 50M NEO tokens could be ‘given back’: Asia Express