PEPE Exchange Netflow, Source: CoinGlass

The U.S. Commodity Futures Trading Commission has warned federally regulated prediction markets that contracts settling on what named people say, attend or do may face a presumption of being readily susceptible to manipulation.

The CFTC’s Division of Market Oversight issued the staff advisory on Sept. 22, covering contracts based on specific words or phrases, event attendance, public appearances and interactions between individuals. The guidance applies directly to designated contract markets and describes only limited circumstances in which such products may satisfy existing federal market-integrity requirements.

Unlike a new Commission rule, the advisory is informational and expressly says it creates no new legal obligations. Exchanges remain responsible for complying with the Commodity Exchange Act, including Core Principle 3, which requires designated contract markets to list only derivatives that are not readily susceptible to manipulation.

The CFTC today issued an advisory that addresses the listing and trading of event contracts for “mentions markets” such as if a specific person will attend an event or mention certain words during an event.

CFTC declares the contracts “present a heightened risk of manipulation.”

— RLinnehanSR (@RLinnehanSR) September 22, 2026

CFTC says mention markets can be presumed manipulable

Mention markets differ from contracts based on election results, economic releases or regulated sporting outcomes because settlement can depend on conduct controlled by one named person or a small group, according to the advisory. The regulator cited examples involving speeches, earnings calls, social-media posts, event appearances, photographs and personal interactions.

CFTC staff said a person controlling an outcome could deliberately trigger it, prevent it from occurring or know the result before traders outside that person’s circle. A podcast host, for example, could say a word tied to a contract payout, while people with access to scripts, prepared remarks or guest lists might possess material nonpublic information before settlement.

For that reason, the Division of Market Oversight said it may view mention markets as “presumptively readily susceptible to manipulation.” The phrase represents staff’s regulatory view under Core Principle 3 and does not mean every contract in the category is automatically prohibited.

A designated market could rebut that presumption in limited cases by showing that its contract design and controls sufficiently reduce manipulation risks. Staff identified independent verification and substantial public scrutiny as central considerations when evaluating those products.

The advisory asks exchanges to examine whether the person controlling settlement faces legal, professional, fiduciary, confidentiality, contractual or organizational duties that discourage deliberate interference. Exchanges should separately consider whether outside traders could influence the individual through payments, social pressure, inducements or other forms of interference.

Public settings receive particular attention. CFTC staff said formal events involving public figures may provide stronger independent verification, while conduct occurring privately or involving non-public people can be harder to verify and monitor. Even a public speech may present concerns when a contract turns on an incidental word with little connection to the substance of the event.

Recent cases show how insiders can control outcomes

The advisory follows two CFTC enforcement cases involving traders whose own access or conduct affected event-contract outcomes.

On Aug. 28, the regulator ordered former White House teleprompter operator Gabriel Perez to disgorge $107,539.02 and pay a $65,000 civil penalty after finding that he used advance access to President Donald Trump’s speeches to trade presidential mention contracts. Perez received a three-year trading ban.

Between December 2025 and February 2026, Perez had access to presidential speeches before delivery because of his federal employment, according to the CFTC order. The Commission found he misappropriated that information and generated more than $107,500 in trading profits. The CFTC credited KalshiEX for assisting the investigation.

As previously reported, the White House speech betting case involving advance access to Trump’s remarks ended with Perez agreeing to more than $172,000 in disgorgement and penalties after the regulator completed its investigation.

A separate July case involved former Rep. George Santos. The CFTC found that Santos traded contracts on whether he would attend the 2026 State of the Union while making public statements about his own attendance plans.

The regulator said contract prices moved in directions favorable to Santos after several of his social-media statements. Its settlement required him to disgorge $17,569.98, pay a $17,500 civil penalty and accept a three-year trading ban.

Kalshi later imposed its own permanent suspension. Kalshi’s lifetime ban on Santos over the State of the Union market followed the federal enforcement action and covered his access to the exchange directly or indirectly.

Kalshi keeps some mention markets live under tighter scrutiny

The new guidance does not amount to an industrywide ban on mention contracts.

As of Sept. 23, Kalshi still displayed markets tied to what Trump would say during United Nations meetings, including contracts covering terms such as AI, NATO and ceasefire. Another contract covering Trump’s United Nations General Assembly speech had recorded nearly $194,000 in volume in the available snapshot.

CFTC filing records show Kalshi previously self-certified amendments covering contracts asking whether a specific word would be said by a person, including a separate template tied to Trump. Those amendments were recorded as certified in June.

The Sept. 22 advisory means future Part 40 submissions involving such products are expected to contain more detailed, contract-specific manipulation analysis. Staff encouraged platforms to identify potential controllers and known insiders, then calibrate position limits, reporting requirements, recordkeeping and surveillance controls around those risks.

Staff said independent obligations placed on the person controlling an outcome do not replace the exchange’s own market-surveillance duties. Exchanges seeking to list a mention contract are expected to explain how their rules can detect manipulation, attempted manipulation and misuse of nonpublic information.

Kalshi has already reduced its exposure to some parts of the category. CFTC review of mention markets prompted Kalshi to pull sports mention contracts in August while political and corporate versions remained available.

A separate development arrived on the same day as the new CFTC advisory. Kalshi Klear requested approval for a margin framework covering selected event contracts, but mention and culture markets were excluded from the proposed eligible group, according to its filing coverage.

Prediction-market rulemaking remains unfinished

The mention-market advisory sits alongside a separate CFTC rulemaking process covering event contracts more generally.

The Commission proposed amendments to Regulation 40.11 in June that would create a formal process for assessing contracts involving areas Congress specifically identified, including gaming, terrorism, assassination, war and activities unlawful under federal or state law. The proposal includes a 90-day review process and contract-specific public-interest factors.

CFTC data said trading volume on federally registered prediction markets surpassed $25 billion during 2025. The regulator described event contracts as a growing part of derivatives markets while noting that the figure remained small beside the roughly $31 trillion notional value of the overall futures market it regulates.

The Commission has not published a final version of the June prediction-market proposal as of Sept. 23. Its current 2026 final-rule list does not show a completed Regulation 40.11 rulemaking, leaving the Sept. 22 staff advisory operating under existing Core Principle 3 and Part 40 requirements.

The federal framework is developing while courts consider separate disputes over state gambling authority. On Aug. 28, the Ninth Circuit ruled that Kalshi had not shown Nevada’s regulation of its sports event contracts was likely displaced by the Commodity Exchange Act, allowing Nevada’s sports-related enforcement to continue while other issues returned to the lower court.

As previously reported, the Ninth Circuit’s Nevada ruling on Kalshi’s sports prediction contracts did not invalidate the CFTC’s prediction-market rules or decide how every category of event contract must be treated.

Polymarket’s U.S. operation is part of the federally registered market structure through QCEX. CFTC records show amendments to the Polymarket U.S. rulebook were certified in April, while QCEX has continued filing event products with the regulator during 2026.

For mention markets specifically, the next compliance step falls on designated contract markets when they submit new products or amendments under Part 40. The Sept. 22 advisory says staff expects each filing to provide a detailed evaluation of the manipulation factors and describe the controls intended to address them.

Apple’s App Store has once again been used as a delivery channel for a crypto theft operation. According to an investigation by blockchain security firm SlowMist, a malicious iOS app named FomoPeek was linked to nearly $580,000 in stolen crypto, with the attackers using kernel-level exploits to break out of Apple’s sandbox and reach sensitive wallet data.

SlowMist says the compromise targeted specific app versions, while a later release removed the malicious components. The incident highlights a persistent risk for mobile users: even when an app is distributed through official stores, flaws at the operating-system level can enable attackers to access data that should remain protected.

Key takeaways

• SlowMist links FomoPeek to about 579,984 USDT stolen after the app contained kernel exploits capable of escaping iOS sandbox protections.
• Only certain versions were affected: SlowMist points to releases on Sept. 9 and Sept. 12, with version 1.3 released on Sept. 17 removing the malicious modules.
• The malicious code targeted protected data: researchers report access to iOS Keychain data and files belonging to other apps.
• Onchain tracing shows cross-network movement: funds were routed through multiple blockchains and later consolidated through several addresses and services.

What SlowMist found inside the FomoPeek app

In its threat intelligence analysis, SlowMist said FomoPeek included multiple malicious modules designed to exploit iOS vulnerabilities. The goal, according to the report, was to gain elevated privileges and escape the constraints of Apple’s application sandbox.

Once the app achieved this elevated access, SlowMist reports it could reach Keychain data as well as files belonging to other apps. For users, that matters because Keychain entries often store credentials and other sensitive material used by wallets and related services—data that normally remains isolated from third-party applications.

SlowMist said the malicious components were part of the app releases issued on Sept. 9 and Sept. 12. The firm added that version 1.3, released on Sept. 17, removed the harmful elements.

Release timing and the window of exposure

SlowMist’s timeline indicates the attack depended on users installing (or keeping) the affected FomoPeek versions rather than a permanently compromised build. The firm said its investigation began after it received reports from users who experienced asset theft and confirmed that at least some of those users had installed one of the vulnerable releases.

This distinction is important for practical risk management. Even if a malicious app is later patched or sanitized, the harm can already be done during the earlier window—especially when the app can exploit kernel weaknesses and access protected data. For mobile users and wallet operators, the lesson is that version-by-version scrutiny can be just as critical as store-level distribution.

Exploit framework details and affected iOS ranges

SlowMist said the exploit framework it observed featured eight attack methods. The report describes intended support for a broad set of iOS versions, including 12.0 to 18.7.2 and 26.0 to 26.1.

The breadth of those ranges underscores why kernel exploitation is so difficult to contain. When an attacker can target multiple configurations, the same malicious app can potentially work across a larger portion of the installed base, increasing the likelihood of successful compromise.

Onchain analysis: nearly $580,000 in stolen crypto

Beyond the app-side findings, SlowMist analyzed the associated blockchain activity. The firm identified a primary hacker address tied to the incident that received approximately 579,984 USDT.

According to SlowMist, the address became active on Sept. 15—after the initial affected releases—suggesting the theft activity followed the period during which users could have installed vulnerable versions. SlowMist further said the stolen funds were spread across multiple blockchain networks before being consolidated through additional addresses and services.

SlowMist reported that portions of the funds were routed toward services including FixedFloat, KuCoin, and cce.cash, while other portions were dispersed through additional addresses that the firm continued to trace.

For investors, traders, and compliance teams, this pattern is typical of efforts to obscure fund trails: attackers frequently move value across networks, fragment flows through intermediaries, and then consolidate proceeds in ways that make attribution harder.

Attempts to get responses

Cointelegraph said it reached out to Apple, SlowMist, and OKX for comment. The outlet reported that it did not receive a response before publication.

SlowMist’s investigation was conducted together with the OKX security team, according to the report. The collaboration points to how incident response in crypto increasingly blends onchain forensics with software security research—especially when attacks originate in mainstream distribution channels like app stores.

Users who installed FomoPeek on iOS versions before the reported removal on Sept. 17 should consider reviewing wallet permissions and checking whether any accounts show unauthorized activity. The key uncertainty going forward is whether additional malicious versions or related packages exist outside the specific releases SlowMist identified—and whether Apple or the broader mobile security community will accelerate defenses against kernel-exploit delivery through app-store software.

A malicious iOS app distributed through Apple’s App Store has been linked to nearly $580,000 in stolen crypto after researchers found it contained multiple kernel exploits capable of escaping Apple’s sandbox and accessing sensitive wallet data.

According to an investigation published by blockchain security firm SlowMist, the app, called FomoPeek, introduced two malicious modules that could exploit iOS vulnerabilities, gain elevated privileges and access Keychain data and files belonging to other apps. 

SlowMist said the affected versions were released on Sept. 9 and Sept. 12, while version 1.3, released Sept. 17, removed the malicious components.

SlowMist said its investigation, conducted with the OKX security team, began after it received reports from users who had suffered asset theft and found that some had previously installed the affected FomoPeek versions.

The exploit framework included eight attack methods and declared support for iOS versions ranging from 12.0 to 18.7.2 and 26.0 to 26.1.

SlowMist’s onchain analysis identified a primary hacker address associated with the incident that received about 579,984 USDT. The firm said the address became active on Sept. 15 and that the stolen funds involved multiple blockchain networks before being consolidated and transferred through several addresses and services.

SlowMist said portions of the funds were transferred toward services including FixedFloat, KuCoin and cce.cash, while other funds were dispersed through additional addresses that the firm continued to trace.

Cointelegraph reached out to Apple, SlowMist and OKX for comment but did not receive a response before publication.

Related: Hugging Face hack exposes the open-weight AI cybersecurity paradox

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

A planned upgrade to make Solana even faster has moved to a testnet, where developers will try to cut the time a payment takes to become irreversible from about 13 seconds to 0.15 seconds.

That moment is known as finality. Exchanges wait for it before crediting deposits, bridges wait before releasing money on another blockchain and merchants need it to know that a payment cannot be taken back.

The upgrade, called Alpenglow, is now being introduced on Solana’s public test network, a copy of the blockchain that uses tokens with no monetary value. Developers can test the migration, find problems and restart the network without putting users’ money at risk.

Solana currently uses a system called TowerBFT to reach consensus, the process through which validators agree on which transactions belong in the permanent record. Validators record their votes on the blockchain and stack enough of them across 32 slots before a block becomes final.

Alpenglow replaces that system with a voting protocol called Votor. Validators send votes directly to one another and can settle on a block after one or two rounds, removing the long chain of onchain votes.

Whether this year follows a similar path – a red October followed by a big bull run – or takes a different route entirely, isn’t something the 2012 precedent can settle on its own. The sample size is too small. Bitcoin has been trading from at least late 2010 and since then, this pattern has shown up only once. So, there isn’t enough repetition to draw a meaningful conclusion about what happens next.

Still, the setup is noteworthy because of its rarity, the outsized rally that followed the 2012 example and bitcoin’s broader four-year market cycle. Some cycle models point to a potentially bullish phase beginning around October or November, although historical cycle patterns are approximate rather than fixed calendar rules

The magnitude of any rally may also be smaller than in bitcoin’s early years. In 2012, bitcoin was a thinly traded asset worth barely $10, and its market could be moved by a relatively small number of buyers.

Today, bitcoin is part of a multi trillion dollar market with substantial institutional participation, deep spot and derivatives liquidity across dozens of venues, and a broad range of directional and relative-value strategies, including options, futures and basis trades. Those markets did not exist at comparable scale in 2012, making a rally of similar percentage magnitude much harder to achieve today.