Insider Threat

State of play.

• The CFTC has established prediction markets as an insider trading enforcement priority, with Director Miller naming Commodity Exchange Act Section 6(c)(1) as the statutory hook and the Van Dyke prosecution as the first live case .
• The North Korean laptop farm sentencing has reframed remote hiring as a national security compliance obligation: DOJ sentenced two U.S. nationals for operating a scheme that placed DPRK workers inside more than 300 U.S. companies using stolen identities and generative AI, with the operation now expanding into European markets (→ North Korean Laptop Farms Enable $5M Identity Fraud Scheme Posing as U.S. Remote Workers).
• Presidential trading disclosures have surfaced a live conflict-of-interest question: over 3,700 stock trades executed through Charles Schwab in Q1 2026, targeting companies whose executives accompanied Trump on a China trip and tech stocks Trump has publicly promoted, with Sullivan & Cromwell reportedly raising internal concerns about its engagement .
• Congress has moved to cut off its own access, with the Senate unanimously prohibiting senators and staff from trading on prediction markets — a structural acknowledgment that nonpublic government information creates inherent conflicts on these platforms .
• For counsel advising financial services clients, government contractors, technology companies with remote workforces, or any entity whose personnel hold nonpublic information, the practical baseline is that insider threat exposure now runs across three simultaneous vectors: prediction market enforcement, state-sponsored workforce infiltration through fake remote workers, and executive branch trading activity that may trigger SEC or DOJ inquiry.

Where things stand.

• Prediction markets are now subject to the same anti-fraud framework as traditional markets. The Van Dyke prosecution establishes that Commodity Exchange Act Section 6(c)(1) reaches event contracts, and the CFTC has named prediction market insider trading as its top enforcement priority .
• Parallel DOJ-CFTC enforcement is the operative model. The Van Dyke case features simultaneous criminal charges from DOJ-SDNY and civil charges from the CFTC — the same dual-track structure that governs traditional securities and commodities enforcement .
• The CFTC's cooperation policy has been restructured around a binary declination framework. Self-reporters who cooperate fully and remediate — including root-cause analysis, compliance upgrades, and disgorgement — face a clear path to no enforcement action; non-cooperators face heightened scrutiny and potential DOJ criminal referral .
• Remote hiring now carries national security compliance implications. The DPRK laptop farm scheme compromised more than 300 U.S. companies between 2020 and 2024 using stolen identities, generative AI, and physical U.S.-based infrastructure to bypass location-based security checks — and has since expanded into European markets (→ North Korean Laptop Farms Enable $5M Identity Fraud Scheme Posing as U.S. Remote Workers).
• The policy-trade nexus is under active investigative pressure. Democratic senators have formally requested SEC and DoD scrutiny of trades that anticipated Trump administration policy moves; separately, OGE disclosures document over 3,700 trades in Q1 2026 targeting companies with direct regulatory exposure to administration decisions .
• Congressional participation in prediction markets is now prohibited at the Senate level, with the House having passed related restrictions — removing the most obvious source of legislative-branch MNPI from these platforms .
• External social engineering targeting executives is escalating as an insider-threat vector. Former Black Basta affiliates are running automated campaigns against C-suite personnel in manufacturing and professional services — credential theft followed by ransomware or extortion, with the attack cycle completing in under 12 minutes .
• Law firm insider threat is a live exposure. An ex-Williams & Connolly clerk has been accused of posting client information — a reminder that privileged-access personnel at professional services firms present the same insider-threat profile as corporate employees .
• The SEC has signaled a lighter regulatory touch at the macro level, but the March 2026 SEC Speaks conference confirmed that core fraud and insider trading enforcement remains active .

Latest developments.

• DOJ sentenced two U.S. nationals — Kejia Wang and Zhenxing Wang — for operating a multiyear DPRK laptop farm scheme that infiltrated over 300 U.S. companies using at least 80 stolen identities and generated more than $5 million for the North Korean regime; the operation has since expanded into European markets (→ North Korean Laptop Farms Enable $5M Identity Fraud Scheme Posing as U.S. Remote Workers).
• OGE disclosures revealed over 3,700 stock trades executed by President Trump in Q1 2026 through Charles Schwab, generating between $50 million and $70 million in buy orders, with Sullivan & Cromwell reportedly raising internal partner concerns about its engagement .

Active questions and open splits.

• What statutory theory supports the Van Dyke charges? The specific charges remain under seal, leaving open whether DOJ is proceeding under securities fraud, commodities fraud, or a military-specific statute — a question that will define the scope of the precedent for non-military MNPI holders .
• How far does CEA Section 6(c)(1) reach into event contracts? The CFTC's first enforcement action establishes the hook but not its outer limits — whether the same theory applies to corporate MNPI (earnings, M&A) traded on prediction markets is unresolved .
• Does executive branch policy information constitute MNPI on prediction markets? The Democratic senators' demand for SEC and DoD investigations raises the question of whether nonpublic knowledge of administration policy decisions — tariffs, sanctions, military operations — triggers existing anti-fraud statutes when traded on event contracts; the presidential trading disclosures sharpen this question considerably .
• What verification obligations attach to remote hiring after the DPRK sentencing? The laptop farm scheme demonstrates that standard onboarding checks are insufficient against state-backed identity fraud using generative AI; whether courts or regulators will impose a specific continuous-verification duty — or whether existing negligent hiring doctrine is adequate — is unresolved (→ North Korean Laptop Farms Enable $5M Identity Fraud Scheme Posing as U.S. Remote Workers).
• Will the Senate ban extend to broader federal regulation of the platforms themselves? The unanimous Senate vote addresses congressional participation but leaves open licensing requirements, tax treatment, and compliance obligations for Kalshi, Polymarket, and similar platforms .
• How does the CFTC's binary-declination framework interact with DOJ criminal referral risk? The cooperation policy creates a self-reporting incentive, but the Van Dyke case demonstrates that DOJ can proceed independently — the declination path may not insulate against criminal exposure where national security or aggravating factors are present .
• What duty of care do employers owe when executives are targeted by automated social engineering? The Black Basta affiliate campaign operates faster than standard incident response protocols, raising questions about whether existing cybersecurity frameworks — and the legal duties they create — are adequate for sub-12-minute attack cycles .

What to watch.

• Unsealing of the Van Dyke charges — the statutory theory will define whether corporate MNPI holders face analogous exposure on prediction markets.
• Whether the SEC or DOJ opens a formal inquiry into the presidential trading disclosures, and whether Congress pursues legislation on presidential blind-trust requirements or enhanced trading disclosure obligations.
• Whether the CFTC releases the full revised cooperation advisory and how it addresses prediction market participants specifically.
• Additional DPRK laptop farm prosecutions or regulatory guidance on remote-worker identity verification obligations — particularly whether OFAC issues updated sanctions compliance guidance targeting the hiring pipeline.
• Senate Commerce Committee hearings on prediction market regulation and whether they produce licensing or compliance obligations for the platforms.
• Whether the Black Basta affiliate campaign produces a publicized breach that triggers regulatory or litigation scrutiny of corporate incident response adequacy.