Football fans wagered more than US $14 billion on the FIFA World Cup through prediction markets Polymarket and Kalshi, a Bellingcat analysis has found.

On the crypto-based Polymarket, which provides more information about individual trading accounts than its rival American site Kalshi, we also found that just 1% of users collected the vast majority of winnings during the tournament.

Users traded on almost 60,000 outcomes across both sites during the competition, betting on everything from the sponsor of the Golden Boot winner to whether Cristiano Ronaldo would shed a tear during a Portugal match. 

The World Cup, held in the US, Canada and Mexico over June and July, was forecast to be the biggest betting event in history, with a predicted $50 billion in wagers. 

Unlike traditional sports betting sites, prediction markets resemble stock exchanges where users trade, via an order book, on whether a real-world event will happen. Prices fluctuate based on what the market believes the probability of that event is. The sites charge fees on each sports trade.  

The prediction market industry has faced criticism over its vulnerability to insider trading, potential market manipulation and concerns about fueling unregulated gambling. The Wall Street Journal also reported in May that a small number of individuals using algorithmic trading models were taking home an outsized share of winnings.

This would appear to align with Bellingcat’s World Cup analysis, where a small percentage of accounts made most of the winnings. However, the level of detail we were able to obtain did not allow us to see accounts that had utilised algorithmic methods.

Both Polymarket and Kalshi make events and volume data available for programmatic extraction – making it useful for open source analysis. Bellingcat’s data analysis examined all 104 matches as well as the World Cup winner event that was hosted on each platform.

On Polymarket, users traded a total of $10 billion ($5.7 billion on individual games and $4.3 billion on which country would win). The largest game on Polymarket was the Spain vs Argentina final ($212 million), followed by the France vs Spain semi-final ($165 million) and the England vs Argentina semi-final ($142 million). 

On Kalshi, users traded a total of more than $4.3 billion ($4.1 billion on the games and $200 million on the winner).

Bellingcat’s analysis also found that 1% of Polymarket trading accounts collected 86% of all winnings during the World Cup, and the bottom 50% of winners shared just 0.1% of profits. The typical winning account on Polymarket made $21, while the typical losing account lost $32 (measured by the median, which is less affected by a handful of exceptionally large wins and losses). More than 12% of traders (14,500) who bet on two or more games lost every bet. The Polymarket account that won the most across all games made a profit of more than $13 million, while the biggest loser lost $11.6 million.

We were unable to run the same win-loss analysis for Kalshi because trading account overviews are not publicly available.

The top teams, by trading volume, across both sites were Argentina ($1.068 billion), Spain ($876 million) and France ($836 million). The top players were Argentina’s Lionel Messi ($40 million), France’s Kylian Mbappé ($36 million) and Norway’s Erling Haaland ($16 million).

How We Calculated the Volume

Polymarket displays the actual traded volume on its site, the total US dollar amount of shares bought and sold since the market started.

Kalshi does not display the traded volume. Instead, it shows the notional volume, which counts every contract traded at the maximum payout value of $1. This means that a token bought for $0.20 will be presented as $1 extra in a user’s displayed volume. This makes the total monetary volume appear higher on Kalshi’s website. To achieve a fair comparison between both platforms, we implemented a heuristic to reconstruct Kalshi’s markets’ volume. We used the daily average price for each market over their duration and multiplied it by the number of contracts traded on that day, the sum of which gives us the values used in this piece. We applied this formula for the more than 21,000 World Cup markets. 

---

Data scraping was supported by Oxylabs’ Project 4β.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Will Ronaldo Cry​? World Cup Fans Bet Billions Through Prediction Markets appeared first on bellingcat.

I haven’t thought about the privacy issues surrounding professional athletes and wearables.

Wearables present serious privacy issues for “Average Joe” consumers, who are entrusting tech companies to safely store and protect their biometric data. Imagine the stakes for a professional athlete, whose entire livelihood could be affected by a single biometric data point. To give one of many realistic hypotheticals: a basketball player has a terrible game, and the coach wonders if they showed up to the gym hungover. The coach has access to the player’s wearable data, and checks to see when they went to sleep, as well as what their heart rate looked like during the night. Should the player have been out partying before a game? No. Should the coach be able to surveil them? Definitely not.

It will not surprise you to learn that there’s an emergent gambling angle here: sports leagues would love to commercialize players’ biometric data, and sharp bettors would love access to data about, say, a hungover player. “We’re going to get to a spot where people are betting not just on the velocity of the puck that was shot by a player in the NHL playoffs, but on what the heart rate of a certain player is going to be running down the field,” said Helen “Nellie” Drew, the director of the University of Buffalo’s Center for the Advancement of Sport, and a professor of practice in sports law.

There are other practical considerations, too. What if wearable data reveals that a player isn’t as speedy as they were before, and a team uses that data against the player during contract negotiations? What if a wearable reveals a player is favoring their leg, or is at greater risk of injury? This information is potentially beneficial to a training staff and an athlete, so long as it’s disclosed and used in a responsible manner—­a critical, mostly unresolved caveat. “Aging and injured players are the most at-risk” of wearable data being used against them, said Michael LeRoy, who researches sports labor laws and AI, and is a professor at the University of Illinois’s School of Labor and Employment Relations.

The bit about gamblers is particularly scary.

I have often said that surveillance tech is generally deployed first against people with diminished rights: children, prisoners, military personnel, the mentally impaired. This is another early use case with different dynamics. The surveilled are wealthy and powerful, and—in many cases—unionized.

A large-scale Thai gambling SEO poisoning operation has compromised 163 organizations across more than 30 countries by exploiting abandoned cloud DNS delegations, according to research from Cyble Research & Intelligence Labs (CRIL).   The ongoing SEO poisoning campaign has affected government agencies, healthcare organizations, financial institutions, universities, and critical infrastructure operators, allowing attackers to host Thai-language gambling content on trusted enterprise domains. 

How the SEO Poisoning Campaign Works 

Researchers found that the campaign primarily abuses abandoned Azure DNS zone delegations. When organizations retire cloud projects, DNS records that delegate subdomains to Azure are often left behind. Threat actors identify these orphaned delegations, recreate the abandoned DNS zones under new Azure subscriptions, and gain authority over the affected subdomains.  Using this method, the attackers deploy a Next.js-based Thai-language gambling kit protected by valid Let's Encrypt wildcard certificates. As a result, users, browsers, and search engines see what appears to be legitimate content hosted under trusted corporate domains.  At the time of publication, 161 of the 163 affected organizations remained actively compromised. 

Discovery Leads to Global Exposure 

The investigation began when CRIL identified unusual DNS activity on a Verizon subdomain environment. Researchers discovered more than 1,000 individually named subdomains serving Thai-language gambling content. Each page contains affiliate links designed to drive user registrations and generate commissions.  Further analysis revealed the same infrastructure and content fingerprints across 162 additional organizations. More than 90 compromised enterprise subdomains shared the same Next.js build ID (QQOrXCFjoI6C9oF-4YVhl), favicon path (/img/ib99-hq.ico), and affiliate redirect destinations. 

Four DNS Abuse Methods Identified 

The Thai gambling SEO poisoning operation relied on four compromise mechanisms: 

• Azure DNS zone takeover: More than 150 organizations were affected through abandoned Azure DNS delegations. 
• DigitalOcean DNS zone takeover: Two organizations were compromised using a similar technique. 
• Direct wildcard DNS misconfigurations: Two organizations had wildcard records pointing to attacker-controlled infrastructure. 
• Mass A-record creation: Verizon's environment contained over 1,000 individual DNS records directing traffic to gambling content. 

Certificate Transparency records showed some abandoned zones had remained dormant for years. One pharmaceutical company's subdomain had not seen a legitimate certificate since October 2019 before attackers obtained a new certificate on April 11, 2026. Another electronics firm's platform showed a gap between February 2023 and April 10, 2026. 

Monetization and Backend Infrastructure 

The SEO poisoning campaign generated revenue through affiliate tracking codes such as "ibiza99vip1," "bigwinv1," "seven77vip1," and "link99." Researchers observed server-side filtering that verified visitors originated from Thailand before redirecting them to gambling platforms.  The campaign ultimately linked to four gambling destinations: ibiza99.autos, big888.store, seven77.click, and link99.nova555.rest. The gambling pages promoted deposits as low as 1 Thai Baht (approximately $0.03 USD) and included structured SEO content, FAQ schema, and mobile optimization features.  Behind the delivery infrastructure, researchers uncovered a dedicated backend fleet of 103 servers located in Hong Kong under AS398478 (PEG TECH INC). Evidence linking the servers included identical TLS fingerprints, shared certificates, matching HTTP hashes, uniform MySQL configurations, and common administration tools. 

Detection and Mitigation

CRIL noted that traditional security tools are unlikely to detect this Thai gambling SEO poisoning activity because the attackers use valid certificates, reputable domains, and clean infrastructure. The researchers recommend continuous monitoring of Certificate Transparency logs, auditing all DNS delegations, and immediately removing abandoned NS records pointing to cloud providers.  According to the report, the campaign demonstrates how a single DNS hygiene failure can be systematically exploited at scale. Rather than breaching networks or applications, the attackers capitalized on forgotten cloud configurations, turning trusted domains into vehicles for a sophisticated SEO poisoning campaign targeting Thai search traffic. 

Insider trading is rife on Polymarket:

Analysis by the Anti-Corruption Data Collective, a non-profit research and advocacy group, found that long-shot bets—­defined as wagers of $2,500 or more at odds of 35 percent or less—­on the platform had an average win rate of around 52 percent in markets on military and defense actions.

That compares with a win rate of 25 percent across all politics-focused markets and just 14 percent for all markets on the platform as a whole.

It is absolutely insane that this is legal. We already know how insider betting warps sports. Insider betting warping politics—and military actions—is orders of magnitude worse.

Polymarket is a platform where people can bet on real-world events, political and otherwise. Leaving the ethical considerations of this aside (for one, it facilitates assassination), one of the issues with making this work is the verification of these real-world events. Polymarket gamblers have threatened a journalist because his story was being used to verify an event. And now, gamblers are taking hair dryers to weather sensors to rig weather bets.

There’s also insider trading: a lot of it.

This article is the result of a collaboration with Josimar. You can find Josimar’s corresponding piece here.

A European academic used a false name to represent an opaque Asian-facing bookmaker that is sponsoring Croatia’s national football team in the run up to the 2026 FIFA World Cup.

Croatia’s national governing body of football, the Croatian Football Federation (HNS), struck the deal to make gambling website Dragon Z6 the team’s “exclusive betting partner” across Asia in May 2024.

Promotional footage of the ceremony to ink the two-year agreement was filmed in Zagreb, with Croatian national team players Marco Pašalić, Lovro Majer and Josip Juranović in attendance.

A video posted to Dragon Z6’s website shows HNS International’s chief executive Dennis Lukančić and the federation’s head of marketing Ante Cicvarić signing the contract with the bookmaker’s representative.

“We hold Dragon Z6.com in high regard,” Cicvarić said in the clip. “A brand with a 25 year legacy and a stellar reputation for providing an exceptional gaming experience. Their motto, ‘Life is a gamble’, resonates deeply with us.”

Dragon Z6’s representative, who is named on screen and in a placard as “Alexander Smith”, described the deal as a “momentous partnership”. 

He said: “The Dragon Z6.com family proudly welcomes the Croatian national football team. We embark on an exciting journey to realise our shared ambitions.”

But the man who appears in the footage on behalf of Dragon Z6 is not Alexander Smith. He is Branko Balon, a senior lecturer in computer science at Algebra Bernays University in Zagreb. 

The Croatian national was identified using facial recognition search engine PimEyes, with images from his Facebook, university profile and media reports confirming the match.

In addition to his university position, Balon is the president of non-profit group the Croatian-Chinese Friendship Society for Cultural, Scientific and Economic Cooperation (CCFS).

He appears to have visited China on several occasions, including last July when he took part in a visiting scholar programme with the Nishan World Center of Confucian Studies in eastern China’s Shandong province, according to his Facebook posts.

Six months before the signing ceremony with HNS, Balon reportedly addressed a Zagreb sports and tourism symposium whose attendees included representatives from the Croatian Football Federation.

After initially confirming receipt of an email from Bellingcat, Branko Balon did not respond to questions. Dragon Z6 did not respond to multiple emails.

Dennis Lukančić said the Croatia Football Federation respected the rules and regulations of the sport’s governing bodies as well as Croatian law, but did not answer specific questions about how it became involved with Dragon Z6 or if it was previously aware of Balon’s real identity.

“Regarding the signing ceremony, we note that the Croatian Football Federation did not publish or officially communicate the identity of the Dragon Z6 representative present at the event,” he said. “As is customary with such ceremonies, the event itself was of a promotional nature and did not constitute the formal execution of contractual documentation.”

“The Croatian Football Federation is not in a position to comment on the internal decisions, communications, or presentation choices of Dragon Z6, including the use of names or identities in their own materials or appearances. Any questions regarding the identity or representation of Dragon Z6 at promotional events are best addressed to Dragon Z6 or their representatives. 

“In any of our proceedings we always negotiate in good faith and we respect all rights and obligations that arise from any agreement.”

Lukančić said the federation had carried out “standard compliance and due diligence procedures” before entering the deal and that the agreement was executed between the relevant legal entities, with Dragon Z6 “represented by their duly authorised signatories”. 

Asked which country Dragon Z6 was headquartered in, who its beneficial owner was, and for the name of the person who signed the contract on behalf of the gambling company, Lukančić said: “In our previous email we gave you already all answers and our position in this matter.”

We also asked if the Dragon Z6 deal includes sponsorship during the upcoming FIFA World Cup, but did not receive a response. England is Croatia’s first opponent, facing off against the Three Lions in Dallas on June 17.

The Many-Headed Dragon

Open source findings suggest that Dragon Z6 – sometimes referred to in Chinese as “Zunlong Kaisheng” – is just the latest iteration of an Asian-facing online gambling platform that has been sponsoring Western sports teams under different names for more than a decade. Dragon Z6 appears to be associated with the Hong Kong-linked gambling company KashBet, also known as KB88.

Gambling does not occur directly on the Z6.com domain. The site is essentially a gateway that redirects users to a fluctuating number of mirror websites with alphanumeric string domains. These Chinese-language sites host the gambling content, including live-streamed card games, and provide clues about Dragon Z6’s association with KashBet.

The image of Dutch former professional footballer Robin van Persie is featured prominently on Dragon Z6’s mirror sites. In the “About” section of these websites, the online casino says it signed van Persie as its brand ambassador in 2021. The same photograph of him is used interchangeably to promote both Dragon Z6 and the KashBet brand.

Van Persie’s agent, Kees Vos, said the footballer had not entered into a partnership with Kashbet, was not involved with Dragon Z6, and had not been aware that his image was being used on these websites.

“We have taken notice of the abuse of the image of our client Robin van Persie by several Asian gambling platforms, and we will instruct our lawyers to take legal action against these parties,” Vos said.

Z6’s mirror sites also say Zunlong Kaisheng is the “official sponsor” of Bundesliga clubs Bayer Leverkusen and Augsburg, Brazilian side Fluminense, Italian club Roma, English league team Wigan Athletic and Dutch club Ajax. 

However, it was KashBet that signed sponsorship deals with these football teams in 2017 and 2019. No record of a sponsorship with FC Augsburg was found, but KB88 was promoted in pitchside advertising during one of the team’s 2019 home games.

In 2019, Australian football team Melbourne Victory dropped their AFC Champions League sponsor “Kaishi Entertainment” after concerns were raised about the company’s link to Kashbet. 

KashBet’s representative at the signing with Bayer Leverkusen was the same person who represented Kaishi Entertainment during the Melbourne Victory announcement in the same year.

A YouTube channel branded as “Zunlong Kaisheng” and featuring the Dragon Z6 logo hosts a 2024 video titled “Welcome to Dragon Casino”. It shows a tour of a facility where female croupiers are live-streamed operating table games. 

The video also features framed photographs purporting to show various ceremonies. These include the KashBet image of van Persie, as well as club teams AS Roma and AFC Ajax’s Asian betting partnerships with KB88 in 2017. Another photo claims to show former Real Madrid, Chelsea and Belgium footballer Eden Hazard becoming a Dragon Casino “brand ambassador” in 2020.

Bellingcat’s emails to representatives for Eden Hazard, who was recently announced as a “global ambassador” for online gambling platform Stake, were not returned.

The location of the facility is not stated but open source evidence shows it was filmed in the Philippines, where offshore gaming operators were banned in 2024. Reverse image searches confirm one section of the promotional video was shot in the five-star Peninsula Hotel in Makati City, Manila.

Offshore Corporate Labyrinth

Dutch club Ajax, who were sponsored by KB88 in 2017, said their deal involved Hong Kong firm KB88 Entertainment Culture Limited. A company based in the British Virgin Islands is also behind trade names linked to KB88, according to a 2023 investigation by Dutch outlet NRC. But the entities purportedly in control of the gambling platform do not stop there.

Dragon Z6’s site links to a 2012 statement posted by English Championship club, Queen’s Park Rangers (QPR), announcing a one year deal to make KashBet the club’s international betting partner. The press release, which was removed from QPR’s website earlier this year, said KashBet was “fully owned and operated by Keen Ocean Entertainment (IOM) Limited” and licensed and regulated by the Gambling Supervision Commission (GSC) on the Isle of Man.

Records from the Isle of Man company registry show a company named Goldenway Investments (UK) Limited was incorporated in 2010 and changed its name to Keen Ocean Entertainment (IOM) Limited a month later. The company’s two directors were all residents of the Isle of Man, adding Hong Kong resident Yong Tang as the third director in November of that year. A company acting as the secretary, Rivercroft Limited, is also named in documents.

An archive of the Isle of Man’s Gambling Supervision Commission’s 2012-13 annual report shows that Keen Ocean Entertainment obtained a full online gambling license. This enabled it to enter into the QPR deal as the regulated body behind Kashbet.

Filings on the Isle of Man register are low on detail. Balance sheets are not filed, and the only documented activity about the company was the occasional movement of Isle of Man-based directors. By November 2015, Yong Tang was the sole director of the company. 

In 2016, Keen Ocean Entertainment was informed by the Companies Registry that it did not have the authority to maintain its registered office at the address it had given as its premises. Yong Tang did not respond to this correspondence, according to the available documents, and the company was subsequently struck off the register.

Gaming Compliance International (GCI), a regulatory intelligence firm that monitors the global online gambling market, said Dragon Z6 and KashBet did not have a current gaming license in any credible jurisdiction.

Ismail Vali, GCI president and the founder and former chief executive of Yield Sec, which tracks gambling and streaming marketplaces, said Dragon Z6 “ruthlessly” targeted audiences in China – where gambling is illegal – but that did not mean the operators were based there.

“Generally, in the illegal gambling model, they use triangulation and separation,” he said. “It’s the most basic form of organised crime: operate your business in one place, incorporate your business in another, make your money from many places, bank your money in many places, and, finally, invest and spend it everywhere to create more crime. Separating the elements of the illegal activity creates problems for tracing, policing and enforcement.”

Vali said Western football associations that are struggling to operate on shrinking budgets could be lured into sponsorship deals with unregulated and illegal gambling companies, which were focused on building brand recognition through live-broadcast games.

“The illegal gambling companies aren’t focused upon making money from the direct audience of the clubs or from the football association’s footprint in Croatia,” he said. “What they are making money from is the audience the football matches are broadcast to globally. They want to communicate what the brand is and because it’s associated with international soccer people think it must be trustworthy.

“The whole point here is to recruit you through sports. That’s the cheapest way to get you interested because you want to place a bet on Croatia versus the Czech Republic in the World Cup qualifiers. Once they recruit a customer cheaply via sports events, they can then cross-sell or migrate them into casino and more products – where the profit margin is far higher.

“Unregulated gambling companies want a blended customer – they don’t just want you for sports betting, they want you for everything.”

---

Ross Higgins and Connor Plunkett contributed to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Croatia’s Football Team Signed Deal With Gambling Sponsor Whose Rep Used Fake Name appeared first on bellingcat.