The bytecode of the law is often less forgiving than the bytecode of a smart contract. On March 2025, the city of Baltimore filed a lawsuit against Kalshi and Polymarket, two platforms that allow users to trade on the outcome of sports events. The claim is straightforward: they are operating unlicensed sports betting under Maryland state law. Yet the implications are anything but simple. This lawsuit is not a mere nuisance; it is a stress test of the entire prediction market thesis—a collision between the blockchain’s promise of permissionless, global markets and the granular, localized reach of state gambling regulations.
Context: Two Platforms, One Legal Trap
Kalshi is a federally regulated event contract exchange, operating under a CFTC license as a Designated Contract Market (DCM). It won a landmark federal lawsuit against the CFTC in September 2024, allowing it to list political event contracts. Polymarket, by contrast, is a crypto-native platform built on Polygon, using UMA oracles for settlement. It was the center of the 2024 US election betting frenzy, with over $3.5 billion in volume. In January 2025, Polymarket settled with the CFTC for roughly $250 million and subsequently blocked US users from its non-compliant markets. Both platforms list sports-related contracts—predictions on NBA, NFL, and college football outcomes. Baltimore’s lawsuit argues that these contracts constitute “unlicensed sports betting” under Maryland law, which legalized sports betting in 2020 but requires a state license. The city’s aim is to protect its licensed operators and collect penalties.
Core: The Regulatory Architecture – A Forensic Autopsy
From a technical compliance perspective, the two platforms are built on fundamentally different architectures, yet they share a common vulnerability: they both treat state-level gambling laws as an edge case rather than a core constraint. This is a classic security flaw—the “edge case” that becomes a door left unlatched.
Start with Kalshi. Its entire business model is predicated on CFTC authorization. The federal Commodity Exchange Act allows DCMs to list event contracts, and the CFTC has explicitly permitted political event contracts. However, the Act does not explicitly preempt state gambling laws. The legal question is whether a CFTC license grants a blanket exemption from state gaming statutes. Historically, fantasy sports operators like DraftKings and FanDuel have navigated this by obtaining state licenses or by structuring their products to fall under the “skill” exception. Kalshi’s contracts are purely binary outcomes—yes/no on a specific event—which Maryland courts might classify as “wagering” rather than a derivative. The lawsuit is essentially a test of federal preemption. If Baltimore wins, Kalshi’s compliance shield cracks.
Polymarket’s architecture is even more exposed. It operates on a decentralized blockchain, but its order book is centralized, and its settlement relies on the UMA optimistic oracle—a system that allows a disputer to challenge a result. The platform’s strength—global accessibility—becomes its weakness in a state-level lawsuit. The City of Baltimore can argue that Polymarket is “conducting business” in Maryland simply by allowing Maryland residents to access the platform. And since Polymarket already settled with the CFTC, it has no federal license to invoke. The state’s attorney can point to the CFTC settlement as an admission that Polymarket was operating an illegal derivatives exchange, and now extend that logic to state gambling laws. The legal system, like a bytecode interpreter, follows strict rules: if the state can prove “money → chance → prize,” the platform is a gambling operation.
In my own audit work, I’ve seen how regulatory ambiguity creates attack surfaces that are exploited by both malicious actors and overzealous regulators. This lawsuit is a textbook example of a “compliance reentrancy” attack—the state enters the contract’s execution flow unexpectedly, redefining the terms of the transaction after the fact. The platforms’ smart contracts are immutable, but their legal status is not.
Contrarian: The Hidden Positive Signal
Counter-intuitively, the Baltimore lawsuit might accelerate the maturation of prediction markets rather than kill them. The industry has long operated in a gray zone, with founders hoping that federal regulation would eventually provide a clear framework. The CFTC vs. Kalshi case in 2024 was a step forward, but it left a gaping hole: state-level laws. Now, that hole is being tested, and the outcome will force a legal clarity that no amount of whitepaper writing can achieve.
If Kalshi successfully defends on the grounds of federal preemption, it will set a powerful precedent that could shield other CFTC-regulated exchanges from state-level gambling claims. This is akin to how the Supreme Court’s 2018 decision on sports betting (PASPA) opened the door for individual states to legalize, but also created a patchwork. The difference here is that Kalshi’s license is federal, and overturning it would require a clear statement from Congress. The risk is that Baltimore’s case could be seen as a “state’s rights” test, which conservative courts might favor. However, the broader trend is toward legalization of sports betting—45 states now allow it. The prediction market industry could piggyback on this trend by seeking state licensing as a secondary compliance layer. Complexity is the bug; clarity is the patch.
For Polymarket, the lawsuit is a reminder that its current strategy—restricting US users—is not enough. State-level lawsuits can still be filed for past violations, and the legal costs are significant. But the global market remains open. The real cost is reputational: institutional partners and liquidity providers may become wary. Yet, paradoxically, this lawsuit may force Polymarket to push for a proper regulatory framework abroad, perhaps by incorporating in a jurisdiction with a clear crypto-gambling license (like the UK or Malta). The lawsuit is a catalyst for structural reform.
Takeaway: The Next 12 Months Will Determine the Fate of Prediction Markets
Every edge case is a door left unlatched. Baltimore’s lawsuit is that edge case for the prediction market industry. The outcome will determine whether these platforms are seen as innovative financial instruments or as unlicensed gambling dens. The legal battle will likely take months, with appeals potentially reaching the Supreme Court. In the meantime, the market will price in the risk: Kalshi’s valuation may drop if it loses, while Polymarket’s international expansion will be under a cloud.
The critical lesson for developers and founders is that regulatory compliance is not a feature to be added post-hoc; it is the foundation. Just as smart contracts must be formalized to prevent reentrancy attacks, business models must be formalized to prevent state-level attacks. The bytecode never lies, only the intent does. The intent of these platforms is to create efficient markets for information, but the law interprets intent through the lens of gambling statutes. The market prices hope; the auditor prices risk. As an auditor, I see the risk clearly: the next 12 months will determine whether prediction markets become a regulated asset class or a cautionary tale of regulatory arbitrage. Developers should start designing for granular geofencing, state-level licensing, and transparent legal structures from day one. The legal code is just as unforgiving as the Solidity compiler.