Is My Money Safe on Prediction Markets? Custody Explained Across Polymarket, Kalshi, Limitless, Predict.Fun, and Opinion

TL;DR

• Kalshi and Polymarket US are custodial: your cash sits in segregated bank or brokerage accounts under the CFTC's Part 190 bankruptcy rules, which puts you ahead of general creditors if the company fails, but that's a pro-rata, best-efforts regime, not an FDIC- or SIPC-style guarantee of full repayment.
• Polymarket's international platform, Limitless, Predict.Fun, and Opinion are non-custodial: you, or a wallet the platform creates for you, hold the private key, funds live on a public blockchain, and no bank or bankruptcy court is involved either way.
• FDIC insurance on Kalshi only covers its partner banks (JPMorgan Chase, Bank of New York Mellon) failing, not Kalshi itself going under. None of the five platforms carries FDIC or SIPC coverage on your actual trading balance.
• On the non-custodial three, the real risk sits in code and key security, not a balance sheet: Limitless's core contracts are forked from Polymarket's own audited exchange (its own changes aren't covered by that audit), and Opinion's contracts have separate, named audits from ScaleBit, Zellic, and Pashov.

Ever wonder what actually happens to your deposit the second it leaves your bank account or your wallet? On Kalshi, it lands in a segregated account at a bank most traders have never heard of holding their cash. On Polymarket, Limitless, Predict.Fun, or Opinion, it lands in a smart contract that you, not the company, hold the keys to.

Those are two structurally different answers to "is my money safe," and neither one is risk-free. Kalshi and Polymarket US are custodial, protected by CFTC bankruptcy rules that are stronger than most people assume, but not an insurance policy. Polymarket's international platform, Limitless, Predict.Fun, and Opinion are non-custodial, which removes company-insolvency risk entirely but puts the full security burden, phishing, key loss, contract bugs, back on you.

The rest of this piece walks through what actually backs your money on each of the five platforms PredictionHero tracks: who holds it, what happens if the company fails, what happens if a market gets cancelled, and what's actually been hacked so far.

What Does "Custody" Actually Mean Here?

Custody is just the answer to one question: whose name is on the account holding your money right now?

On a custodial platform, the company holds it on your behalf, the same model as a bank or a traditional brokerage. You have a claim against the company, not direct possession of the asset itself. That claim is only as good as the rules governing what happens if the company can't pay.

On a non-custodial platform, nobody holds it but you. Your funds sit in a wallet address on a public blockchain, and a private key, not a company login, is what moves them. The company can't freeze, lend out, or lose your balance in a bankruptcy, because it never had it in the first place.

Both models can fail. A custodial platform can mismanage or misuse segregated funds. A non-custodial platform can ship a buggy smart contract, or you can lose the key yourself. "Which one is safer" depends on which failure mode you're actually worried about, which is the question most "is it safe" headlines skip past.

Which of the Five Platforms Hold Your Money, and Which Don't?

Two of the five are custodial. Three are non-custodial. Polymarket is the one platform that's genuinely split across both models, depending on which Polymarket you're using.

Our KYC comparison covers the identity side of this same split, since custody and verification track the same regulatory line almost exactly.

Is Kalshi's Money FDIC Insured?

Not directly, and this is the single most misread fact in this whole topic. Kalshi holds customer cash in segregated accounts at FDIC-insured banks, including JPMorgan Chase and Bank of New York Mellon. FDIC insurance covers those banks failing. It does not cover Kalshi itself failing, because Kalshi is an exchange, not a bank.

For Kalshi's own insolvency, a different federal rule applies: 17 CFR Part 190, the CFTC's bankruptcy framework for commodity brokers and exchanges. Under Part 190, customer cash is legally walled off into a separate "customer estate," distinct from the firm's own operating money. If Kalshi became insolvent, its bankruptcy trustee is required to make a best-efforts attempt, within seven calendar days, to transfer open positions and the cash backing them to another solvent firm rather than defaulting straight to liquidation.

If a transfer isn't possible, customers get paid out of that segregated estate before the firm's general creditors see anything. That's a real, enforceable priority, ahead of ordinary creditors, not a courtesy.

Here's the part that's easy to miss: Part 190 distribution is pro rata, not guaranteed. If the segregated pool is somehow short of what it should hold, customers in that account class absorb the shortfall proportionally. There's no FDIC-style fund that makes you whole regardless, and SIPC doesn't apply here either, since SIPC covers securities brokerage accounts, and Kalshi's contracts are derivatives, not securities.

The honest summary: Kalshi's segregation rules are a genuine structural protection against the company commingling your cash with its own. They're not insurance.

How Is Polymarket US's Custody Different From Kalshi's?

It isn't, structurally. Polymarket US runs through CFTC-registered futures commission merchants, which hold customer collateral under that same Part 190 framework, the identical regulatory plumbing Kalshi uses, just wired through an intermediary instead of a direct in-house account.

That's a meaningfully different risk profile from Polymarket's international platform, and it's the reason "is Polymarket custodial" doesn't have one answer. Our US setup guide covers the practical differences between the two products.

Polymarket US is newer than Kalshi, live in beta since November 2025, so it has a much shorter operating track record under this framework. The rules protecting you are the same ones. The company's history running them isn't.

Who Actually Holds Your Funds on Polymarket's International Platform, Limitless, Predict.Fun, and Opinion?

You do, on all three, and the platforms say so directly rather than leaving it implied.

Polymarket's own help center states it plainly: "Polymarket is non-custodial, so you're in control of your funds," adding that the platform "never takes possession of your USDC." Its own shorthand for this is "your keys = your funds," and you can export your private key at any time.

Limitless describes the same structure in its documentation: "no protocol-level custody of user funds." Its core contracts aren't written from scratch. They're forked from Polymarket's own audited exchange contracts, with ChainSecurity's audit of the upstream Polymarket code carried over.

The catch, stated in Limitless's own docs, is that its fork-specific changes (a new signature type, its Base deployment configuration) "are not covered by the upstream ChainSecurity audit." That's a genuinely useful distinction most reviews of Limitless skip: reused, audited code plus unreviewed modifications on top, not a fully audited system end to end.

Predict.Fun uses the same non-custodial design, through a slightly different mechanism. It assigns every user a smart contract wallet via Privy and ZeroDev, so there's no seed phrase to manage, and states directly that "Predict never has access to your private keys, so you're always in control of your funds."

The one structural wrinkle is what happens to that collateral while a position is open. Predict.Fun auto-routes it into Venus Protocol, a BNB Chain lending market, so idle capital earns yield instead of sitting dormant. That's a real benefit, but it also means your collateral briefly touches a third party's smart contracts, not just Predict.Fun's own, while a trade is live.

Opinion follows the same wallet-connect pattern as the other two on-chain platforms, though its own documentation doesn't use the word "non-custodial" explicitly. What it does publish, and this is more than Limitless or Predict.Fun disclose, is a named set of independent smart-contract audits: ScaleBit and Zellic both audited its Conditional Tokens contracts, ScaleBit separately audited its Exchange Engine and Fee Manager, and ScaleBit and Pashov both audited its OPN token contract.

None of the three publishes what specifically happens to a user's wallet balance if the company itself shuts down, because the honest answer is structural rather than something a company statement would add: a non-custodial contract keeps running on its own chain regardless of whether the company behind it still exists, as long as the chain itself and the contract's own logic keep functioning.

What Happens to Your Money If One of These Platforms Gets Hacked?

This is where the five platforms' actual track records diverge, and it's worth being specific rather than treating "hacked" as one category.

Polymarket's core exchange contracts have never been reported exploited. Its hack history is entirely at the edges: third-party login providers, phishing sites, and once, in June 2026, a compromised vendor injecting malicious code into the official site itself, which cost about $3.1 million from 11 wallets. Polymarket pledged full refunds for that one. Our Polymarket review has the complete incident table.

Limitless, Predict.Fun, and Opinion have no documented platform-level hack of their own contracts as of this writing. That's worth stating plainly rather than treating as reassuring: it reflects what's publicly known today, not a guarantee about tomorrow, and two of the three (Limitless, Predict.Fun) haven't published a public audit report the way Opinion has.

Predict.Fun's Venus Protocol integration also means its users' open-position collateral inherits whatever risk sits inside Venus itself. Venus suffered a real exploit in March 2026, a roughly $3.7 million loss tied to a price-manipulation attack on a specific collateral market, unrelated to Predict.Fun directly. It's a concrete example of the third-party smart-contract risk that comes bundled with any yield-generating integration like this one.

Kalshi's bank-held custody model means it isn't exposed to this category of risk at all. Its own operational failures look different: a January 2026 episode where some NFL contract holders were initially paid only their original stake instead of the full settlement value, which Kalshi reversed and corrected after user backlash. That's a settlement dispute, not a custody breach, but it belongs in the same "has this platform ever failed to pay correctly" conversation. Our Kalshi review covers it in full.

What Happens to Your Money If the Platform Itself Goes Bankrupt?

For Kalshi and Polymarket US, this is exactly the Part 190 scenario described above: a best-efforts attempt to transfer your open positions to another solvent firm within seven days, and if that fails, a pro-rata payout from the segregated customer estate ahead of general creditors. It's a structured wind-down, not a guarantee of full repayment.

For Polymarket's international platform, Limitless, Predict.Fun, and Opinion, the company going bankrupt and your wallet balance are two separate things entirely. The tokens in your wallet exist on a public blockchain independent of the company's legal status. If the company shuts down, support disappears and the front-end website might go dark, but the underlying contracts, and whatever is sitting inside them, don't automatically vanish with it. Nothing about non-custodial design protects you from a bad smart contract or a compromised key; it just removes the company's own solvency as a source of risk in the first place.

History has a cautionary example worth knowing, from outside the five platforms PredictionHero covers. Intrade, the prediction market best known for its 2008 and 2012 election coverage, suspended all trading in March 2013 after disclosing what it called "financial irregularities," a roughly $700,000 cash shortfall. It said it would try to refund members in full by the end of 2014.

Whether every customer was ultimately repaid in full isn't clearly documented in public reporting. Intrade was never a CFTC-regulated exchange and operated under none of the segregation rules described above, which is a large part of why today's regulated platforms look structurally different from it.

What Happens to Your Money If a Market Gets Cancelled or Disputed?

This is a related but separate question from company insolvency, and the honest answer varies more by platform than most coverage assumes. Our guide to what happens when an event gets cancelled covers the mechanics in depth; the short version matters here too.

Kalshi doesn't automatically refund a cancelled or unresolvable event. Its rulebook allows a grace-period extension first, and if the outcome still can't be determined, settlement falls to either the last traded price or a binding ruling from its Outcome Review Committee. An actual refund of your original stake is reserved for Kalshi's emergency powers, not routine postponements.

Polymarket's well-known 50/50 fallback is real but genuinely rare, reserved for disputed proposals that escalate all the way to a token-holder vote. Most markets resolve normally under their own written edge-case rules well before that point. Limitless is the one platform with an actual refund-at-cost policy for misresolved markets, though only when a market's own rules don't already cover the scenario. Predict.Fun and Opinion haven't published a general cancellation policy as of this writing.

So Which Custody Model Should You Actually Trust?

Neither model removes risk. It just decides which kind of risk you're carrying.

If what worries you is a company doing something to your money while it's still solvent, commingling it, mismanaging it, freezing it, non-custodial removes that risk entirely, because the company never had possession of it to begin with. If what worries you is a company going under altogether, custodial is the more structured architecture: Part 190 forces an orderly wind-down with customer priority, rather than leaving you with only a wallet address and a hope that the chain and the code keep working.

Most "is it safe" takes on this topic pick one of those two fears and answer it as if it were the whole question. It isn't. Checking a platform's own custody and audit disclosures directly, which is what this piece draws from, beats trusting either a brand's own safety messaging or a flat "crypto bad" or "banks bad" prior.

Whichever model you're trading under, read the specific market's own resolution rules before you commit size, and size positions to what you can afford to lose regardless of how the platform holds your cash. Comparing the same event across all five platforms on PredictionHero is the fastest way to see where they actually agree.

Sources

• Cornell Law School Legal Information Institute. "17 CFR Part 190, Bankruptcy." law.cornell.edu
• Kalshi Help Center. "Bank Deposits." help.kalshi.com
• CFTC. "CFTC Designates KalshiEX LLC as a Contract Market." Press release, November 2020. cftc.gov
• CFTC. "Polymarket US Amended Order of Designation." November 2025. cftc.gov
• Polymarket Help Center. "Is My Money Safe?" Updated January 11, 2026. help.polymarket.com
• Limitless Exchange Docs. "Security." docs.limitless.exchange
• Limitless Exchange Docs. "Refund Policy." docs.limitless.exchange
• Predict.Fun. "About." predict.fun
• Opinion Docs. "Audit Report." docs.opinion.trade
• SIPC. "What SIPC Protects." sipc.org
• TIME. "Online 'Predictions' Market Intrade Shuts Down Months After Federal Lawsuit." March 11, 2013. business.time.com
• Wikipedia. "Intrade." en.wikipedia.org
• The Block. "Venus Protocol left with roughly $2M in bad debt after exploit manipulates Thena's THE token price." March 2026. theblock.co
• CoinDesk. "Polymarket hack updated to $3.1 million." June 27, 2026. coindesk.com

PredictionHero aggregates publicly available prediction market data for informational purposes only. This is not financial advice. Prediction markets may not be available in all jurisdictions.