39 farm wallets
+ ghost
One maker-side fill rechecked for every farm-sample wallet. All 18 archived ghost fills rechecked.
Inspect the order logs ↗The September file / 02
The code
has a name.
The builder code in the farm’s orders resolves to Firefly. Firefly’s payment profile appears on the same payroll. And a funding wallet connects two treasuries already in the investigation.
01 / An old unknown, resolved
One builder code.
One name. One payee.
The original investigation called 0xe67c1c79…22f77 an unlisted code. The September 16 directory maps that exact 32-byte value to Firefly, marked verified. The profile receiving payroll payments is Firefly-EverythingApp.
39 farm wallets
Firefly
Exact builder-code match.
Directory logo references Polymarket user 4090895.
Firefly-
EverythingApp
Public-profile API returns user 4090895 and wallet 0xd3ea…ee97.
26 August / two payments
584.10 USDC.e from the payroll.
The documented operator 0xc012…59efe sent two ClipperPayout batches containing 286.94 and 297.16 USDC.e for the Firefly profile. Both payment legs match the token contract, recipient, amount and log index in successful transaction receipts.
What the code records
Order attribution to Firefly.
The exchange’s OrderFilled event puts the builder code on each order. The verified logs record attribution to Firefly for these wallets. Polymarket’s builder program uses attribution for volume and reward accounting.
Read the sample reconciliation
The older “40-wallet” export contains 39 farm-sample wallets and ghost. Its archived tally is 19,959 Firefly-coded fills out of 26,704 for the 39 farm wallets, plus 18 of 18 for ghost. This update independently rechecks 39 farm examples and all 18 ghost logs: 57 unique fills across 40 wallets.
The current builder directory contains 543 entries across 11 pages. The published historical wording remains in the archive; this finding updates the identity of its previously unnamed code.
Download every example check ↓02 / The funding wallet
Two money trails
meet at 0x2d507.
0x2d507…dea54 sent 2,100,001 USDC.e to the documented payroll money-mover across four transfers in March and April. On September 9, it sent 75,000 PUSD to the machine treasury.
78 seconds later
47,006 PUSD to User1244322.
The machine treasury sent 47,006 PUSD to the public-profile wallet 0xe558…fdcd2 at 23:28:58 UTC. Its PUSD balance was 3,937.141718 before the 75,000 deposit, 78,937.141718 after it, and 31,931.141718 after the payment.
The earlier reverse transfer
100,000 USDC.e went back.
On January 10, the machine treasury sent 100,000 USDC.e to 0x2d507. This is a two-way financial relationship, spanning eight months and two token contracts. The transfer table preserves each direction and denomination.
Open the January transfer ↗Read the funding-wallet census
Pagination reached the January 1 boundary: 1,959 explorer transfer records, including 1,736 transfers of the allowlisted tokens. The counterparties export shows every incoming and outgoing total separately by token. This is a high-volume funding wallet with many counterparties.
The balance check reads the PUSD contract at the block before and after each September transfer. Block timestamps put the two transfers 78 seconds apart. The machine treasury had insufficient PUSD for the 47,006 payment before the deposit arrived.
Download the counterparty census ↓03 / Open the evidence
Click a connection.
Read its receipts.
Each row names the relationship established by its source: builder attribution or a token transfer. Amounts remain in the token actually transferred.
Order attribution
Farm + ghost → Firefly code
57 verified fills39 farm-sample wallets each have a maker-side example carrying the Firefly code. The ghost staging wallet carries it on all 18 archived fills. The current directory names the code Firefly; its logo filename and the payment profile share user ID 4090895.
All nine verified payment legs
| UTC | From | To | Amount | Token | Receipt |
|---|---|---|---|---|---|
| 2026-01-10 20:40:58 | Machine treasury | 0x2d507…dea54 | 100,000.00 | USDC.e | Log 562 ↗ |
| 2026-03-20 22:59:53 | 0x2d507…dea54 | Payroll money-mover | 100,000.00 | USDC.e | Log 5913 ↗ |
| 2026-04-28 21:29:16 | 0x2d507…dea54 | Payroll money-mover | 1.00 | USDC.e | Log 1264 ↗ |
| 2026-04-28 22:05:24 | 0x2d507…dea54 | Payroll money-mover | 1,000,000.00 | USDC.e | Log 486 ↗ |
| 2026-04-29 21:48:24 | 0x2d507…dea54 | Payroll money-mover | 1,000,000.00 | USDC.e | Log 2102 ↗ |
| 2026-08-26 16:59:30 | ClipperPayout | Firefly profile | 286.94 | USDC.e | Log 206 ↗ |
| 2026-08-26 17:02:06 | ClipperPayout | Firefly profile | 297.16 | USDC.e | Log 1025 ↗ |
| 2026-09-09 23:27:40 | 0x2d507…dea54 | Machine treasury | 75,000.00 | PUSD | Log 965 ↗ |
| 2026-09-09 23:28:58 | Machine treasury | User1244322 | 47,006.00 | PUSD | Log 236 ↗ |
04 / Reproduce the findings
The joins.
The logs. The checks.
Official Polymarket metadata, raw Polygon receipt checks and a pinned wallet-control sweep. Forty of 47 traced histories reached their requested date boundary. Individual coverage is recorded in the downloads.
Nine payment legs ↓Direction, token, amount and receipt57 checked order fills ↓Maker wallet and exact builder codeFirefly metadata join ↓Official directory and public profileRaw receipt excerpts ↓The cited logs, status and block hashesTreasury balances ↓Four historical contract readsFunding-wallet counterparties ↓Incoming and outgoing totals by tokenFunding-wallet transfer census ↓1,736 allowlisted token transfersWallet control sweep ↓1,157 wallets at block 93,916,082Collection coverage ↓All 47 traced walletsReproduce the findings ↓Sources, joins and selection rules
1,157 wallets checked for control.
At Polygon block 93,916,082, the owner and Safe checks returned two shared-controller groups. Both are public infrastructure: Polymarket contracts and Stargate contracts. These checks produced no new shared customer controller.