One machine faked the wins, farmed the volume, and pressed the resolutions.

The public scoreboard vs. the corrected on-chain record.

Every card below starts on the public Polymarket record - the one followers saw. Flip it for the same account with the abandoned, unredeemed losers counted.

Corrected figures count every unredeemed resolved loser with at least $50 at cost, verified against CLOB resolution on August 6, 2026; itskkoma and 0xbumblebee were checked completely. Per-account tables: heooo, katelv, itskkoma, 0xbumblebee, and the receipt ledger below.

Control group

The cluster's opposite-match rate is 4,561 times the crowd baseline.

The same strict screen, rerun on 200 random traders drawn from the 52-market control pool: 153,331 control activity rows, 59,220 market-feed trades, 11.2 million unrelated trader-pairs.

katelv and heooo still beat fair odds with every hidden loser counted (p≈0.01 each); itskkoma is statistically ordinary (p=0.44). The fake part is the presentation, not always the P&L.

15 p-valued tests, Benjamini-Hochberg corrected; the battery reproduces the published 33-event screen exactly. Re-runnable: reports/deep/statistical_battery.py, seed 42, stdlib-only, about 7 seconds.

Case 01 · The posted wins

Kate's posted wins were hedged by linked accounts.

Twelve archived posts from four Kate-circle accounts, graded against the ledger.

gracechase posted a Polymarket win screen: "You won $2,080.00" - $1,081.60 profit on Flames. The post did not show:

• 18 minutes 8 seconds earlier, butzki had bought the exact opposite - 2,040 Wild shares for $1,040.40. Flames won; he never posted the -$1,040.40 loss, and because he never redeemed the dead shares, it is invisible in his public record.
• The next day it repeated: gracechase posted "1 won, return 49.25%, proceeds $3,030.00" - exactly 3,030.00 Celtics shares, bought 5 minutes 36 seconds after butzki's 3,030.30 Lakers shares.
• Combined result of the two sides: -$0.10.

Kate posted a Polymarket slip: MOUZ, $1,320 at 55%, to pay $2,400. Her own account has no such trade - its last trade was July 29. The slip matches heooo's fill share-for-share: 2,400.00 MOUZ shares at 0.55, executed 13:44:14 (tx 0x17a4d7…, unredeemed, +$1,050.30). She posted the linked account's win as her own.

The post showed a $370 position paying $500. Before the post, heooo had already bought exactly 500 shares of the opposite outcome for $125: the pair cost $495, paid $500, made about +$5 - not $130. Her +$44.20 day recap reconciles to -$44.45, a -2.2% day, once the four coordinated opposite positions count.

The circle ran 11 more large matched pairs between December 1 and January 12 and never posted them - six of them 6 to 46 seconds apart. That matched book deployed $28,430 across both legs and netted -$284.69, a -1.00% return.

The counterexamples stay: a hedged pair still won +$31.81 on August 1, and Kate posted an honest -$1,880.43 day loss on August 2. The strict screen still found 33 opposite-outcome events - 634.6 per 1,000 trader-pairs against 0.139 for unrelated bettors, roughly 4,561 times the baseline - and 30 of them lose no matter who wins.

Case 02 · The treasury loop

The Kate circle's own cash-out wallet funds its treasury.

One bankroll sits behind the accounts: winnings leave Polymarket and come back as fresh funding.

The loop closes at Burd: the cash-out wallet itself seeded 12s5qa, the Safe's largest outside funder, and sent it a further 1,598.00 USDC. The treasury's "#1 external funder" is the cluster's own cash-out wallet recycling winnings.

Six single-purpose embedded smart accounts (EIP-7702, all delegating to the same Simple7702Account code) top up Burd, each used only for that. Their money arrives from 0xddf38734…b7b5.

• Not Polymarket's payout path: it is a DepositWallet proxy whose live owner() is a cold EOA, 0xb710fdde…1dd8 - nonce 0, no Polymarket profile.
• Its inflows: 28,861.15 PUSD minted from the zero address across 66 transactions, each routed USDT0 to USDC.e to PUSD through Relay.
• Burd is one of several payees: this cluster-operated treasury wallet pays a customer list:

Each received exactly one transfer from the treasury that feeds the Kate cash-out loop; three Burd-funding EOAs draw from other chains. One cluster-operated treasury funds the Kate loop and four more trading profiles.

September 16 update: four original-operator payments reached the documented withdrawal endpoint. A newly traced hub adds another funding route. Open the verified transactions ↗

Case 03 · The funding tree

One Bybit hot wallet funds every treasury in Wincy's circle.

Wincy's public wallet funded profiles that were created minutes earlier. Behind the whole circle sits one visible upstream: direct withdrawals from 0xbaed383e…439f, tagged "Bybit: Hot Wallet 6".

The accounts were created minutes before they were funded:

• iluvdubnation was funded through an exact $105.334020 handoff 4 minutes 9 seconds after creation - the middle wallet reused the exact amount 12 seconds later.
• f595 funded lolxdkek six times through the same two-bridge route, 62 to 69 seconds each run, and funded 422644 in 57 seconds - first trade 52 seconds later.
• FC1d paid Wincy's public wallet 210 PUSD in consecutive owner-authorized transactions.
• On the way out, 18 linked route outputs credited the exact 0x720191...E2d5 address, totaling $41,227.077678 - one Bybit deposit endpoint reused by every branch of the circle, including Wincy's own public wallet.

All eight BSC legs are transferFrom pulls from the f595 authority 0xC94f994B itself; the 0x4337… vanity addresses are per-request executors, not deposit targets.

The authority's BSC money traces to Binance: two legs came directly from the bscscan-labeled "Binance 51" wallet 0x8894E0a0…D4E3 (449.99 USDT each, July 13 and 20), three more through intermediaries with eight-figure Binance-51 inflows. The operator uses both exchanges.

She distributed US-app invite codes.

On March 31 at 12:02:54 UTC, @gusik4ever posted this, verbatim:

The post's own metadata: lang=en, geo field empty ({}). Her Telegram - first-party, live - names her "Daria Guseva" with the bio "Community Lead in Polymarket Sports". The same account's documented circle runs the treasury stocked by Bybit hot-wallet withdrawals.

Case 04 · The badge crew

itskkoma and 0xbumblebee: the Sports badge, the payouts, and the August 4 stripping.

Polymarket's badge is a trust product: a company icon, a paid X subscription, sometimes undisclosed payment. With the CMO on record promising "There will be a token, there will be an airdrop," it also reads as a claim on future $POLY.

His public record shows an 89.1% win rate and +$28,173.67. Both are an artifact of the same endpoint: he redeems his winners and abandons his losers.

itskkoma is "Kkoma," named co-host of gmPM, simulcast on X, YouTube, LinkedIn, Instagram, and TikTok and billed as "the best tennis quant in the game." The YouTube mirror holds 22 episodes, about 20 hours of his on-camera commentary.

• He sponsors his own show: every episode is "Powered by @Stitch3_ai @bvcket_xyz & @DG3_terminal" - bvcket_xyz is Kkoma's own betting SaaS ($7.99-$24.99 a month), and co-host Dave (@DCBK2LA) sells the slots through his agency, The Web3 Collective.
• His own profile contradicts the pitch: displayed P/L -$1,084.23, biggest win $2,402.52, while he tells followers tennis "has been cooking."
• Self-declared location: "Based in United States" on Superteam as "Al Lee"; an X location-history mirror shows "Los Angeles, CA".

itskkoma's seed capital never came from outside. On his creation day, 2026-07-04, sibling profile nononononoononono ran three declared Relay requests - profiles funding profiles:

• What stands: funded 17 minutes after creation by an operator network that pre-positioned 71,000 USDC two weeks before the profile existed; exactly 85,720.678224 USDC later flowed from his signer into the dormant blposdpaodpsd profile.
• Not an origin: what an earlier report called a "Circle Gateway mint" was the Relay solver's own liquidity - infrastructure, not a source.
• 0xbumblebee sits on a closed Solana funding loop rooted at 3MPpYZ8y…s6Qn. Full route receipts live in the receipt ledger.

His public footprint is referral spam (~$887.33 on Abelix), not fake P&L.

The Kate-to-Bumblebee DMs, badges moving "in exchange for tips," "brags about multi-accounting," and Wincy heading the Polymarket Sports community come from a Quant Chad investigation republished by insider.pm on August 4, 2026; the original is login-walled, the archived republication is readable.

Case 05 · Who pays for all this

Each circle has its own funding source.

Who funds each circle, and what else those funders do.

The one cross-circle overlap is shared bridge infrastructure: both the Kate circle's Solana wallets and bumblebee's funder pay 7uTT8Xi5…i8pZ and F7p3dFrj…gmNe - Relay Protocol's official SVM solver (contract-address docs) and its Solana depository - and a third overlap, Mihso7kX, is address-poisoning dust. It's the bridge, not a link.

The rare referrer tag funxyz|l2vwlwvifj marks 55 publishable requests from 14 sender wallets - 33 Wincy, 19 Kate, 3 badge-crew - and zero strangers in the 1,926-request corpus; the common funxyz|su4gnoxz14 is the proven fun.xyz default (921 requests, 78 sender wallets, 30 unmapped strangers).

Case 06 · The payroll

The cluster wallets collected $18,820 in promotional payouts.

The accounts traded together and got paid together: shared promotional payout rails paid them while they presented as ordinary traders. Every payment below is a public Polygon receipt.

One ClipperPayout contract paid wallets from every circle.

ClipperPayout 0xd15fe25e…80e3 is a 1,780-byte Disperse clone on Polygon: 2,207 mass payouts from 144 different senders, $13.0M in stablecoins, February through August. One tenant runs this payroll: 19 biweekly batches of exactly ~$25,000 in 9-14 amount tiers, January 26 to August 6, 124 wallets. Inside them sit 31 payments to cluster wallets worth $10,815.46.

The kate and wincy proxies were paid in the same transactions 12 times - two supposedly unrelated circles on one payout rail. And one batch goes further:

One transaction, three documented circles, one payer.

Sixty payout waves decoded: betmoar.fun tops the biweekly core.

Every payout the operators ever signed, decoded: 60 waves across two contracts, $1,866,464 total, October 28, 2025 to August 6, 2026 - a $12.5K biweekly core on the canonical Disperse.app contract, doubled to exactly ~$25,000 on the custom clone, plus special waves of $50K, $100K and $175,000.

The top earner of the biweekly core is the same wallet every time: betmoar.fun, the ecosystem's biggest trading terminal, $154,448.45 across 39 payments.

The table below is the 19-batch clone-era core. The rest of the roster is the Polymarket builder ecosystem - copy bots, terminals, analytics apps - with the cluster's accounts in the same transactions. Full 19-batch roster: payroll_19batch_recipients.csv; the original 213-wallet decode: clipper_batch_recipients.csv.

The rail paid profiles and infrastructure alike: the circle's shared Bybit cash-out endpoint collected 150 USDT0 inside the Jun 10 batch. Full 213-wallet roster with every profile match: clipper_batch_recipients.csv.

Seventeen paid wallets carry no public profile - the money through them needs a second hop. Two wash straight into named profiles: 0x9d44bcfe… took $1,770.80 across nine biweekly batches, minted it to PUSD and forwarded $3,082.13 on Jun 15 to ForMarketBeta; 0x992b3d86… took $1,338 across three batches and passed $803 on May 20 to QuantTools. The rail's real recipient list is longer than the batch rosters.

The payroll is one tenant of a $13M payout pipeline.

The operator cluster runs three programs through the same 1,780-byte contract:

• The payroll: $475,026. 19 biweekly batches, Jan 26 - Aug 6, roster above. The last one landed two days after the exposé.
• A second, non-Polymarket payout business: $639,432. The treasury and the money-mover sent 12 mass distributions to thousands of wallets, February to April. Zero of 40 sampled recipients resolve to a Polymarket profile - the same treasury pays a much wider network outside the platform. The $162K batch
• A $959,639 July wave. Operator 0x04ce5aeb… ran 34 batches in 30 days: eight uniform 100 × $500 waves to Polymarket users (30 of 30 sampled recipients resolve to live profiles), six $50,000 tiered batches paying named traders up to $36,500 (Dullie, aoddy, fifaunderdog1), and the Aug 3 roster batch - 90 of its 100 recipients are this file's documented profiles. A 100 × $500 wave

Who runs the pipeline is unnamed on-chain. What is visible: a Relay-bridged treasury, a Bybit-linked money-mover, unlabeled whales stocking each cycle, and the ecosystem's own builder apps collecting the top tier every two weeks.

Refresh check, Aug 16: no new roster batch since the Aug 6 wave - the operators' own wallets are fully scanned post-Aug-6 and sent none; the next biweekly slot (~Aug 20) has not arrived. katelv's dedicated payer, silent since Aug 2, missed its ~Aug 16 slot. Roster-match over 4,026 post-Aug-6 rail transfers: zero cluster recipients.

The operators kept running, though. 0x39861ad4… paid 1,500 USDT0 to the documented bee-rail wallet 0xade330a9… on Aug 8, plus 20, 125, 138 and 250 USDT0 to fresh wallets on Aug 8-14 - each send paired with a same-amount transfer in a lookalike token: the address-poisoning pattern, live after the exposé. The money-mover pushed two ~50,000 fake-USDC sends on Aug 15, and operator 0x04ce5aeb… topped the payout contract up with 296.56 USDC on Aug 11.

katelv's dedicated payer sent four round-sum payments.

0x75e81d04…1ae9 is an EIP-7702 smart account that pays exactly one wallet: katelv's signer. Four payments, all round sums - $3,394 in total: $1,000.11 on Jul 6, $1,000 on Jul 20, and $394.00 + $1,000 on Aug 2. Each executed as an ERC-4337 UserOp with gas self-paid, no paymaster.

Each swap was fed 14-16 seconds earlier by exact-amount unwraps from the PUSD collateral vault, arriving 12-15 seconds after exact-amount transfers from 0xbe3ad881…, a 125-byte clone contract. End-to-end: staged 78 to 117 seconds before execution from a PUSD-denominated source, then consolidated within minutes into Solana treasury BurdG5Ek…UvHLT - the recycling wallet from Case 02.

The batch operator also paid cluster signers directly.

0x39861ad4…3f84 - the EIP-7702 MetaMask Delegator behind the Jun 10 batch, 788 transactions - pays cluster signers directly from its own address:

• 150 USDT0 → 0xbumblebee signer, May 29. tx
• 175 USDT0 → katelv signer, May 30. tx
• 250 USDT0 → 0xbumblebee signer, Jul 11. tx
• Jul 23: funded 0xade330a9… with 500 + 1,000 USDT0 - the same morning that wallet paid itskkoma's proxy 100 PUSD, roughly 28 hours before his DG3-rebate promo post. Grade: candidate - the payment is real, the DG3 attribution is unproven.

One of the payers runs address-poisoning traffic.

The payer 0x1bd8425d… - $1,500 to katelv across April-June, $175 to bumblebee on Jun 11 - simultaneously runs address-poisoning traffic: forged "ÚSDС" tokens, 0-value transfers, lookalike addresses. Six seconds after the Jul 20 payment, a poisoning lookalike dusted katelv's own signer. The USDC payments are genuine; the operator is a poisoning-cluster wallet.

The promo rail and the poisoning cluster are the same operator.

The payers are funded through deposit contracts, Relay bridges, and unlabeled whales.

katelv's staging wallet is byte-provably Polymarket deposit infrastructure. 0xbe3ad881… - the 125-byte clone that pre-funds her $1,000-class payments - carries a bytecode argument matching the verified Polymarket DepositWalletFactory exactly: a DepositWallet clone.

From Jun 25 to Aug 2 it took in 13,643.49 PUSD across 23 transfers, ~90% fresh mints from Polymarket relayer EOAs; outbound it trades on the CTF Exchange V2 and stages the exact-amount transfers into her payment rail.

The money paying katelv flowed OUT of someone's Polymarket PUSD balances; Polymarket the company is not the payer.

The wallet's owner is a ghost: 0xb07275ca… has nonce 0 on Polygon, no labels, no Relay history, zero observable footprint anywhere. It acts exclusively through owner-signed factory batches.

The poisoning-cluster payer's funding resolves to a familiar endpoint. ERC1967 proxy 0xee7ae85f… - Relay-fed, including from Solana - sent 99.88 + 7,404.88 USDC on Jul 1, covering the 7,500 USDC that reached payer 0x1bd8425d… the same day to within $4.76.

The same Binance-controlled smart account received EVplusrebate's $8,000 off-ramp after the exposé and is katelv's recurring Relay source on Base - one endpoint, three threads.

The ClipperPayout 100 × 500 batch traces back to an unlabeled whale. Operator funding runs through money-mover 0x6aeea906…, whose main external load was 99,995 USDC on Jul 30 from 0xf8191d98… - an unlabeled whale with zero mainnet footprint, itself Relay-fed hours before the payouts.

A sibling f8191d98… vanity wallet pushed $20.1M into the b5e4 whale on mainnet. The payroll treasury's first major load came over a bridge: $124,999.97 USDC on Feb 7 from a Relay solver wallet, two days before batch one.

In July a second operator, 0x04ce5aeb…, took $800,010 from unlabeled whale 0xb5e4d212… plus $49,998.07 from that same money-mover and pushed $959,639 through the contract in 30 days - the August uniform batches included. One operation, two operators.

Operator-upstream 0x9e6e9532… is run by 24k-transaction gray signer 0xe2d4a7ff…; its only July inbound was poison dust mimicking operator 0x39861ad4… - even the operators get poisoned.

The payroll sits inside a $15.4M funding machine

The money-mover 0x6aeea906… runs at mainnet scale: 668 USDC transfers, $15.4M in and out, April 2025 to April 2026. Its counterparties are not random wallets - they are generated. At least 38 of them fall into four vanity-address families: c012…efe (the payroll operator's own pattern), b5e4…24e (the whales), 8669…ce01 (the treasuries), d143…e899 (payment endpoints). One key-generation system, one owner set.

The seeding is on the record. Whale 0xb5E4d212… sent the mover five flat $1,000,000 transfers between Nov 13 and Feb 4 - million-dollar loads on a monthly cadence. On Feb 7, within two minutes, $350,000 + $125,000 bridged from mainnet to Polygon over Relay; two days later the first $25,000 payroll batch ran.

The same whale later stocked the July $500-wave operator with $800,010. It holds $20M+ on Base and aggregates $589M, $270M and $162M inflows from fifteen institutional-scale counterparties.

The exit is a bridge. $10.26M of the mover's mainnet outflow - 85 transfers - goes straight into deBridge's DLN source contract, cross-chain and off any single-chain audit trail.

One endpoint touches the badge crew's rails and the payroll machine's funding. The 0xee7ae85f… smart account from the Kate rail above - her recurring Relay source on Base, the wallet that took EVplusrebate's post-exposé off-ramp - also sent $90.5M to the b5e4 whale and $95.8M to the market-making account that stocked the mover. The badge crew's rails and the payroll machine's funding run through the same account.

The payroll money is private, not Polymarket's, and built to stay unnamed

Two rails, one platform. Polymarket's official programs settle from Polymarket's own infrastructure: the pUSD backing vault 0xc417fd8e…, the ada1/ada2 relayer fleet, the CTF exchange - 20,000+ transfers in the midnight UTC window alone. The badge-crew payroll settles biweekly from a Relay-bridged anonymous treasury through a public Disperse clone.

Both rails scanned: zero overlap in payer addresses. The money paying the cluster is private money, not corporate money.

The opsec is professional. 45 operation wallets swept for identity leaks: zero ENS names, zero explorer tags, zero public labels. 48+ wallets across five generated vanity families. Funding enters only through bridge solvers (Relay in, deBridge out) - the exact points where chain attribution ends by design.

The machine's wallets were born pre-funded, sign in a steady 19:00-03:00 UTC window, and never touch a named exchange deposit from the same address twice.

One beneficiary is named anyway. The payroll's top earner - betmoar.fun, $154,448.45 across 39 payments - is a public company: Betmoar, operated by Singapore-based Betmoar Innovation Limited and publicly described as an official Polymarket partner. The anonymous machine's biggest paycheck goes to the ecosystem's most official app.

The machine reloaded from Binance hot wallets on August 10 and 12

The b5e4 whale - the machine's mainnet vault - took $1.3M directly from Binance hot wallet 16 on August 10 and $1.5M from Binance hot wallet 14 on August 12, and pushed $2.3M to settlement endpoint 0x46CF758E on August 11. A week after the exposé, the machine was reloading from a named exchange, on-chain.

Above the payroll sits a distribution hub, 0x48951872 - $3.54M of stablecoins through it since February 2025, wired out to the machine's own generated families. $10,000 to seed wallet 0x721aA1e2 on April 9, 2025 - that wallet's first activity ever, three months before it seeded betmoar's company treasury.

$250,000 wires into the 0x166…f68 family. The hub itself is fed by two unlabeled passthroughs, 0xC4Db5dB4 ($2.0M) and 0x0Dd6E3F3 ($1.04M), and the first shares a settlement endpoint with the whale: both pay 0x46CF758E - $6.8M from the passthrough, $13.9M from the whale. One mesh, from Binance's hot wallets to the badge crew's payroll.

The payroll contract was born from a Bybit account.

The wallet that deployed the ClipperPayout contract - 0x64240371fe…, purpose-built, never used on any other chain - received its first gas at 09:23 UTC on April 5, 2025: 4.978 MATIC straight from Bybit Hot Wallet 1 - an exchange account withdrawal, KYC'd at the exchange. Nine minutes later the deployer sent its first transaction; four hours later it deployed the payout contract through the CreateX factory.

Every dollar the badge crew and betmoar collected from that contract traces to an address born from a Bybit account. Bybit knows who.

The contract sits on a settlement mesh at institutional scale. Endpoint 0x46CF758E alone cleared $1.77B in and $1.62B out between June 2024 and August 2026 - including $391M from the machine's own b5e4 whale, $415.9M from the distribution hub's funder 0xC4Db5dB4, and $12M straight from Binance 14.

The money-mover drew its own first gas from that same hub funder on April 29, 2025. The badge crew's $1.87M payroll is a small slice of a billion-dollar settlement flow.

The anonymous account above Kate was switched on by Kate's own treasury.

The staging wallet 0xbe3ad881… is also a complete anonymous Polymarket account - no username, no profile - that placed 18 trades for $10,634 across 15 markets (CS2, WNBA, World Cup) between Jun 18 and Jul 26 while staging the $1,000-class payments into katelv's rail. Its owner key 0xb07275ca… holds nonce 0 on Polygon, Ethereum and Base: a signature-only key that has never sent a transaction on any chain.

The bootstrap names the circle. On Jun 18 the account was seeded through a single-use Solana wallet - 8w4dKxbi…, five lifetime transactions, all inside 90 minutes. At 14:31 it took 10 USDC from 9pMoP274…, a wallet still active as of Aug 14.

At 15:58:15 it received 0.02 SOL of gas from BurdG5Ek…UvHLT - Kate's own Solana cash-out treasury (Case 02). Forty seconds later it bridged $109.75 into the ghost wallet, which placed its first trade eight minutes after.

The unidentified principal above the Kate circle was funded by the Kate circle itself.

It mirror-trades the wincy circle's anonymous account. Wincy's circle runs an identical no-profile DepositWallet, 0xf595d7f0….

The two anonymous accounts sit on the same side of the same five World Cup markets - England, Spain, Argentina, Paraguay/France, Brazil/Norway - minutes to hours apart, alternating who enters first: f595 bought England 15:06, the ghost followed 15:21; the ghost bought Argentina 18:54, f595 followed 21:27.

On Jul 19 the Kate circle's own anonymous account Infinite-Temper (0x359bb0a9…) took Yes at 18:58 against the ghost's $500 No at 17:26 - the two circles' hidden accounts trading against each other on one market.

It also draws from a 513-wallet anonymous payroll ring. Sender 0x9653915a… pushed 121 Disperse batches - $38,753.27 in round amounts to 513 no-profile wallets (full recipient list). The ghost collected $338.67 across ten batches, including the largest single cut of the Jul 20 batch ($300 of $2,250).

The sender is loaded by the poisoning-cluster payer 0x1bd8425d… ($2,249.95), by unlabeled gray EOA 0xafd13cbd… ($18,488.40), and by a zero-volume account created May 13 under the auto-name "Verifiable-Temperature-Commitment" ($2,524.84).

One app absent from Polymarket's builder directory signs the ring's orders

Every Polymarket order can carry a builder code naming the app that routed it. The maker-side code, decoded on all 26,722 fills from the ring's 40 biggest wallets: 19,977 carry one code - 0xe67c1c79… - and 30 of the 40 wallets use it on every single order they ever placed.

That code appears nowhere in Polymarket's builder directory: all 581 entries scanned across the leaderboard and volume table. No name, no logo, no rank, no rewards credit. Whoever runs the farm built private order software and signs the fleet's orders with it.

The ghost above Kate signs 18 of 18 orders with the same unlisted code - the account that pays Kate's rail and the 513-wallet ring run on the same private software.

The public faces are different: katelv, heooo, chudddd, Infinite-Temper and 5150 carry zero builder code on 473 combined fills - they trade on polymarket.com like any user. Wincy's anonymous account f595 signs 426 of 426 orders through Bagel's public, verified builder code - the app Kate publicly farms referrals for.

The faces use the website; the hidden layer runs on in-house software.

The ring also holds its own bankroll. Between payroll batches, the ring's whale wallets cycle six-figure sums among themselves: 0xa76c3fc6… pushed $195,760 to seven sibling ring wallets, 0xd942d7e8… $179,344 to seven, 0x9c9c6d95… $165,458 to four - 120 direct ring-to-ring transfers in the scanned window. The $50-$300 payroll batches are seed money. The operation's real float is internal.

Case 06B · the accusation

The app that tells users who the smart money is takes its paychecks from the machine.

betmoar is the ecosystem's order-flow terminal: whale alerts, top-holder lists, UMA vote tracking, the Discord bot inside Polymarket's own community server, roughly $817M routed through the Builders Program. The product is free and no pricing page exists. The accusation: betmoar runs on the anonymous payroll documented on this page.

The machine put the first dollar into betmoar's company treasury on July 17, 2025, then paid betmoar more than anyone else - $154,448.45 across 39 payments, on the same payroll that pays the Kate and Wincy circles. betmoar has never disclosed any of it. A feed that sells "who the smart money is" is funded by the operation manufacturing that flow.

The payroll ran two months on the canonical Disperse app before the clone existed.

Operator 0xc0126535…59efe sent the first batch on November 9, 2025 through Disperse.app's official contract: $12,499 to 11 wallets, $2,500 of it straight to betmoar. Eight more canonical batches followed, growing from 11 recipients to 35 - $150,010 before the clone ever signed.

When the custom contract opened on January 26 it was a rewrite, not a beginning: same operator, same roster, bigger checks. The earliest clone-era payment to betmoar, $3,528, landed January 12 - two weeks before "batch one".

The betmoar profile wallet collects the payroll and forwards it.

betmoar's Polymarket profile wallet holds a handful of test-size trades from the 2024 election era and does one thing at scale: it forwards the payroll income. Three transfers - $31,565, $20,833, then $61,497.95 - move $113,895.95 into company treasury 0xb04529d5…

The machine's own treasury sent that same company treasury $2,750 on January 4, before the clone era even opened. Whoever pays the roster pays betmoar's company, directly and on purpose.

The company treasury's first-ever funding - $3,000.29 on July 17, 2025 - came from 0x721aA1e2…, a wallet the payroll's money-mover had loaded with $35,000 three days earlier and with another $200,000 the week after. The seed money for betmoar's company wallet is machine money, one hop removed.

The same seed wallet then ran a parallel program of its own: dozens of identical $22,104 payments - $398,477 in September 2025 alone - into a sixth generated vanity family, 0x166…f68, and bridged $69,476 out through LiFi Diamond.

betmoar pays its own side through generated vanity wallets - the machine's signature.

Out of the company treasury, the money lands in fresh vanity families: three 0x61aa…4fb9 wallets, three 0xc254…3f73, two 0xc7a8…a5c3, two 0x84cc…a322 - the same generated-address pattern the payroll machine uses for its operators, whales, and treasuries.

One of the c254 wallets is not anonymous at all: 0xc25427ea… trades Polymarket as TeemuPukki, where the latest 500 trades alone clear $952K in notional on the sports and politics book - the same sports book the badge crew promotes.

A wallet paid by the payroll's top earner trades the category the circle shills.

Two more rows from the treasury's ledger: TK1803 collected $550.02 and has never placed a trade; another $10,000 went to 0x851821fc…, a wallet with no profile and no public footprint. And TeemuPukki's book is the fleet's book: 53 of the 230 markets in his latest 500 trades are the same World Cup dailies and esports markets the payroll ring's sampled accounts trade.

betmoar is the ecosystem's most official app - and the machine's biggest payee

betmoar is Betmoar Innovation Limited of Singapore - publicly described as an official Polymarket partner and the Discord bot provider inside Polymarket's own community server. Its product surfaces order flow, market news, and UMA resolution votes before most of the market sees them. There is no team page.

What is on the record: the anonymous payroll's biggest paycheck - 39 payments, $154,448.45 - goes to this company; its company treasury's first dollar traces to the payroll's money-mover in a single hop; and it pays its own side through the same kind of generated vanity wallets the machine uses. No public statement explains any of it.

betmoar's product is free, routes $817M, and carries two company names in one contract

Every dollar the company ever received on-chain is machine money.

Every stablecoin transfer into company treasury 0xb04529d5…, audited across its full history. Four sources exist. Everything else ever sent to this wallet is zero-value poisoning dust.

$129,646.24 in total. Not one dollar of customer, investor, or product revenue appears anywhere in the treasury's history. The company behind the ecosystem's biggest builder app has exactly one financier on-chain: the anonymous payroll that also funds the Kate and Wincy circles.

None of it is Builders Program money. betmoar is the program's rank-1 builder - verified, 3,730 active users on the official leaderboard, ~$817M in routed volume - and the program pays two ways: builder fees settling to the wallet tied to the builder profile, and a weekly USDC reward pool that opened November 2, 2025.

The treasury's first dollar landed July 17, 2025, three and a half months before that pool existed, as the fourth and final stop of a seven-minute distribution run: $100.02 then $11,902.33 to machine wallet 0x3a0aee0b…, $9,987.98 to 0xd42f6a16…, then betmoar. A corporate reward program does not pay out as the last stop of an anonymous wallet's funding run.

The machine's treasury collects from itself, never from customers

Every funding source of the machine's own treasury 0x8669debf… - the wallet that wired betmoar's company treasury $2,750 on January 4 - audited. Twenty sources, $1,270,325.61 traced.

Every dollar is the machine feeding itself: $378,967.15 from its own money-mover 0x6aEea906…, six anonymous EOAs wiring $49,999 to $144,620 apiece ($619,978.90 combined), a $124,999.97 settlement from a Relay bridge solver, an $84,489.56 bridge mint issued straight to the treasury by the token contract on February 23, 2026, and a swap through the 1inch router.

Not one of the payroll's 124 payees ever sends a dollar back. A business collects from customers; this treasury collects from itself. Full source table: machine_treasury_inflows.csv.

The rest of the company's money, traced one hop further: $50,000 to 0x675568fe… - a wallet with exactly one outbound rail: Binance's hot wallet, $151,167.95 cashed out through it in total (tx).

$30,000 to a Daimo Pay executor contract - a crypto checkout rail: someone got paid, off-chain. $17,250 in bond-size transfers to UMA's official Optimistic Oracle - the team's wallets assert market outcomes with real bond capital on the same resolution layer their product tracks.

$43,500 to a settlement contract wired into Polymarket's official UMA CTF Adapter V4 resolution pipeline. Company money trades, resolves, cashes out to Binance, or pays through a checkout rail. No invoices, no payroll, no vendors with names.

None of the six team payouts bought anything on-chain.

Every company-treasury payment to a team wallet, followed one hop. None of it buys anything on-chain. Leg table: betmoar_team_payouts.csv.

Two of the six payout addresses are not wallets at all - they are Daimo Pay intent contracts, so paying them is paying a crypto checkout. Three more are plain EOAs whose balances Daimo's relayer pulled into checkout contracts 6 to 10 seconds after landing, each pre-approved for exactly one payment. The sixth bridged its own $1,000 out through LiFi's Mayan route. $30,000 of the $31,000 ends inside Daimo Pay - the exact total documented above, now attributed leg by leg.

Jun 4, 2026, 09:10:21 UTC - ninety seconds before the final $10,000 leg - the treasury sent $1.00 to 0x5bc2c49a…. Polymarket's own public-profile API resolves that wallet to the main betmoar.fun profile. The test went to the product's own user wallet.

The payroll's one named trader moved five figures the day after the exposé. Aug 5, 2026, 23:08:54 UTC: one relayed transaction put $10,000 into TeemuPukki's wallet from a proxy contract and straight out to 0x675568fe… - the ghost cash-out above, whose only rail is Binance's hot wallet.

TK1803 never placed a trade. Its wallet relayed $3,283 in 218 transfers.

The treasury paid 0x61aa0507… - the wallet behind the TK1803 profile - $550.02 on Oct 15, 2025. The profile has zero trades. The wallet runs a relay: 218 stablecoin transfers, Dec 30 2025 - Jun 18 2026, $3,283.23 in and $3,180.09 out. Money arrives from DEX settler contracts and in 14 direct sends from Bybit Hot Wallet 1 - the hot wallet that gassed the ClipperPayout deployer - and leaves within 30 seconds to 4 minutes: 39 transfers ($1,407.77) to its own trading Safe 0xE51525dF…, 46 transfers ($1,044.01) to a second TK-branded profile, Tk1803w, the rest through a Uniswap adapter and two receive-only addresses with zero transactions of their own. The wallet also sits under a spray of zero-value transfers from lookalike vanity addresses mimicking its own destinations - the address-poisoning pattern documented around the payroll.

One wallet keeps the payroll alive. It also wired betmoar $10,000.

0x3a0aee0b… is the machine's operations wallet, on mainnet and Polygon at once:

The payroll's operator, the money-mover, and betmoar's company treasury all answer to one operations wallet. betmoar is not a payee of the machine; it sits inside the machine's plumbing.

39 payments, $154,448.45. Hover any bar for date and amount. Two weeks (Feb 27 / Mar 2) were paid off-ledger through the payroll passthrough wallet instead of the batch contract. Last check: $3,854.67 on August 6, two days after the exposé. First wave: $13,091 on Oct 28, 2025 - the machine treasury's first day alive. Biggest single wave: $175,000 on Mar 4, 2026.

The payroll's biggest paycheck went to a free product, every wave, for nine months.

betmoar charges users nothing, publishes no pricing, and names no founder. Yet an anonymous payroll machine - born from a Bybit account, funded through bridges, run through generated vanity wallets - chose this company as its number-one payee, every wave, for nine months.

What the machine buys with that money appears in no contract and no disclosure. What is on-chain: the payroll's own farm produces exactly the sports-book volume that builder apps are measured by, and betmoar's treasury-paid team wallet trades that same book.

Case 07 · After the exposé

After the exposé, the pairing stopped and the trading moved to fresh wallets.

The community called them out on August 4. In the twelve days after, the katelv × heooo pairing stopped dead (25 same-outcome pairs before, zero after) and the ClipperPayout payroll rail's PUSD payouts fell from 119 recipients to zero while the same contract got busier paying everyone else. The trading never stopped - it rotated to fresh wallets.

communityMod is the platform's own community-moderation designation; verifiedBadge is its verified mark. When staff stripped this circle's Sports badges on August 4, these flags were left on: katelv's pair read true on August 6, again on August 9, again on August 17 - every snapshot on file. Re-checked August 17 at 12:41 UTC: still true. d1namit's communityMod read true in that same August 17 snapshot. The flagged two are not random accounts: one posts the hedged wins of case 01, the other drew from the ClipperPayout payroll. Polymarket's trust system currently vouches for two accounts this page places inside a coordinated fleet.

The Aug 17 sweep, account by account, with API receipts

Account	Group	Platform flags	Receipt
gracechase	kate	none	Polymarket API ↗
heooo	kate	none	Polymarket API ↗
andreho	kate	none	Polymarket API ↗
andreww	kate	none	Polymarket API ↗
vuiko	kate	none	Polymarket API ↗
svetlikvl	kate	none	Polymarket API ↗
butzki	kate	none	Polymarket API ↗
briskona	kate	none	Polymarket API ↗
anastaasia	kate	none	Polymarket API ↗
katelv	kate	communityMod: true + verifiedBadge: true	Polymarket API ↗
andreas12	kate	none	Polymarket API ↗
harsh_nation	kate	none	Polymarket API ↗
bulky_banjo	kate	none	Polymarket API ↗
seyoka	kate	none	Polymarket API ↗
infinite_temper	kate	none	Polymarket API ↗
notbroken2	kate	none	Polymarket API ↗
iluvdubnation	wincy	none	Polymarket API ↗
lostnpeace	wincy	none	Polymarket API ↗
lolxdkek	wincy	none	Polymarket API ↗
polyhelper	wincy	none	Polymarket API ↗
po1yhelp	wincy	none	Polymarket API ↗
wincy_funding_path_95ff	wincy	none	Polymarket API ↗
wincy_f595	wincy	no public profile record	Polymarket API ↗
wincy_422644	wincy	no public profile record	Polymarket API ↗
0xbumblebee	bee_kkoma	none	Polymarket API ↗
itskkoma	bee_kkoma	none	Polymarket API ↗
d1namit	directory	communityMod: true	Polymarket API ↗
chudddd	directory	none	Polymarket API ↗
internr	directory	none	Polymarket API ↗
fivemintrade	directory	none	Polymarket API ↗
OxVooDoo	directory	none	Polymarket API ↗
blposdpaodpsd	directory	none	Polymarket API ↗
manvsrice	directory	none	Polymarket API ↗
whosay	candidate	none	Polymarket API ↗
manvsrice42	candidate	none	Polymarket API ↗
ojg	candidate	none	Polymarket API ↗
123412341234	candidate	none	Polymarket API ↗
yupiiiiiiiii	treasury	none	Polymarket API ↗
BreakTheBank	treasury	none	Polymarket API ↗
EVplusrebate	treasury	none	Polymarket API ↗
duratio6	treasury	none	Polymarket API ↗

itskkoma kept trading and promoting; he never acknowledged the exposé.

35 trades and $25,397 across 13 markets, every day from Aug 4 00:31 to Aug 9 00:10. His posts on the dexu.ai mirror match the chain to the minute:

On Aug 8 he posted "Man I hope this $POLY airdrop makes us rich" - 89 likes. No denial, no badge-scandal mention, no apology anywhere in the indexed record.

He sped up. Aug 9-15 added 69 trades and $73,712.96, bringing the post-exposé record to 104 trades and $99,109.74 across 38 markets, last trade Aug 15 23:11 UTC.

The reload rail kept him funded: operator 0xc55b68e4… sent $51,633.73 to a new pass-through, 0xbb0898e2…, in four transfers on Aug 4, 13 and 14; the pass-through forwarded $25,095.55 (Aug 8) and $5,757.30 (Aug 13) to his signer - the second 8.5 minutes after the operator's exact-amount inflow. $25,662 cycled back to the operator through a second pass-through, 0x8eae9e55…, on Aug 8-14.

Kate kept moving money - then returned to the platform.

On Aug 8 at 13:42 UTC her signer 0x0275ddd99e992f6e2c029c7bd516964387aa2ff9 sent 25.130006 USDC on Base to BurdG5Ek3oAoW276YkVbg6bbGwQtphsvfgtixZjUvHLT - the documented recycling wallet - arriving as 25.113615 USDT on Solana, four days after the stripping. Her profile's verifiedBadge still reads true as of August 16, and the same API flags her communityMod: true. A sweep of all 43 tracked accounts on August 17 found platform trust flags on exactly two: hers and d1namit's.

Her Solana treasury kept getting refilled through the documented PUSD pipeline: the known funder EOA 0x85f6f328… sent three more routes on Aug 9-10 (140, 50 and 100.305276 USDC.e), and a sixth single-purpose funder, 0xd6aa7fcc…, appeared on Aug 14 with 498.186342 USDC.e - same PUSD source, same redeem path, same Relay deposit, spun up ten days after the exposé.

After eighteen silent days she returned on Aug 16 with two buys, $52 total, on "Games Total: O/U 2.5" Over - 43 minutes after lolxdkek bought the same side of the same market. One instance: logged as a timing candidate, not a case.

0xbumblebee's funding loop kept running.

Eight small trades for $789.60 - the eighth a $28.85 buy on Aug 10. On Aug 6 his signer sent 122.877 USDC on Ethereum and 23.380414 USDC on Base to his documented Solana root 3MPpYZ8ydLjdJ5KKc1CKMhEJNeF2bhduNoNHqESps6Qn; the root sent seven returns back on Aug 9-10, six of them $3-5 dust, the last 102.419079 USDC swapped to ETH. The two-way loop from Case 05 kept running past the exposé week.

He also leaned on the shared Relay endpoint 0xb92fe925…: 25 dust bridges from his signer between Aug 10 and Aug 14. That endpoint already collected from the Kate circle (polyhelper 15 routes, vuiko 3) and itskkoma ($13,000 on Jul 22, $20,000 on Aug 2) - the bee circle became its fourth documented source after the exposé, 45 documented routes in all.

The treasury profiles traded $2.31M in five days; one cash-out paused.

Cash-out as usual: EVplusrebate unwrapped 5,000 PUSD on Aug 4 and 3,000 PUSD on Aug 6 to payout wallet 0x76058fC2bEB5E9234b97044Da63069bBF0e16338 - an established route, 24 transfers and $69,777.32 since March 27, uninterrupted. duratio6's signer 0x3F87044B8bA6C92d6B9c8bD552D9c3FC89247Ec1 put in 2 × 10,000 USDC.e and swept $26,628.16 back over 20 routes Aug 5-9, largest 14,851.25 on Aug 6.

The signer is a pure pass-through: it forwarded $26,575.01 in exactly 20 plain transfers to 0x99081bf0… - the $53 delta is Relay fees. duratio6's profile was created on August 1 - three days before the exposé.

The six-day raw-chain sweep - 4,411 stablecoin events from Polygon logs - shows money coming in, not just out: 134 fresh PUSD mints totaling $1,546,097.67 across the five active profiles (yupiiiiiiiii $1,005,234.18, BreakTheBank $468,236.19, EVplusrebate $26,036.80, duratio6 $25,417.61, itskkoma $16,403.49). Actively bankrolled, not winding down.

The sweep also caught flows the platform APIs never showed. yupiiiiiiiii's proxy sent 43,142.114700 PUSD to 0x8bfee7ae… on Aug 5 01:28 UTC - a cash-out with no Relay route, invisible to the request corpus. EVplusrebate's payout wallet forwarded $5,000 (Aug 4) and $3,000 (Aug 6) onward to 0xee7ae85f…, an off-ramp to a Binance-controlled endpoint - the same endpoint is katelv's recurring Relay source on Base.

BreakTheBank's payout wallet 0x05D0d36ebc37f58C9B7902Cc3854994342afCF25 received 50 routes and $8,078,772.97 between June 16 and July 29 on a near-weekly cadence, batches up to $400,000. The cadence pointed to a batch around Aug 5-12. None came, while the profile kept trading ~$965k: zero Polygon stablecoin events touched the wallet in six days.

Extended through Aug 16: three of the four kept trading - BreakTheBank added 2,644 trades and $3,501,719, yupiiiiiiiii added 963 and $419,450, EVplusrebate added 1,782 and $285,678 after Aug 9. duratio6 never traded again - referral rewards only. And the payout wallet stayed quiet: zero new Relay routes to 0x05D0d36e… as of Aug 16. The skipped week became two.

Small daily trades kept the accounts active.

Since Aug 4: lolxdkek placed 75 trades for $928.92, the f595 account placed 75 for $1,162.89 plus 54 redeems, and heooo placed 9 small esports buys for $1,450. None of the three exited.

The lolxdkek × f595 mirror kept running: seven same-outcome buy pairs inside ten minutes on Aug 12-16, 16 to 237 seconds apart - eleven such pairs pre-cutoff, twelve in all. The newest pair landed Aug 16 at 16:00 UTC, two hours past the cutoff: both accounts bought Casper Ruud, $5.15 and $5.21, 47 seconds apart. The heooo × katelv pairing stopped dead: 25 same-outcome pairs before, zero after. But heooo cashed out twice to the Kate circle's shared Solana wallet 2vTs2N1v…: 455 USDC.e on Aug 10 and 1,010 USDC.e on Aug 12 - 53 documented routes from four sources now.

The circle's shared dust Safe 0x115f48dc… kept collecting: 88 documented payments totaling $150.30, eleven of them post-cutoff sends from four of the five documented sources - wincy_f595 six times, itskkoma three (one for $20.40), lolxdkek and 0xbumblebee once each. The last landed Aug 16 at 12:37 UTC: 0.22748 PUSD from wincy_f595.

Post-exposé, the payment screen caught a new name: whosay.

Grade: candidate. On Aug 10 at 14:43:03 UTC itskkoma's proxy bought 300 Dellien shares directly against a sell from the Safe trading as whosay: two accounts, opposite sides, one matchOrders transaction - $192.00 PUSD to whosay, $3.456 to the dust Safe. whosay had bought the same 300 shares 75 seconds earlier for $21 less. Four minutes later the two wallets reappear inside one 12-fill matchOrders transaction. No market-maker sits between them. One of ten same-market rows inside six minutes, 2 to 79 seconds apart.

The sync predates the exposé by months: 45 pairs within 120 seconds against five documented accounts, Feb 15 through Aug 11 - eleven opposite-outcome pairs against lostnpeace on whosay's first trading day (the receipts show one lostnpeace order, 78.77 Vitality shares at 0.635, sitting inside an eleven-transaction TheMongolz burst over 98 seconds; Vitality won, lostnpeace exited at 0.999 for +$38 two hours later, whosay sold into the collapse at 0.21-0.24 about an hour after buying at 0.33-0.38 - the money moved the wrong way for a hand-off), a zero-second pair against 0xbumblebee on Jun 11. No treasury link and no shared bridge endpoints surfaced; the grade stays candidate.

The screen flags two more post-cutoff clusters: manvsrice42 × itskkoma on Aug 13, eleven rows 2-91 seconds apart on opposite sides, one settling in the same transaction, and ojg × itskkoma and wincy_f595 on Aug 15, sixteen rows at 3-100 seconds. Both public records are honestly negative; the only roster-linked inflows either Safe ever received are ~$10 matchOrders fills from lolxdkek's proxy in May.

The funding side adds another name. whosay's owner wallet runs a two-way loop with one counterparty - $82,000 in against $84,059 out across 22 transfers - and that counterparty resolves to a second Polymarket account, the numeric-handle profile 123412341234 (@qqdasdzxc, created Oct 2025). It runs the same two-wallet setup as whosay, a trading Safe fed by its owner through a pass-through wallet moving $108,000 at a time, and it trades in lockstep with whosay: 312 same-outcome pairs inside 120 seconds across six days, five settling inside the same transaction (three verified on-chain, two sharing activity-feed identifiers that never appeared on blockscout), most of them after the exposé. The same screen finds at most three pairs against any roster account and zero against itskkoma. It does share one direct fill with the roster: on Mar 12, in the Russia-Kyiv strike market for the week of March 2, katelv's proxy held two resting Yes orders (100 shares at 0.57, 91.93 at 0.55) that a 209.27-share No taker order from 123412341234's Safe swept at 0.4387 - a direct counterparty trade, not a shared batch. Context reads against coordination: both accounts worked that market independently all day, katelv stacked 391.93 Yes between 0.51 and 0.57 and dumped it at 0.70 within the hour, and the cell account sold its No leg 47 minutes later at 0.273, taking the loss on the fill. Its first-ever trade points the same way: one $1,999 No buy on Oct 20, 2025, crossed against an unrelated market-maker contract's resting order - no roster wallet on the other side, no repeated first-day pattern. Its public record reads 99% wins across 10,307 closed positions, but 86% of those positions were bought at 99 cents or better on markets about to resolve - the 99% is a strategy artifact, not curation. Coordinated with whosay, adjacent to the circle; no treasury link, payroll rail or shared bridge endpoint. Archive.org's index holds zero captures of the @qqdasdzxc handle on x.com or twitter.com - no archived posts to check against the chain record.

Both kept trading after the cutoff: whosay added 36 trades and $4,331.77, 123412341234 added 7 trades and $4,890.88. On Aug 17 they were in the same market again, the Uchijima first-set total at 8.5 games: 123412341234 bought $2,396.31 of Over at 07:59:27 UTC, whosay bought $22.50 of Over at 08:00:01, 34 seconds later. Their redemptions landed in one bundled transaction at 08:40:07 - an ERC-4337 bundle that also carried two unrelated accounts, so it is a bundler artifact, not a link.

Running delta log, all times UTC:

Aug 17, 12:41-19:26 - wincy_f595, lolxdkek and 123412341234 placed small trades ($54.61 combined); no new sync pairs; no tracked-source dust Safe sends; 123412341234's pass-through loop cycled another $522.76.

Aug 17, rail runs - three ClipperPayout batches, none paying a tracked wallet: $3,851.57 to 22 mostly established accounts at 16:27; $1,600.10 to 14 fresh shells - zero transactions, zero Polymarket activity, no profiles - at 16:53 and 16:57, from a burner wallet created six minutes before its first batch, gassed by the same funding service that routinely fuels documented payroll operator 0x04ce5aeb, and loaded with $3,115.76 in USDT0 from a vanity-address fleet; a 420-recipient BET-token airdrop at 20:11. The rail serves many tenants, and at least one of them pays shells post-exposé.

Aug 17, 20:15-22:09 - no roster-directed batch; the shell runs' upstream 0x6872b663 kept churning USDT0 ($2,629 in against $5,196 out, no tracked counterparty); whosay placed one $6.53 trade; treasury account yupiiiiiiiii placed nine trades ($169.36, Strait of Hormuz and Greenland markets); dust Safe received spam only; katelv and d1namit still carry the communityMod flag (re-checked 22:09).

Aug 17, 22:09-22:39 - rails silent: no clone batch, no movement on operators, burners, the vanity fleet or its gas service; canonical Disperse paid $1,533.78 to third parties, none tracked. whosay ran its documented 99-cent pattern on the Cirstea match: bought 504.57 shares at 0.99, sold at 0.999 four minutes later. yupiiiiiiiii exited a $3 Hormuz position. Dust Safe received nothing. katelv and d1namit still carry the communityMod flag (re-checked 22:39).

A third-party @gusik4ever bio snapshot still claims "Community Lead @PolymarketSport" - undated.

A verified top-100 account runs an undisclosed resolution wallet.

Car (@CarOnPolymarket) - rank 81 by all-time volume, verified badge, communityMod flag - funds a wallet that proposes UMA resolutions on markets he trades. Seven proposals were overturned by the DVM - all Yes, all on markets he trades. The full record - the attribution chain, all seven overturns, the fifteen verified order matches against roster accounts and the $191,266 seeded fleet - sits in its own chapter.

Original Car chapter — archived copy; see the September 16 corrections above

Case 08 · the verified operator

Rank #81 proposes the outcomes he bets on.

Car (@CarOnPolymarket) is a top-100 account by all-time volume - $180.8M traded, +$1,488,267 realized - carrying the platform's verified badge, communityMod and creator flags. His Safe funds a second wallet that never takes a position. Its only job is proposing and disputing UMA oracle resolutions on the markets car trades. Seven of its Yes proposals were reversed by UMA's token-holder vote; the ledger below shows the bags he carried into them.

$180.8Mall-time volume · rank #81 · leaderboard

121price proposals filed by the funded wallet

7overturned by UMA's DVM - all Yes, all markets he trades

$191,266seeded into 11 PredictFolio-branded profiles

Allegation 1 · the hidden oracle wallet

One wallet, one job: resolutions on his own markets.

0x3e8379fa… never takes a position. Its first stablecoin inflow is $888 in USDC.e from car's Safe, two minutes before its first transaction. 37 direct sends from the Safe total $37,966 - eighteen of them exactly $750, the proposer-bond size. Relay logs add $1,036,420 across 55 routes. Its 367 transactions since Jul 12 2024: 121 price proposals, 20 disputes, 13 resolutions.

Oracle wallet 0x3e8379fa…$888 first inflow, Jul 12 2024car's trading Safe

Allegation 2 · overturned on his own book

Seven proposals the DVM reversed - all Yes, all on markets he trades.

Forty-five of the 47 disputes against its proposals came from 36 outside wallets; the machine filed the other two against itself. On Apr 23, 2026 it proposed Yes on "US x Iran ceasefire extended by April 22" after the deadline had passed - car held 39,343 Yes shares at the time. On the Russia-sanctions market it proposed Yes three times in eight days; his Yes position went from zero at the first to 2,000 at the second to 4,178 at the third. That is the pattern: the first proposal arrives with an empty book, the repeat arrives loaded.

Request (UTC)	Market	Proposed	Final	Dispute receipt
Mar 26 2025	Will Trump increase sanctions on Russia before June?	Yes	No	tx ↗
Apr 2 2025	The same sanctions market, proposed again	Yes	No	tx ↗
Mar 27 2026	Will Iran conduct a military action against Israel on March 27?	Yes	No	tx ↗
Apr 20 2026	US x Iran ceasefire extended by April 22, 2026?	Yes	No	tx ↗
May 25 2026	Iran agrees to end enrichment of uranium by July 31?	Yes	No	tx ↗
Jun 19 2026	The same uranium market, proposed again - disputed by the proposer itself	Yes	No	tx ↗
Jun 23 2026	US x Iran diplomatic meeting by July 3, 2026?	Yes	No	tx ↗

Every false proposal failed and the DVM reversed each one. Twice the machine disputed its own proposal - the oracle wallet on Jun 19, the vanity hub on Feb 3 - and a self-dispute keeps the forfeited bond in-house. Bond losses to outsiders across the remaining overturns and 11 wrong counter-disputes run roughly $9,000-13,500.

Ceasefire marketSanctions market

Allegation 3 · the acquisition ledger

The wallet proposes Yes while his book is empty, then again after he loads it.

On four of the overturned markets the sequence repeats: the wallet proposes Yes while car holds nothing; he accumulates Yes; the wallet proposes Yes again with his shares on the book. Positions are the trade-log net at the proposal minute; the bond at stake each time is $750.

Market - all finally No	Yes accumulated before the repeat proposal	Held at the proposal minute	Payout if Yes had stood	Proposal (UTC)	Receipts
Trump increases sanctions on Russia before June proposed Apr 2 and again Apr 3 2025	16,105 Yes for $8,979, Mar 30 - Apr 2	2,000 → 4,178 Yes	$2,000 / $4,178	Apr 2 14:13 - 13 min after a 1,818-share buy at 0.89	buy ↗ proposal ↗
US x Iran ceasefire extended by April 22 proposed Apr 20 (held 0) and again Apr 23 2026	105,003 Yes for $23,476, Apr 21-23	39,343 Yes ($4,881 net)	$39,343	Apr 23 02:15 - after the deadline	first buy ↗ proposal ↗
Iran agrees to end uranium enrichment by July 31 proposed May 25, then twice on Jun 19 2026	5,000 Yes for $3,250, Jun 18 23:57	5,000 Yes	$5,000	Jun 19 00:02 - five minutes after the buy	buy ↗ proposal ↗
US x Iran diplomatic meeting by July 3 proposed Jun 23 (held 0) and again Jul 3 2026	18,582 Yes for $7,507, Jun 26 - Jul 3	9,699 Yes ($3,697 net)	$9,699	Jul 3 17:44 - deadline day	first buy ↗ proposal ↗

The uranium row is the tightest: 5,000 Yes at 0.65 for $3,250 at 23:57; the wallet proposed Yes five minutes later. On the ceasefire market the repeat proposal came after the April 22 deadline with 39,343 Yes on his book - a $39,343 payout against $4,881 spent, had it stood. flying-wheel bought the No side thirty minutes later (Allegation 4).

The mechanism, step by step · Russia-sanctions market, Mar 26 - Apr 3 2025

He bought the outcome. His wallet proposed it. UMA reversed it.Replay ⟳

Step 1 · Mar 26, 2025His oracle wallet proposes YES - his own book is emptyThe market asks: will Trump increase sanctions on Russia before June? The wallet his Safe funds answers Yes. Car holds 0 Yes shares at that minute.proof: 0x5d69c8…6796 · an outside wallet disputes it ↗

Step 2 · Mar 30 - Apr 2He loads the bag: 16,105 Yes for $8,979His trading Safe accumulates for four days. The last 1,818 shares at $0.89 land Apr 2, 14:00 - thirteen minutes before the wallet speaks again.proof: 0x0d6863…32a6 · first buy, Mar 30 14:03 ↗proof: 0x07e9ac…f58b · 1,818 Yes @0.89, Apr 2 14:00 ↗

Step 3 · Apr 2, 14:13 UTCThe wallet proposes YES again - he holds 2,000Thirteen minutes after his buy. A Yes resolution pays $1 per share: $2,000 on his book.proof: 0x9a9529…af88 · the proposal ↗proof: 0x811093…bb72 · disputed again ↗

Step 4 · Apr 3, 00:49 UTCAnd again - with 4,178 Yes on his bookOvernight he adds 2,178 more shares. The wallet proposes Yes a third time.proof: 0x923691…c6ec · the proposal ↗

Step 5 · UMA token-holder voteBoth disputed proposals reversed - the market resolves NOBoth $750 proposer bonds are forfeited to the disputers. Six more of its Yes proposals die the same way on other markets he trades.proof: the resolved market ↗

car's Yes position

2,0004,178

pays $1 per share if Yes stands

Reversed · resolved No

A wallet that never trades, funded by the account holding the bag, does one job: proposing outcomes. It proposed Yes when his book was empty, then again after he loaded it. On this market: two disputed proposals, two $750 bonds forfeited, both reversed in public.

Allegation 4 · the fleet trades his resolution windows

flying-wheel was seeded the day it was created and bought the other side of his proposal by April.

flying-wheel's first trade ever was a direct fill from car's Safe - 1,732 Yes at 0.46, March 8, 02:36 UTC tx ↗. Of the account's 24 lifetime markets, three are markets the oracle wallet proposed on - including the ceasefire market proposed Yes after its deadline.

UTC	Event	Receipt
Apr 23 02:15:18	Oracle wallet proposes Yes - the deadline had passed; car held 39,343 Yes	tx ↗
Apr 23 02:45:10	flying-wheel starts buying No - 29.9 minutes later	tx ↗
Apr 23 16:36	One transaction settles both sides: car buys 5,223.91 Yes @0.09, flying-wheel buys 5,223.91 No @0.91	tx ↗
May 1 00:32	flying-wheel redeems $142,829.70 - its 47 No buys cost $135,405	tx ↗

The false proposal held a settled question open. During the delay the seeded account bought No from 0.90 down to 0.73 - average 0.948 across 47 fills - and redeemed at $1 when the market finally resolved No on May 1: $7,424 on one market.

Allegation 5 · volume without risk

The same $144K, redeemed and re-bet five times in 71 minutes.

May 9, after "Russia x Ukraine ceasefire by May 31" had resolved: flying-wheel bought Yes at 0.999, redeemed at $1 within one to four minutes, and re-bet the exact proceeds. Five passes booked $1.19M of volume on roughly $144K of capital. A sister market took $144K in one minute.

UTC, May 9	Action	Amount	Receipt
19:05:22	BUY 143,637 Yes @0.999	$143,493.39	tx ↗
19:06:55	REDEEM at $1	$143,637.03	tx ↗
19:08:57	BUY 143,781 Yes @0.999 - the exact redemption proceeds	$143,637.03	tx ↗
19:09:50	REDEEM at $1	$143,780.81	tx ↗

Lifetime, the account shows $2.38M of traded volume against roughly $3.2K of net realized gains. The first pass that evening bought 143,076 Yes at 0.999 and sold the identical size back at 0.999 three minutes later - a round trip with no economic content.

Allegation 6 · the seeded fleet

Eleven PredictFolio-branded profiles live on his money.

Relay logs show $191,266 paid from car's wallets into eleven branded profiles. The largest, flying-wheel, took $141,212 across twelve routes - the first landing March 8, 2026, the same UTC day the profile was created. Book contact with the wider fleet is mixed-direction with no wash signature. flying-wheel is the exception: its first trade ever was a direct fill from the Safe, and five settlements put both wallets inside one transaction.

Profile	Seeded	Routes	Profile created (UTC)
flying-wheel	$141,212	12	Mar 8 2026 - first route same day
b4k9xj2wh2	$30,094	4	Apr 1 2025
dsdfghfdwdesfgdsasdf	$17,960	6	Jul 3 2025
hers	$800	2	Sep 30 2025
Meepie	$495	1	Feb 26 2025
six more profiles	$705	6	2025-2026

First flying-wheel route, Mar 8 2026car's Relay history

Allegation 7 · the money comes back

The Safe's biggest outside funder is the machine itself.

Relay logs show $315,646 arriving in car's Safe from one address - thirty routes, December 2025 to April 2026. That address is not outside money. Its Arbitrum USDC came from the oracle wallet: twelve transfers, $250,056. flying-wheel's funding wallet added $67,794. The money leaves the Safe, passes through the vanity mesh, and re-enters as fresh funding.

Leg	Amount	Path	Receipt
car's Safe → oracle wallet	$1,036,420	55 Relay routes · Sep 2025 - Jun 2026	Relay ↗
oracle wallet → 0x82c1121f… pass-through	$250,056	12 USDC transfers · Arbitrum	tx ↗
0x82c1121f… → car's Safe	$315,646	30 Relay routes · Dec 2025 - Apr 2026	Relay ↗
flying-wheel funding wallet → 0x82c1121f…	$67,794	3 USDC transfers · Arbitrum	address ↗

December 3 shows the loop at speed: the oracle wallet sent the pass-through $1,000 at 15:42 and $28,845 at 15:47; the pass-through relayed both into the Safe within the same minutes. The pass-through is one of three generated addresses ending 6c21 - siblings that only ever transact with the mesh's hub.

Allegation 8 · the plumbing

Vanity-addressed plumbing keeps the pieces from touching in public.

The infrastructure around his accounts runs on generated vanity addresses - four families plus a hub - cycled through Relay, CCTP and an EIP-7702 pass-through. His signing key never transacts on Polygon or BSC; its Ethereum gas arrives from a small wallet the vanity mesh feeds, roughly $2K at a time.

Vanity hub 0xce523a36…Signer's gas funder 0x46C11F0c…Signing key 0x1f64f273…

Allegation 9 · coordination, on the record

Fifteen verified settlements put his Safe inside one transaction with a roster account.

Fifteen order matches put car's Safe inside the same settlement transaction as accounts from the tracked circles, verified fill by fill on-chain. Ten are direct fills - his order against theirs, nobody between. Twice against 123412341234 he bought 1,000-share loser dust at 0.001 in the same market where the cell account bought 0.999 winners at the resolution tail.

Date (UTC)	Counterparty	Mechanism	Market	car's fill	Receipt
Oct 9 2024	heooo	direct fill	Will Speed break the 24h backflip world record?	BUY No 500 @0.998	tx ↗
Dec 16 2024	d1namit	direct fill	US government Bitcoin reserves in 2024?	BUY No 429.9 @0.984	tx ↗
Sep 17 2025	d1namit	direct fill	Will Powell say "Inflation" 50+ times during September press conference?	SELL Yes 2,129.9 @0.888	tx ↗
Sep 28 2025	d1namit	shared matchOrders · 10 fills	Lord Miles completes 40-day water fast in the desert?	BUY Yes 3,000 @0.200	tx ↗
Nov 7 2025	lolxdkek	direct fill	Will Jesus Christ return before GTA VI?	SELL No 9.4 @0.530	tx ↗
Dec 10 2025	d1namit	direct fill	Will Time 2025 Person of the Year be leaked?	BUY Yes 1,000 @0.926	tx ↗
Dec 10 2025	d1namit	shared matchOrders · 10 fills	Will TIME's Person of the Year for 2025 be a woman?	SELL No 220.2 @0.450	tx ↗
Dec 19 2025	d1namit	direct fill	Will DraftKings launch a prediction market in 2025?	BUY Yes 5,000 @0.999	tx ↗
Jan 15 2026	d1namit	shared matchOrders · 4 fills	Will Polymarket mindshare hit 80%?	SELL No 795.4 @0.910	tx ↗
Mar 6 2026	123412341234	shared matchOrders · 7 fills	Will Iran strike Israel on March 4?	BUY Yes 55.6 @0.954	tx ↗
Mar 19 2026	d1namit	shared matchOrders · 101 fills	Netanyahu out by March 31?	SELL No 2,800 @0.979	tx ↗
Mar 20 2026	123412341234	direct fill	Howard Bison vs. Michigan Wolverines	BUY Howard 1,000 @0.001	tx ↗
Mar 20 2026	123412341234	direct fill	Howard Bison vs. Michigan Wolverines	BUY Howard 1,000 @0.001	tx ↗
Mar 30 2026	0xbumblebee	direct fill	US forces enter Iran by April 30?	BUY No 6.8 @0.280	tx ↗
May 7 2026	d1namit	direct fill	MicroStrategy sells any Bitcoin by May 31, 2026?	SELL Yes 2,631.6 @0.163	tx ↗

The normalization check: with 241,363 trades, a $180.8M account crosses everyone eventually. Per trade-pair, car sits below the 200-trader random baseline on every coordination metric - strict signature zero observed against 11.5-24.2 expected. These fifteen are verified contact points, graded candidate.

Seven times the resolution wallet proposed Yes on a market its funder trades. All seven were reversed in public.UMA's DVM reversed every one - one was disputed by the proposer itself

The second operator on this desk - his own bankroll, his own payroll, zero contact: case 09.

car: verifiedBadge + communityMod + creatorPolymarket API, Aug 18 sweep

Case 09 · the second operator

A second operator runs the same playbook.

aenews2 (@aenews) fronts a small public profile - $131K weighted volume, created January 13, 2024 and funded the same day with $100, $1,000, $10,000 and $100,000 from a wallet whose own Polymarket persona, aenews-915, dates to November 2020. Behind it sits a wallet that does both jobs at once: 0xba2cB316… has filed 374 price proposals and 53 disputes on Polymarket's UMA oracles since August 22, 2023 - and it trades, 418 fills and $860,544 notional since November 2024, with $318,725 of it at prices of 0.95 or higher. Eight markets on the record where it did both: held the position, filed the outcome. Its bankroll is his own trading proxy: ten Relay transfers, $500,200, June 3 - July 26, 2026 - two $100 tests, then chunks up to $200,000. Same template as car: public account in front, resolution wallet behind, bridge rail in between.

His oracle wallet drew UMA before his profile existed.

The first UMA disbursement to 0xba2cB316… landed September 8, 2023 - four months before the aenews2 Polymarket profile was created. Distribution wallet 0x774bff0c… pays 451 wallets in recurring batches; aenews2's wallet is its third-most-frequent recipient, 33 disbursements through December 2025, batched through the Disperse utility. The distributor is funded by a Safe holding 1.25 million UMA behind four anonymous signers. The collected UMA sits idle: vault 0xc7927C4c… holds 1,597.64 UMA and has never sent a transaction - a stake that doubles as a DVM voting path if one of his proposals is ever disputed. Whoever runs this desk came from UMA's resolution layer first; the Polymarket persona came later.

Four personas, seven wallets, one hand.

Follow the funding backward from the aenews2 profile and the same operator keeps surfacing, years before the persona existed. Six wallets link directly - first-funding and gas receipts on-chain:

Both wallets hit the same targets and never touch each other.

Polymarket's resolution layer is small. The same few wallets propose and dispute each other - and car's and aenews2's wallets keep landing on the same ones:

August 1, 2026 - "Will Donald Trump publicly insult Tucker Carlson by July 31, 2026": aenews2's wallet killed the first proposal with a dispute at 12:07 UTC; 89 minutes later car's oracle filed the next proposal at 13:35. aenews2's wallet had itself proposed the May-31 iteration of the same market on June 1.

The negative space: 30 disputes on record against car's proposals since September 2025, from 21 different wallets - two of them his own. aenews2's wallet is not among them. None of the disputes filed by car's oracle or his second wallet ever touched aenews2's 374 proposals either. Two of the most active players on one small desk work the same markets and the same targets and never touch each other. Direct money transfers between the two core clusters: none found, on any chain. The one shared counterparty on record is the pf-meep cash-out mesh - $28,198.89 from aenews2's proxy, $300 from car's Safe - a service wallet used by at least seven unrelated Polymarket accounts, not a link between the operators.

It bets on the markets it whistles.

The hidden wallet files binding outcome proposals to Polymarket's oracle - and it holds positions in the markets it proposes on. Eight markets on the record where 0xba2cB316… both traded and filed the outcome. In six of the eight, it held the side it asserted:

A proposal on this oracle is what the market pays unless someone else posts a counter-bond. In the six matching cases the wallet accumulated first and whistled minutes to hours later. On the Yeshiva market it put $10,400 into Yes at 0.585-0.67, filed its YES proposal nine minutes into the session, then kept buying up to 0.96 as the price converged on its own assertion - $12,886 paid, $20,379 redemption value. In two of the eight it held the opposite side. Either way, the referee is in the game it calls.

Case 10 · Jurisdiction and platform rules

Declared locations against the platform's own rules.

Polymarket's own rulebook, every location datum the actors published themselves, and the US-app invite a community lead offered to anyone, anywhere.

What the actors say about where they are, graded by source.

Asked where he is, he answered: "Russia".

April 27, 2026. @0xBumblebee posts two photos of heavy snow from his window: "April 27, are you ok?". @_kate_lv is in the thread within the hour - "lmao, where are you?". His reply is one word. That same day a record late-April snowstorm hit Moscow. Kate is on the thread; her circle shares the payout rail with the badge crew.

Apr 27, 2026, captured: snow from his window, Kate asks where, one word back: "Russia" - the day of Moscow's record snowstorm.

Her own camera roll puts her in Russia.

Three images from her own X account, July 1-2, 2026. Local copies archived; a deletion changes nothing.

Her own photos and words place her in Kazan, Russia.

On July 6 at 07:39 UTC - 10:39 in the morning in Kazan - she posted "start your day like a princes" with two photos. The first is a hill viewpoint over the Kazanka river; the round building below is the Kazan Family Center "Chasha", one of the city's recognized landmarks on the Kazanka embankment.

The shirt she wears is printed "HELLO I NEED ONLY USDT IN MY LIFE". The second photo is the marketing material: a bagel.win slip under the name "wincy".

The community-chat evidence starts at her Telegram bio, which links one channel: "Polymarket Sports". That channel's footer links its private "Polymarket Sports Chat" - a live group, 103 members when verified on August 11 - where she posts as owner. Her own messages:

No $POLY token date had been publicly announced. William LeGate is the Polymarket Growth/Marketing Lead documented stripping this circle's badges in case 04. The claim is hers, in her own group, on the record.

Polymarket's official geoblock documentation draws the map this way:

• Fully blocked: only OFAC-sanctioned jurisdictions - Iran, Syria, Cuba, North Korea, and the occupied Ukrainian regions of Crimea, Donetsk, and Luhansk.
• Close-only: Russia, Belarus, the United States, the United Kingdom and about 35 others. Ukraine proper is unrestricted.
• Sign-up: attest you are not a US person and not located in a restricted jurisdiction; a KYC flow can demand proof of residence within 14 days on pain of close-only mode.
• The operator: the site's own footer states "Polymarket US is operated by QCX LLC d/b/a Polymarket US, a CFTC-regulated Designated Contract Market." In 2022 the CFTC settled with Polymarket's operator for offering event contracts on an unregistered facility - a $1.4 million penalty under Press Release 8478-22.

The name-origin indicator in the evidence base is heooo's Farcaster handle "heorhii" - the Ukrainian transliteration of George. Every quoted post is in English; timezone histograms fit UTC+1…+3 waking hours - and automation.

The name "Daria Guseva" is first-party verifiable from her own Telegram - t.me/s/gusik4ever, live, verified twice; the older "Darya" spelling came from insider.pm's Cyrillic republication ("Дарья Гусева").