A step-by-step blockchain investigation into Polymarket insider trading, how the funds were traced, and why Binance now holds the key to identifying the insider.

There is a special kind of confidence that comes from knowing something the rest of the market doesn't. The kind that makes a person place two precise bets — 8,012.802569 USDC.e and 10,002.982077 USDC.e — on a prediction market in the hour before a significant event, then wake up the next morning with a Ethereum wallet holding 253,376.655946 USDT.

Someone did exactly that on April 7, 2026.

We know this not because they told us, but because blockchains are, by design, extraordinarily bad at keeping secrets. Every transaction is permanent, public, and queryable by anyone with enough curiosity and a working internet connection. What follows is a full account of how we traced these bets from the Polymarket smart contract all the way back through a Caribbean shell company's no-KYC swap service — and then directly into two Binance hot wallets that funded the intermediary 1,782 days ago. Binance has KYC. The game is over.

Let's be precise from the start.

The bets placed:

(8,012.802569 + 10,002.982077 = 18,015.784646)

The Ethereum wallet at time of investigation:

Everything started with a single transaction on Polygon:

0x8ea20fd7d7b491990d29140018022daf96c39446788ef94702c43caba809cefb

On the surface, it looks unremarkable: a Gnosis Safe executing a depositErc20 call, moving USDC.e into a contract called the RelayDepositor. Happens thousands of times a day on Polymarket.

What made this one stand out was the timing — the deposit was made in the hour before a significant market-moving event, from a Gnosis Safe deployed that same day. Fresh wallet. Precise bet sizing. Suspiciously comfortable.

The decoded RelayErc20Deposit event from this transaction:

That deposit ID is the permanent fingerprint linking this on-chain transaction to a specific Polymarket exchange account. It sits in the Polygon blockchain forever, in plaintext, waiting to be decoded by anyone with a hex editor and too much free time.

Before we trace the money, it helps to understand the plumbing.

Polymarket doesn't run on vibes. It runs on a layered smart contract architecture on Polygon that looks like this:

Your Ethereum Wallet (EOA)
        ↓
  Gnosis Safe (Polygon)       ← Your on-chain Polymarket account
        ↓
  RelayDepositor Contract     ← The bridge to Polymarket's off-chain order book
        ↓
  Polymarket CLOB             ← Where bets are matched

The RelayDepositor (0x4cD00e387622C35bDDB9b4c962C136462338BC31) is the key piece. When you deposit into Polymarket, your Gnosis Safe calls depositErc20(), which transfers USDC.e to the RelayDepositor and emits a RelayErc20Deposit event. That event's from field identifies the Safe — and through the Safe's SafeSetup creation event, we can find the Ethereum EOA that owns it.

The bets themselves (8,012.802569 USDC.e and 10,002.982077 USDC.e) are placed on Polymarket's off-chain Central Limit Order Book after funding. The on-chain deposit is the funding mechanism — the trail into the system.

The Gnosis Safe that made the deposit — 0x68558D37cAfd9E6612AB32863F55cCDd798f655a — was deployed on April 7, 2026 by Polymarket's Safe Proxy Factory (0xaacFeEa03eb1561C4e67d661e40682Bd20E3541b). Its single owner is the EOA 0x7b6b6b07B04F5E49E127552056b795C3dB7EF286, and it required just one signature to execute transactions (threshold: 1).

Create wallet. Fund it. Place bets. The Safe existed for one purpose, on one day.

This is not the behaviour of a casual bettor with an existing Polymarket account. This is someone who created a fresh, isolated wallet specifically for this trade.

The Safe's owner — 0x7b6b6b07B04F5E49E127552056b795C3dB7EF286 — is where things get interesting.

On Polygon: nothing. Zero POL, no meaningful history.

On Ethereum: 253,376.655946 USDT, worth $253,358.67 at $0.9999/USDT.

Nearly a quarter of a million dollars in Tether, sitting in a holding wallet that has made almost no on-chain noise. This is the wallet of someone who moves money deliberately and quietly — not a trader, not a DeFi user, just a holding address for a very specific purpose.

And crucially: this wallet was funded approximately 58 days before the trades, by address 0x4f87e7800132ad0f6650d45bcd587134a1d71839. Pre-loading a wallet two months before a trade is not spontaneous behaviour. This was planned.

0x4f87e7800132ad0f6650d45bcd587134a1d71839 — the address that funded the insider's Ethereum wallet — was itself funded by:

0xcDd37Ada79F589c15bD4f8fD2083dc88E34A2af2

This address carries a label on Etherscan: SideShift: Hot Wallet.

SideShift.ai is a cryptocurrency swap service built around one core feature: no account required. No email. No phone number. No government ID. You send crypto in, you receive different crypto out, and SideShift asks absolutely no questions about who you are.

The company behind it — Paradigm Ltd, registered in Saint Kitts and Nevis — is operated by founder Andreas Brekken. The platform has processed over $3 billion in lifetime volume and uses automated risk management to flag suspicious activity.

The automated risk management did not flag someone converting funds into USDT and routing it through an intermediary wallet toward a Polymarket insider trade. We are sure SideShift wishes it had, now that this article exists.

[Unknown origin — invisible on-chain]
            ↓
   SideShift internal processing
            ↓
  0xcDd37Ada... (SideShift Hot Wallet — Ethereum)
            ↓
  0x4f87e780... (Intermediary wallet)
            ↓
  0x7b6b6b07... (Insider EOA — 253,376.655946 USDT)

The input side of the swap — what was sent into SideShift, and from where — is not visible on-chain. That information lives only inside SideShift's own records. Fortunately for investigators, SideShift does retain those records and states it cooperates with law enforcement upon receipt of valid legal process.

As it turns out, the SideShift layer is now irrelevant anyway.

??? (Unknown origin — pre-SideShift)
        ↓
  SideShift.ai swap [no KYC]
        ↓
  0xcDd37Ada79F589c15bD4f8fD2083dc88E34A2af2
  (SideShift Hot Wallet — Ethereum)
        ↓  ~58 days before trades
  0x4f87e7800132ad0f6650d45bcd587134a1d71839
  (Intermediary wallet — Ethereum)
        ↓
  0x7b6b6b07B04F5E49E127552056b795C3dB7EF286
  (Insider EOA — 253,376.655946 USDT / $253,358.67 on Ethereum)
        ↓  USDC.e bridged to Polygon
  0x68558D37cAfd9E6612AB32863F55cCDd798f655a
  (Polymarket Gnosis Safe — created April 7, 2026)
        ↓  Two bets placed:
        │  8,012.802569 USDC.e
        │  10,002.982077 USDC.e
        │  Total: 18,015.784646 USDC.e
        ↓
  0x4cD00e387622C35bDDB9b4c962C136462338BC31
  (Polymarket RelayDepositor)
        ↓
  Polymarket CLOB
  Deposit ID: 0x1BB050242ED260E8F54501355EF38F49740B5574...

The intermediary wallet was thought to be the outstanding unknown. It is not.

This is the part where the insider's careful construction falls apart.

The intermediary wallet — 0x4f87e7800132ad0f6650d45bcd587134a1d71839 — received two separate USDC deposits from Binance hot wallets, 1,782 days ago. Not from another anonymous address. Not from a mixer. From Binance — the world's largest cryptocurrency exchange, which requires full KYC verification from every account holder and retains those records indefinitely.

The two Binance addresses:

Both confirmed against our database of 52 known exchange hot wallet addresses across 16 exchanges.

Running the KYC-link analysis against the complete funding chain:

🟡 NO-KYC SWAP SERVICE
   Address:  0xcdd37ada79f589c15bd4f8fd2083dc88e34a2af2
   Service:  SideShift.ai
   ⚠  Obfuscation layer — no direct KYC available.

🔴 KYC EXCHANGE MATCH
   Address:  0xbe0eb53f46cd790cd13851d5eff43d12404d33e8
   Exchange: Binance — Hot Wallet 1
   Funded ~1,782 days ago
   ★ Binance holds KYC records that can identify the insider.

🔴 KYC EXCHANGE MATCH
   Address:  0xf977814e90da44bfa03b6295a0616a897441acec
   Exchange: Binance — Hot Wallet 2
   Funded ~1,782 days ago
   ★ Binance holds KYC records that can identify the insider.

✅ 2 KYC EXCHANGE LINKS FOUND — identities obtainable

1,782 days ago, someone used their Binance account to send USDC to a wallet. That wallet sat quiet for years. Then 58 days before April 7, 2026, it was used as part of a funding chain — through SideShift, through an intermediary, into the insider's Ethereum holding address — that ultimately financed two precisely sized Polymarket bets totalling 18,015.784646 USDC.e.

Binance knows exactly who made those withdrawals. They have a name. They have a government-issued ID. They have a selfie. They have an email address, a phone number, and every IP address ever used to log into that account.

The SideShift obfuscation was real. The fresh Gnosis Safe was real. The precise bet sizing was real. All of it was completely undone by two Binance withdrawals made nearly five years before the crime.

All of the above was derived from public blockchain data using open-source tools built for this investigation.

We built a set of Node.js scripts that:

1. Decode RelayErc20Deposit events directly from Polygon transaction receipts via JSON-RPC — no API keys required.

2. Trace the Gnosis Safe back to its Ethereum EOA owner via SafeSetup event logs — a three-hop process: flagged tx → RelayErc20Deposit.from → Safe creation tx → SafeSetup.owners[0] → EOA.

3. Trace USDC flows by querying ERC-20 Transfer event logs on the USDC.e token contract, filtered by address.

4. Cross-reference against 52 known exchange hot wallet addresses across 16 exchanges — Binance, Coinbase, Kraken, OKX, Bybit, KuCoin, Huobi, Gate.io, Gemini, Bitstamp, Crypto.com, MEXC, Deribit, Bitfinex, BitMEX, and Robinhood — plus known no-KYC services including SideShift.ai, ChangeNow, and FixedFloat.

5. Walk the funded_by chain recursively, flagging KYC exchanges (identity obtainable via legal process) and no-KYC services (obfuscation layers).

All data is permanently, irrevocably public on the Polygon and Ethereum blockchains. None of this required privileged access to any system.

# Deep trace the flagged transaction
node scripts/trace-tx.js 0x8ea20fd7d7b491990d29140018022daf96c39446788ef94702c43caba809cefb

# Track all deposits from the Safe
node scripts/track-funds.js

# Walk the funding chain and flag KYC exchanges
node scripts/kyc-link.js

# Full exchange cross-reference
node scripts/check-exchange.js

With two confirmed Binance KYC links in the chain, the path to an identity is now short and direct.

Binance holds KYC records for the account that withdrew USDC to 0x4f87e7800132ad0f6650d45bcd587134a1d71839 from:

• 0xBE0eB53F46cd790Cd13851d5EFF43D12404d33E8 (Binance Hot Wallet 1)

• 0xF977814e90dA44bFA03b6295A0616a897441aceC (Binance Hot Wallet 2)

These withdrawals occurred approximately 1,782 days ago. Binance retains KYC records indefinitely and is legally required to hold them for a minimum of five years. These records exist.

Binance legal contact:

• Law enforcement portal: https://app.kodexglobal.com/binance/signup

• US law enforcement email: lert@binance.us

A valid subpoena produces: full name, government-issued ID, residential address, email, phone, and complete IP login history.

Polymarket is CFTC-regulated. Filing a Form TCR at https://forms.cftc.gov/Forms/TCR is free and gives the CFTC a self-contained case file. CFTC Enforcement Director David Miller has confirmed: "There's a myth that insider trading law doesn't apply to prediction markets. That is wrong."

Include in your filing:

• Flagged tx: 0x8ea20fd7d7b491990d29140018022daf96c39446788ef94702c43caba809cefb

• Bets: 8,012.802569 + 10,002.982077 = 18,015.784646 USDC.e total

• Deposit ID: 0x1BB050242ED260E8F54501355EF38F49740B5574AC5473033D8AE1A99B19F8C7

• Binance hot wallets: 0xBE0eB53F46cd... and 0xF977814e90dA...

The deposit ID 0x1BB050242ED260E8F54501355EF38F49740B5574AC5473033D8AE1A99B19F8C7 maps to a specific Polymarket user account. Polymarket can identify and suspend it. Contact Polymarket's compliance team with this ID.

The SideShift layer is now secondary, but a request to legal@sideshift.ai for the input side of the swap that produced output to 0xcDd37Ada... provides additional corroboration and may reveal the original source of funds.

The person behind these bets was careful. They used a fresh Gnosis Safe created the same day as the trade. They routed funds through SideShift, a no-KYC swap service registered in the Caribbean. They pre-loaded their wallet 58 days in advance to create temporal distance between funding and trading.

They forgot about something they did 1,782 days ago.

Somewhere around late 2021, they opened a Binance account, completed KYC, and withdrew USDC to a wallet they almost certainly stopped thinking about. They hadn't stopped thinking about it enough. That wallet sat quietly in the chain, four hops back, holding a permanent and irrevocable link between a verified Binance identity and two precise Polymarket bets totalling 18,015.784646 USDC.e.

The SideShift layer was real. The fresh Safe was real. All of it was undone by a Binance withdrawal that predates the entire scheme by years.

Blockchains don't forget. Binance's compliance database doesn't either.

A subpoena to lert@binance.us is now the shortest path from blockchain data to a name on a government ID.

🔴 = Confirmed KYC link. Binance holds identity records for the account behind these withdrawals.

On-chain analysis conducted April 8, 2026. All data sourced from public Polygon and Ethereum blockchain records. All wallet addresses are public information by virtue of being on a public blockchain. Nothing in this article constitutes legal advice — but if you're the person behind 0x7b6b6b07, you should probably call Binance compliance before they call you.

insider-EOA: https://etherscan.io/address/0x7b6b6b07b04f5e49e127552056b795c3db7ef286

repo : https://gitlab.com/tradingtoolcrypto/insider-trading