# Someone Placed $18,015.78 in Polymarket Before a Major Event and Won! * — So We Followed the Money* By [TetracOfficial](https://paragraph.com/@tetrac) · 2026-04-08 #polymarkets, #insider, #insider-trading, #binance --- _A step-by-step blockchain investigation into Polymarket insider trading, how the funds were traced, and why Binance now holds the key to identifying the insider._ * * * There is a special kind of confidence that comes from knowing something the rest of the market doesn't. The kind that makes a person place two precise bets — 8,012.802569 USDC.e and 10,002.982077 USDC.e — on a prediction market in the hour before a significant event, then wake up the next morning with a Ethereum wallet holding **253,376.655946 USDT**. Someone did exactly that on April 7, 2026. We know this not because they told us, but because blockchains are, by design, extraordinarily bad at keeping secrets. Every transaction is permanent, public, and queryable by anyone with enough curiosity and a working internet connection. What follows is a full account of how we traced these bets from the Polymarket smart contract all the way back through a Caribbean shell company's no-KYC swap service — and then directly into two Binance hot wallets that funded the intermediary 1,782 days ago. Binance has KYC. The game is over. * * * **The Numbers** --------------- Let's be precise from the start. **The bets placed:** Bet Amount Token Position 1 8,012.802569 USDC.e Position 2 10,002.982077 USDC.e **Total wagered** **18,015.784646** **USDC.e** _(8,012.802569 + 10,002.982077 = 18,015.784646)_ **The Ethereum wallet at time of investigation:** Asset Amount Price USD Value USDT (Tether) 253,376.655946 $0.9999 **$253,358.67** * * * **The Flagged Transaction** --------------------------- Everything started with a single transaction on Polygon: `0x8ea20fd7d7b491990d29140018022daf96c39446788ef94702c43caba809cefb` On the surface, it looks unremarkable: a Gnosis Safe executing a `depositErc20` call, moving USDC.e into a contract called the RelayDepositor. Happens thousands of times a day on Polymarket. What made this one stand out was the timing — the deposit was made in the hour before a significant market-moving event, from a Gnosis Safe deployed _that same day_. Fresh wallet. Precise bet sizing. Suspiciously comfortable. The decoded `RelayErc20Deposit` event from this transaction: Field Value **from (Safe)** `0x68558D37cAfd9E6612AB32863F55cCDd798f655a` **token** USDC.e (`0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174`) **deposit ID** `0x1BB050242ED260E8F54501355EF38F49740B5574AC5473033D8AE1A99B19F8C7` That `deposit ID` is the permanent fingerprint linking this on-chain transaction to a specific Polymarket exchange account. It sits in the Polygon blockchain forever, in plaintext, waiting to be decoded by anyone with a hex editor and too much free time. * * * **How Polymarket Actually Works (The Part Most Articles Skip)** --------------------------------------------------------------- Before we trace the money, it helps to understand the plumbing. Polymarket doesn't run on vibes. It runs on a layered smart contract architecture on Polygon that looks like this: Your Ethereum Wallet (EOA) ↓ Gnosis Safe (Polygon) ← Your on-chain Polymarket account ↓ RelayDepositor Contract ← The bridge to Polymarket's off-chain order book ↓ Polymarket CLOB ← Where bets are matched The **RelayDepositor** (`0x4cD00e387622C35bDDB9b4c962C136462338BC31`) is the key piece. When you deposit into Polymarket, your Gnosis Safe calls `depositErc20()`, which transfers USDC.e to the RelayDepositor and emits a `RelayErc20Deposit` event. That event's `from` field identifies the Safe — and through the Safe's `SafeSetup` creation event, we can find the Ethereum EOA that owns it. The bets themselves (8,012.802569 USDC.e and 10,002.982077 USDC.e) are placed on Polymarket's off-chain Central Limit Order Book after funding. The on-chain deposit is the funding mechanism — the trail into the system. * * * **The Safe Was Brand New** -------------------------- The Gnosis Safe that made the deposit — `0x68558D37cAfd9E6612AB32863F55cCDd798f655a` — was deployed on April 7, 2026 by Polymarket's Safe Proxy Factory (`0xaacFeEa03eb1561C4e67d661e40682Bd20E3541b`). Its single owner is the EOA `0x7b6b6b07B04F5E49E127552056b795C3dB7EF286`, and it required just one signature to execute transactions (threshold: 1). Create wallet. Fund it. Place bets. The Safe existed for one purpose, on one day. This is not the behaviour of a casual bettor with an existing Polymarket account. This is someone who created a fresh, isolated wallet specifically for this trade. * * * **Following the Money: The EOA** -------------------------------- The Safe's owner — `0x7b6b6b07B04F5E49E127552056b795C3dB7EF286` — is where things get interesting. On Polygon: nothing. Zero POL, no meaningful history. On Ethereum: **253,376.655946 USDT, worth $253,358.67 at $0.9999/USDT.** Nearly a quarter of a million dollars in Tether, sitting in a holding wallet that has made almost no on-chain noise. This is the wallet of someone who moves money deliberately and quietly — not a trader, not a DeFi user, just a holding address for a very specific purpose. And crucially: this wallet was **funded approximately 58 days before the trades**, by address `0x4f87e7800132ad0f6650d45bcd587134a1d71839`. Pre-loading a wallet two months before a trade is not spontaneous behaviour. This was planned. * * * **The Obfuscation Layer: SideShift.ai** --------------------------------------- `0x4f87e7800132ad0f6650d45bcd587134a1d71839` — the address that funded the insider's Ethereum wallet — was itself funded by: `0xcDd37Ada79F589c15bD4f8fD2083dc88E34A2af2` This address carries a label on Etherscan: **SideShift: Hot Wallet**. [SideShift.ai](https://sideshift.ai/) is a cryptocurrency swap service built around one core feature: **no account required**. No email. No phone number. No government ID. You send crypto in, you receive different crypto out, and SideShift asks absolutely no questions about who you are. The company behind it — **Paradigm Ltd**, registered in Saint Kitts and Nevis — is operated by founder **Andreas Brekken**. The platform has processed over $3 billion in lifetime volume and uses automated risk management to flag suspicious activity. The automated risk management did not flag someone converting funds into USDT and routing it through an intermediary wallet toward a Polymarket insider trade. We are sure SideShift wishes it had, now that this article exists. ### **What SideShift Does to a Money Trail** [Unknown origin — invisible on-chain] ↓ SideShift internal processing ↓ 0xcDd37Ada... (SideShift Hot Wallet — Ethereum) ↓ 0x4f87e780... (Intermediary wallet) ↓ 0x7b6b6b07... (Insider EOA — 253,376.655946 USDT) The input side of the swap — what was sent _into_ SideShift, and from where — is not visible on-chain. That information lives only inside SideShift's own records. Fortunately for investigators, SideShift does retain those records and states it cooperates with law enforcement upon receipt of valid legal process. As it turns out, the SideShift layer is now irrelevant anyway. * * * **The Full Funding Chain** -------------------------- ??? (Unknown origin — pre-SideShift) ↓ SideShift.ai swap [no KYC] ↓ 0xcDd37Ada79F589c15bD4f8fD2083dc88E34A2af2 (SideShift Hot Wallet — Ethereum) ↓ ~58 days before trades 0x4f87e7800132ad0f6650d45bcd587134a1d71839 (Intermediary wallet — Ethereum) ↓ 0x7b6b6b07B04F5E49E127552056b795C3dB7EF286 (Insider EOA — 253,376.655946 USDT / $253,358.67 on Ethereum) ↓ USDC.e bridged to Polygon 0x68558D37cAfd9E6612AB32863F55cCDd798f655a (Polymarket Gnosis Safe — created April 7, 2026) ↓ Two bets placed: │ 8,012.802569 USDC.e │ 10,002.982077 USDC.e │ Total: 18,015.784646 USDC.e ↓ 0x4cD00e387622C35bDDB9b4c962C136462338BC31 (Polymarket RelayDepositor) ↓ Polymarket CLOB Deposit ID: 0x1BB050242ED260E8F54501355EF38F49740B5574... The intermediary wallet was thought to be the outstanding unknown. It is not. * * * **The Intermediary Was Funded by Binance** ------------------------------------------ This is the part where the insider's careful construction falls apart. The intermediary wallet — `0x4f87e7800132ad0f6650d45bcd587134a1d71839` — received **two separate USDC deposits from Binance hot wallets, 1,782 days ago**. Not from another anonymous address. Not from a mixer. From Binance — the world's largest cryptocurrency exchange, which requires full KYC verification from every account holder and retains those records indefinitely. The two Binance addresses: Address Label `0xBE0eB53F46cd790Cd13851d5EFF43D12404d33E8` Binance: Hot Wallet 1 `0xF977814e90dA44bFA03b6295A0616a897441aceC` Binance: Hot Wallet 2 Both confirmed against our database of 52 known exchange hot wallet addresses across 16 exchanges. Running the KYC-link analysis against the complete funding chain: 🟡 NO-KYC SWAP SERVICE Address: 0xcdd37ada79f589c15bd4f8fd2083dc88e34a2af2 Service: SideShift.ai ⚠ Obfuscation layer — no direct KYC available. 🔴 KYC EXCHANGE MATCH Address: 0xbe0eb53f46cd790cd13851d5eff43d12404d33e8 Exchange: Binance — Hot Wallet 1 Funded ~1,782 days ago ★ Binance holds KYC records that can identify the insider. 🔴 KYC EXCHANGE MATCH Address: 0xf977814e90da44bfa03b6295a0616a897441acec Exchange: Binance — Hot Wallet 2 Funded ~1,782 days ago ★ Binance holds KYC records that can identify the insider. ✅ 2 KYC EXCHANGE LINKS FOUND — identities obtainable ### **What This Means** 1,782 days ago, someone used their Binance account to send USDC to a wallet. That wallet sat quiet for years. Then 58 days before April 7, 2026, it was used as part of a funding chain — through SideShift, through an intermediary, into the insider's Ethereum holding address — that ultimately financed two precisely sized Polymarket bets totalling 18,015.784646 USDC.e. Binance knows exactly who made those withdrawals. They have a name. They have a government-issued ID. They have a selfie. They have an email address, a phone number, and every IP address ever used to log into that account. The SideShift obfuscation was real. The fresh Gnosis Safe was real. The precise bet sizing was real. All of it was completely undone by two Binance withdrawals made nearly five years before the crime. * * * **The Methodology: How We Did This** ------------------------------------ All of the above was derived from public blockchain data using open-source tools built for this investigation. We built a set of Node.js scripts that: 1. **Decode** `RelayErc20Deposit` **events** directly from Polygon transaction receipts via JSON-RPC — no API keys required. 2. **Trace the Gnosis Safe** back to its Ethereum EOA owner via `SafeSetup` event logs — a three-hop process: flagged tx → RelayErc20Deposit.from → Safe creation tx → SafeSetup.owners\[0\] → EOA. 3. **Trace USDC flows** by querying ERC-20 `Transfer` event logs on the USDC.e token contract, filtered by address. 4. **Cross-reference against 52 known exchange hot wallet addresses** across 16 exchanges — Binance, Coinbase, Kraken, OKX, Bybit, KuCoin, Huobi, Gate.io, Gemini, Bitstamp, Crypto.com, MEXC, Deribit, Bitfinex, BitMEX, and Robinhood — plus known no-KYC services including SideShift.ai, ChangeNow, and FixedFloat. 5. **Walk the** `funded_by` **chain recursively**, flagging KYC exchanges (identity obtainable via legal process) and no-KYC services (obfuscation layers). All data is permanently, irrevocably public on the Polygon and Ethereum blockchains. None of this required privileged access to any system. # Deep trace the flagged transaction node scripts/trace-tx.js 0x8ea20fd7d7b491990d29140018022daf96c39446788ef94702c43caba809cefb # Track all deposits from the Safe node scripts/track-funds.js # Walk the funding chain and flag KYC exchanges node scripts/kyc-link.js # Full exchange cross-reference node scripts/check-exchange.js * * * **How to Proceed: Legal Action** -------------------------------- With two confirmed Binance KYC links in the chain, the path to an identity is now short and direct. ### **Step 1: Subpoena Binance** Binance holds KYC records for the account that withdrew USDC to `0x4f87e7800132ad0f6650d45bcd587134a1d71839` from: * `0xBE0eB53F46cd790Cd13851d5EFF43D12404d33E8` (Binance Hot Wallet 1) * `0xF977814e90dA44bFA03b6295A0616a897441aceC` (Binance Hot Wallet 2) These withdrawals occurred approximately 1,782 days ago. Binance retains KYC records indefinitely and is legally required to hold them for a minimum of five years. These records exist. **Binance legal contact:** * Law enforcement portal: [https://app.kodexglobal.com/binance/signup](https://app.kodexglobal.com/binance/signup) * US law enforcement email: `lert@binance.us` A valid subpoena produces: full name, government-issued ID, residential address, email, phone, and complete IP login history. ### **Step 2: File a CFTC Complaint** Polymarket is CFTC-regulated. Filing a Form TCR at [https://forms.cftc.gov/Forms/TCR](https://forms.cftc.gov/Forms/TCR) is free and gives the CFTC a self-contained case file. CFTC Enforcement Director David Miller has confirmed: _"There's a myth that insider trading law doesn't apply to prediction markets. That is wrong."_ ![](https://storage.googleapis.com/papyrus_images/00655d91d05df33b28a9e2450a3839273d57e7c59f4a848f23609ca9bc48bdf1.png) Include in your filing: * Flagged tx: `0x8ea20fd7d7b491990d29140018022daf96c39446788ef94702c43caba809cefb` * Bets: 8,012.802569 + 10,002.982077 = **18,015.784646 USDC.e** total * Deposit ID: `0x1BB050242ED260E8F54501355EF38F49740B5574AC5473033D8AE1A99B19F8C7` * Binance hot wallets: `0xBE0eB53F46cd...` and `0xF977814e90dA...` ### **Step 3: Polymarket's Own Records** The deposit ID `0x1BB050242ED260E8F54501355EF38F49740B5574AC5473033D8AE1A99B19F8C7` maps to a specific Polymarket user account. Polymarket can identify and suspend it. Contact Polymarket's compliance team with this ID. ### **Step 4: SideShift.ai (Secondary)** The SideShift layer is now secondary, but a request to `legal@sideshift.ai` for the input side of the swap that produced output to `0xcDd37Ada...` provides additional corroboration and may reveal the original source of funds. * * * **The Uncomfortable Lesson** ---------------------------- The person behind these bets was careful. They used a fresh Gnosis Safe created the same day as the trade. They routed funds through SideShift, a no-KYC swap service registered in the Caribbean. They pre-loaded their wallet 58 days in advance to create temporal distance between funding and trading. They forgot about something they did 1,782 days ago. Somewhere around late 2021, they opened a Binance account, completed KYC, and withdrew USDC to a wallet they almost certainly stopped thinking about. They hadn't stopped thinking about it enough. That wallet sat quietly in the chain, four hops back, holding a permanent and irrevocable link between a verified Binance identity and two precise Polymarket bets totalling 18,015.784646 USDC.e. The SideShift layer was real. The fresh Safe was real. All of it was undone by a Binance withdrawal that predates the entire scheme by years. Blockchains don't forget. Binance's compliance database doesn't either. A subpoena to `lert@binance.us` is now the shortest path from blockchain data to a name on a government ID. * * * **Key Addresses Summary** ------------------------- Role Chain Address Flagged transaction Polygon `0x8ea20fd7d7b491990d29140018022daf96c39446788ef94702c43caba809cefb` Polymarket Gnosis Safe Polygon `0x68558D37cAfd9E6612AB32863F55cCDd798f655a` Insider EOA Ethereum `0x7b6b6b07B04F5E49E127552056b795C3dB7EF286` Intermediary wallet Ethereum `0x4f87e7800132ad0f6650d45bcd587134a1d71839` SideShift Hot Wallet Ethereum `0xcDd37Ada79F589c15bD4f8fD2083dc88E34A2af2` ![](https://cdn.jsdelivr.net/npm/emoji-datasource-apple/img/apple/64/1f534.png) **Binance Hot Wallet 1** **Ethereum** `0xBE0eB53F46cd790Cd13851d5EFF43D12404d33E8` ![](https://cdn.jsdelivr.net/npm/emoji-datasource-apple/img/apple/64/1f534.png) **Binance Hot Wallet 2** **Ethereum** `0xF977814e90dA44bFA03b6295A0616a897441aceC` Polymarket RelayDepositor Polygon `0x4cD00e387622C35bDDB9b4c962C136462338BC31` Polymarket Deposit ID — `0x1BB050242ED260E8F54501355EF38F49740B5574AC5473033D8AE1A99B19F8C7` ![](https://cdn.jsdelivr.net/npm/emoji-datasource-apple/img/apple/64/1f534.png) = **Confirmed KYC link. Binance holds identity records for the account behind these withdrawals.** * * * **Financial Summary** --------------------- Item Figure Bet 1 8,012.802569 USDC.e Bet 2 10,002.982077 USDC.e **Total wagered** **18,015.784646 USDC.e** Insider ETH wallet holdings 253,376.655946 USDT USDT price $0.9999 **USD value of holdings** **$253,358.67** * * * _On-chain analysis conducted April 8, 2026. All data sourced from public Polygon and Ethereum blockchain records. All wallet addresses are public information by virtue of being on a public blockchain. Nothing in this article constitutes legal advice — but if you're the person behind_ `0x7b6b6b07`_, you should probably call Binance compliance before they call you._ insider-EOA: [https://etherscan.io/address/0x7b6b6b07b04f5e49e127552056b795c3db7ef286](https://etherscan.io/address/0x7b6b6b07b04f5e49e127552056b795c3db7ef286) _repo :_ [_https://gitlab.com/tradingtoolcrypto/insider-trading_](https://gitlab.com/tradingtoolcrypto/insider-trading) --- *Originally published on [TetracOfficial](https://paragraph.com/@tetrac/insider-trading-on-polymarkets)*