Polymarket Trader Cluster Pockets $6.4M in World Cup Winnings
Their Biggest Position? Spain to Win the Tournament
1. Executive summary
During the 2026 World Cup, a set of Polymarket accounts traded the tournament at whale scale and, when it ended, moved their balances off the platform within days of the final. Public reporting in July 2026 first flagged a group of these accounts as a probable single operator. We did not discover the cluster. What follows is an independent verification and extension of it, built entirely from public on-chain data and Polymarket’s own APIs.
The findings:
The cluster is eight accounts: six opened between 5 June and 13 July for the tournament, plus two older, higher-volume accounts folded into the same exit. The eighth member,
copa1970, surfaced only when every inbound leg into the consolidation wallet was reconciled.Net profit across the eight is $6,409,589 on $82,777,299 of volume. Two of the eight accounts are net losers over their lifetime; one lost $795,933.
All eight consolidated into a single Ethereum wallet,
0xc14e6dc9afa2850a86f8a17f5874944470ccc0b1, which took in $14,254,855.47 across the tournament window and now holds $0.47.The funding loop closes. The same consolidation wallet sent $500,000 to one account’s deposit address on 28 June 2026, the exact transaction that created that account. One wallet both capitalizes the accounts and harvests their proceeds.
The consolidation evidence is probabilistic, not cryptographic. Every leg matched on amount and timing within a 7 to 21 second window, at transfer sizes that were unique on the platform in their window by a wide margin. We explain in Section 10 why the settlement rail in use here does not permit a deterministic proof, and we state the case accordingly.
The operator’s identity is unknown. The consolidation wallet has fanned out to eleven unattributed wallets, and following further would require resources beyond chain analysis. What the case does establish is common control across the eight accounts, and it doubles as a working demonstration of which tracing techniques still function on Polymarket’s current funding architecture and which no longer do.
2. Provenance and scope
The cluster was surfaced publicly before our analysis; versions of the claim circulated widely in July 2026, naming seven accounts. This report is not a rebuttal of that reporting and does not relitigate it; it is our own reconstruction from primary sources. Where our figures differ from circulated ones, Section 7 notes the differences briefly. The bulk of the report concerns what the chain shows and how the cluster membership was established.
Everything here derives from public sources: Polymarket’s data APIs for account PnL and volume, Etherscan v2 across Ethereum and Polygon for on-chain flows, and direct measurement of Polymarket’s withdrawal infrastructure. No privileged or platform-internal data was used, which also means the analysis inherits the limits of public data. Those limits are flagged where they matter.
3. What the chain shows
3.1 The cluster
Net: $6,409,589 on $82,777,299 of volume.
Note the shape. Two older accounts opened in February and March, carrying enormous volume ($40.7M combined) and losing money. Six accounts opened between 5 June and 13 July, carrying less volume and making all the profit. copa1970 surfaced during the exit-rail reconciliation described in Section 5.3. The name is not subtle: copa is Spanish for cup, and 1970 is the most celebrated World Cup ever played.
3.2 The Consolidation Wallet
0xc14e6dc9afa2850a86f8a17f5874944470ccc0b1 (Ethereum, externally owned account)
Every large inbound leg matched a Polygon-side withdrawal from one of the eight accounts, arriving 7 to 21 seconds later, with fee drift of 0.02% to 0.05%.
3.3 The funding loop
This is the strongest single piece of evidence in the case.
On 28 June 2026 at 17:16 UTC, the consolidation wallet sent $500,000 to 0xbbfa1a7cdae85c619561302aabff97f11ee1b4f5. That address is asparagus2012’s dedicated Polymarket deposit address, and that transaction is the funding event that created the account. Twenty-two days later the same account sent $3,346,472.51 back through the withdrawal rail into the same hub.
One wallet capitalizing an account and later collecting its winnings is very difficult to reconcile with independent traders who happen to use the same infrastructure. It is the kind of edge the rest of the correlational evidence cannot manufacture on its own, because it is a direct transfer on a single chain, visible in full.
3.4 Downstream
The consolidation wallet drained to eleven addresses between 30 June and 26 July: $2.90M, $2.83M, $2.50M, $2.50M, $1.30M, $600K, $500K, a further $500K recycled back into a Polymarket deposit address, $300K, $300K, and $25K. None are attributed. Following further is possible but each hop multiplies the work, and the realistic endgame is an exchange deposit, where attribution requires legal process rather than analysis.
4. What they traded
The chain shows the money moving. Polymarket’s own activity feed shows what the money did in between. We reconstructed the complete trading history of all eight accounts, just under 80,000 trades across roughly 570 distinct markets, and computed realized profit per market from every trade and every redemption. The per-account totals reconcile with Polymarket’s official PnL figures to within about 4%; the residual is maker rebates, trading rewards, and positions still open on the two surviving accounts.
The picture is not eight variations of one strategy. It is one book, run through two kinds of vehicle, and most of the money came from a single conviction.
4.1 Three-fifths of the profit was one position: Spain to win the World Cup
Across three accounts, the operator accumulated 5,099,330 shares of “Will Spain win the 2026 FIFA World Cup?” for $1,165,516, an average entry of 22.9 cents. Spain won. Every share paid out at $1.00, for a profit of $3,933,814, which is 61% of the cluster’s entire net.
The entries, in order:
Three details in that table carry the story. First, asparagus2012 began buying Spain the same day the consolidation wallet’s $500,000 arrived and the account was created; the account existed to buy Spain at 11 cents. Second, copa1970, the account whose name is Spanish for “cup,” deployed essentially its whole stake into this one market three days after its own creation and touched almost nothing else: six markets lifetime, one of them a $227 cricket flutter. Third, the ladder keeps climbing: the operator kept adding as the price tripled, including over half a million dollars at 59 cents once Spain had reached the final. That is not scalping a mispricing; that is conviction held from 11 cents to settlement.
None of the three accounts sold a single share into the rally. Every share was held to expiry and redeemed at $1.00. The redemptions landed within hours of the final: asparagus2012 and copa1970 redeemed 60 seconds apart, at 01:47 and 01:48 UTC on 20 July, one more small tell of a single hand on the controls.
4.2 The semifinal harvest
The single most profitable match was the France vs. Spain semifinal on 14 July. Four of the accounts traded it, and together they netted $1,990,078 on about $1.75M staked, the cluster’s best day by far:
asparagus2012 put $518,660 on Under 2.5 goals and made +$521,775.
therighteousdog, one of the two “losing” accounts, took Spain to advance for +$408,952, its largest win ever recorded, on a World Cup market rather than its usual club-football fare.
stubblyballs took Spain to advance (+$263,055), the Under (+$101,000), and No on both teams scoring (+$89,999).
The daily “Will Spain win on 2026-07-14?” market added +$251,103 across two accounts.
The other semifinal, England vs. Argentina on 15 July, is the honesty check: the cluster lost $26,268 net on it. The corner bets won, and they are the same “Over/Under 8.5 Total Corners” market flagged in the behavioral fingerprint of Section 5.1: asparagus2012 and hampertime held the Under together and collected about $133,000 combined. hampertime’s bet against England won another $137,121. But stubblyballs bet the match to be low-scoring three different ways, No on both teams to score (−$217,057), Under 2.5 goals (−$57,691), and 0-0 exact score (−$35,984), and the goals came anyway. Right on corners, wrong on goals, net zero. Sharp, not psychic.
4.3 The shape of the whole book
Realized profit by market type, all eight accounts combined:
Read the first and fifth rows against each other. The futures row made $3.3M on $1.8M of turnover; it is the Spain position minus about $450,000 the operator lost backing Brazil and England to win the tournament, a useful reminder that the conviction was specific, not general. The daily match-winner row is the opposite: $17.1M of churn for $287K net, a grinder’s line, thousands of trades at short odds for a sub-2% margin. That churn is what made the accounts look like whales by volume; the futures are what made the operation worth running.
The style is consistent everywhere it shows: large positions at short prices, Unders on goals, No on longshots, favorites to advance. athelstan’s book is the purest example, +$559K betting against Türkiye on 19 June and +$410K against Czechia on 18 June, taking the “No” side of single-match markets in six-figure size.
And the book was not clairvoyant. Individual losses ran large: $461,923 backing England on 17 June (athelstan), $344,129 on Brazil futures across two accounts, $194,220 by copa1970 betting against France in the quarterfinal it then reversed at the semifinal. The edge, wherever it came from, was a few points per bet at scale, not foreknowledge.
4.4 Two kinds of account, one operator
The trading history also explains the cluster’s odd shape, the thing our first pass got wrong. The six accounts opened in June and July are tournament specialists: 3 to 42 markets each, World Cup almost exclusively, all profitable. The two older accounts are something else entirely. therighteousdog traded 272 markets and $12.5M of volume, NoLyon 180 markets and $8.0M, and their books from February through May are wall-to-wall European club football: Bundesliga, La Liga, Serie A, Premier League, daily match markets and totals, in the same short-odds style. Both ground out net losses doing it.
So the operator was not a World Cup tourist. This is someone who had been trading European football at six-figure clip sizes for months, losing at club level, and then concentrated everything on the tournament and won. The World Cup accounts were opened fresh for the occasion; the club accounts were folded into the same exit when it ended. Any membership screen keyed on “World Cup only” or “profitable only” excludes the two accounts that reveal the most about who this trader actually is.
5. How the cluster was established
No single technique carried the case. Three did, in sequence. Each is stated with its actual evidentiary weight, because they are not equal.
5.1 Behavioral fingerprint (suggestive, not sufficient)
The six 2026 accounts share a funding ritual precise enough to be a signature: a tiny test deposit of $77 to $100, then exactly two tranches of roughly $250,000 landing two to twelve minutes apart, totalling about $500,000 per account, over the same bridge route, repeated across six weeks. They traded World Cup markets almost exclusively, including obscure derivatives that most users never touch. Two of them independently concentrated in “England vs. Argentina Over/Under 8.5 Total Corners.”
This is strong circumstantial evidence. It is not proof, and on its own it produced a wrong answer in this very case. See 5.3.
5.2 Cross-chain amount-and-time correlation (the decisive technique)
Each Polygon-side withdrawal was matched to a destination-chain arrival by amount within a tight time window. Ten matched on the first pass, thirteen after reconciliation.
Why this works is arithmetic, not cleverness. We measured the full distribution of withdrawals leaving the platform over 24 hours:
A pooled rail hides a transaction in proportion to how many other transactions look like it. At $47 the crowd is thousands deep and the privacy is real. At $3,346,472.51 there is no crowd. On an ordinary day the platform does not process a single withdrawal above half a million dollars. The anonymity set for that transfer was one, not just in its hour but plausibly in its month.
The pooling is genuinely protective for the typical user and provides essentially nothing to a whale. Any operator moving seven figures through this rail is legible to anyone willing to look on both sides of the bridge.
One caveat on the measurement itself: the distribution is a single 24-hour sample taken in late July, after the tournament ended. Withdrawal volume during the World Cup settlement window was plausibly heavier at the top end. That would widen the candidate set for the largest legs somewhat, but not to a degree that changes the conclusion; even a tenfold increase in seven-figure withdrawals leaves the candidate set in single digits within a 60-second window.
5.3 Exit-rail reconciliation (the technique that corrected the record)
Our first pass matched ten withdrawals to five accounts and rejected therighteousdog and NoLyon, on the grounds that both had negative lifetime PnL, both were funded months earlier by a different route, and neither fit the funding fingerprint from 5.1.
That was wrong. The error surfaced only because we went back and reconciled every inbound leg into the consolidation wallet rather than stopping at the ones already explained. Thirteen legs in, ten accounted for, three unexplained. Tracing those three back across the bridge resolved them to therighteousdog ($1,105,700), NoLyon ($800,343.13), and an account we had never heard of, copa1970 ($936,000).
Three lessons generalize:
Reconcile the total, not the matches. The unexplained residual was the entire finding. A pass that only confirms its own hypothesis will confirm it and stop.
The exit rail beats the funding rail as a membership test. Funding patterns vary because an operator’s accounts are established at different times by different means. The exit is where everything converges, because the whole point of the operation is to end up in one place.
Losing accounts are still the operator’s accounts. Any screen that filters on profitability will systematically miss the losers, and in this case the losers carried nearly half the cluster’s total volume. If the question is an operator’s market footprint rather than their profit, excluding them is the larger error.
6. What this does and does not establish
Established: eight accounts under common control, to a high but explicitly probabilistic standard; a consolidation wallet that both funds and harvests; the profit and volume figures as reconstructed here; the timing of the exit around the final.
Not established: who the operator is. Whether the operation broke any rule. Whether any information advantage was involved. The destination of the $14.25M after the first hop out. Whether the cluster is complete; the reconciliation closed every inbound leg to this consolidation, but an operator running additional accounts that exit to a different hub would be invisible to this method.
We want to be precise on the rules question, because it is easy to overreach here.
Multi-accounting is not prohibited on Polymarket’s global platform. The integrity rules prohibit wash trading, self-dealing, fictitious transactions, spoofing, front-running, and manipulation. They contain no prohibition on holding multiple accounts. There is also no KYC on the global platform, so there is no identity substrate on which common control could be detected in the first place.
The 2024 precedent is instructive. When Polymarket confirmed that four accounts belonged to the French trader known as Théo, it found no manipulation and secured only a forward-looking commitment not to open further accounts without notice. That remedy only makes sense if the prior conduct was not a breach.
Polymarket US is a different matter entirely. As a CFTC-designated contract market, its rulebook imposes an affirmative disclosure duty and a common-control aggregation prohibition:
“This prohibition applies across all accounts under common ownership, control, or direction, whether Orders are entered directly, via API, or through an FCM Participant or Broker Participant.”
That rule is enforceable because every US account is KYC’d through an intermediary. The same conduct sits on opposite sides of the line depending on which entity the trader used.
So the accurate framing is: this operator ran eight accounts on a platform that does not forbid it, on a venue with no identity layer, and would have been in clear breach had they done the same thing on the regulated US exchange twenty feet to the left.
7. What the public account got wrong
The version of this cluster that circulated publicly asserted that seven accounts were “funded from the same initial wallet” and that profits were “consolidated in a single unlabeled wallet,” citing an address for each. The central conclusion holds up. The two cited addresses do not, and the mechanism is worth two paragraphs because it is the most common pitfall in prediction-market open-source work, one we have fallen into ourselves.
The cited “same initial wallet”, 0xf70da97812cb96acdf810712aa562db8dfa3dbef, is the Relay bridge solver: a liquidity wallet that pays out on the destination chain when anyone bridges into Polygon. It appears as the funder for 1,726 distinct recipients in our registry alone. Two accounts receiving money from it are no more connected than two people who received a package from the same courier.
The cited “single unlabeled wallet”, 0x4cd00e387622c35bddb9b4c962c136462338bc31, is Polymarket’s shared withdrawal aggregator. We measured it processing 542 withdrawals from 442 distinct wallets in one hour. It is not a personal wallet; it is a funnel every withdrawing user passes through.
Both assertions were substantively true anyway. There is a single wallet that funded the accounts, and a single wallet the profits consolidated into, and they are the same wallet. It is just not either address the public claim identified; the actual wallet sits one chain boundary away, on Ethereum rather than Polygon. Also true in the public account: the core one-operator claim and the World Cup concentration. Overstated: the $7.4M profit figure, which counted two net-losing accounts as winners, and the seven-account count, which missed one.
8. Context: this is a category, not an anomaly
Multi-account operation on Polymarket is well documented and the estimates are large.
The 2024 election whale. Four accounts confirmed by Polymarket, later expanded by Chainalysis to nine and then eleven wallets, roughly $80M deployed and $78.7M to $85M in profit. Identification came from funding patterns: every account traced back to Kraken deposits in $500,000 and $1,000,000 tranches at consistent times of day. Real-world identification was not on-chain at all; Polymarket engaged a corporate investigations firm.
Wash trading and Sybil farming. A Columbia study covering roughly three years found about 25% of Polymarket volume consistent with wash trading, peaking near 60% of weekly volume in December 2024, with one cluster of 43,000 wallets. Chaos Labs put the 2024 election market near one third. Solidus Labs found about 15% over a later window and noted that under 1% of wallets captured about half of all profits in key political markets. These are different windows and methods and should not be averaged.
Informed trading. Mitts and Ofir (Columbia and Haifa) screened over 93,000 markets and flagged 210,718 wallet-market pairs with a 69.9% win rate and roughly $143M in aggregate anomalous profit, explicitly framed as a lower bound and explicitly not synonymous with illegal insider trading.
Enforcement exists but is thin and new. In April 2026 the CFTC brought its first insider-trading action involving an event contract, against a US Army master sergeant who traded Polymarket contracts on Venezuela outcomes using classified planning information, with parallel SDNY criminal charges. Polymarket referred the activity. Note what made that case work: a motivated platform and a defendant reachable by US process. Neither condition holds for an anonymous wallet funded through a bridge from an offshore exchange.
And nobody is obliged to watch. Surveillance on the global platform is a commercial contract, terminable at will and answerable to no regulator. The integrity-vendor ecosystem that matured through 2026 is sports-shaped, because leagues had the commercial leverage to demand it. There is no equivalent counterparty for elections, geopolitics, or monetary policy, which is exactly where the anomalous profit concentrates. The DNC has no integrity desk.
9. An operational note: the payout wallet is under attack
Worth including because it is visible, unusual, and it has a practical lesson.
Of 964 token transfers touching the payout wallet, only 653 were canonical USDC. The remainder are an address-poisoning campaign:
Counterfeit ERC-20 contracts whose symbol renders as “USDC,” several using Cyrillic homoglyphs so the string is visually identical but byte-different.
Zero-value and one-cent dust from lookalike addresses that clone the first and last four hex characters of the payout wallet’s real fan-out destinations. The real
0x8d946bf7…be23has a shadow at0x8d947f17…be23.
The poisoner is watching the consolidation wallet’s genuine outflows in real time and manufacturing near-identical decoys, betting the operator eventually copies an address from their own transaction history and pastes it into a transfer. Wallets and explorers truncate the middle of addresses, which is the whole basis of the attack.
The academic baseline (USENIX Security 2025) counts 270 million such attempts against 17 million victims with at least $83.8M in confirmed losses, and over 1,100 counterfeit contracts impersonating USDC alone.
The lesson for anyone doing this work: filter to canonical token contract addresses and require non-zero value, or your tooling will report flows that never happened. Token names and symbols are not unique and are not verified on-chain. Only the contract address is authoritative.
The same technique contaminated our desk research. Text circulating in search results purporting to quote Polymarket’s terms on multiple accounts traces to polymakrets.com and polymarkets.co.il, lookalike domains that are not Polymarket. In this domain the counterfeits target the analyst as readily as the trader.
10. Verification notes
Every figure in this report was pulled directly from primary sources using BETINT.AI. Wallet PnL and volume come from Polymarket’s own APIs; all on-chain figures from Etherscan v2 across Ethereum and Polygon; the withdrawal distribution from a direct measurement of the aggregator.
One correction we made during the work and are carrying openly. We initially described the large settlement legs as Circle CCTP. They are Circle Gateway. The distinction is not cosmetic. A CCTP transfer commits its destination recipient on the source chain at burn time, making the hop cryptographically provable. Gateway mints against a unified multi-chain balance, so the link is correlational. Both appear identically in a block explorer as a transfer from the zero address, and only the minter contract in the transaction logs distinguishes them.
This matters for how strongly the case should be stated. Had these been CCTP transfers, consolidation would be provable by event data alone. Because they are Gateway, the evidence is amount-and-time correlation across thirteen legs, each within a 7 to 21 second window, at amounts that are unique in their window by a wide margin, plus a funding loop that closes. That is a very strong probabilistic case. It is not a cryptographic one, and this report does not describe it as such.
Appendix: addresses
