The Polymarket bets the CFTC is investigating, traced on-chain

01 · The last morningA bet on a pardon, minutes before the handover

On Joe Biden's last morning as president, in January 2025, one Polymarket account kept buying the same thing. Each share it bought would pay a dollar if Biden pardoned his brother Jim before he left office, and nothing if he did not.

The market did not think he would. The price fell through the morning, and in the last hour it was down to about four cents, the crowd's way of saying one chance in twenty-five. The account bought hardest as it fell. Then, about twenty minutes before Donald Trump was sworn in, Biden pardoned his brother and four other relatives. The account had spent about $22,000 on shares that were now worth almost $200,000.

Polymarket is a site where people bet on how real events will turn out. Elections, football, wars. You buy shares in the answer you think is right. A right answer pays a dollar a share and a wrong one pays nothing, so the price of a share is the crowd's own guess at the odds. The site settles all of it on Polygon, a public blockchain, so every bet and every payout is on the record.

Pardon bets like that one are the subject of one of two Polymarket investigations the Commodity Futures Trading Commission opened this year. The CFTC is the US regulator for futures and for prediction markets. This month WIRED reported, from records it obtained, that the agency's chairman approved an investigation order into bets on Biden's pardons in early May, and a second into "Iran event contracts" at the end of May. Each came after a news report. NPR wrote about a trader who made about $300,000 on the pardons. 60 Minutes aired a segment on nine accounts that made $2.4 million on the war with Iran and won 98% of the time.

Our blockchain data lake holds Polygon's token transfers back to 2020, so we rebuilt both cases from the chain, down to each bet and each withdrawal. We found the two accounts behind the pardon bets, whose addresses NPR's report did not give. Most of what was reported about the Iran accounts holds up, with two caveats, set out below. And money was still leaving some of those accounts months after the story aired.

Nothing here identifies a person, and we make no claim about how anybody learned anything. An investigation order is not a charge.

02 · Two ordersWhat the CFTC is looking at

An investigation order lets the CFTC's enforcement staff demand records, issue subpoenas and take testimony under oath. WIRED found at least three this year, all approved by the chairman, Michael Selig. The third covers bets on Google's Year in Search rankings and sits outside this piece. The orders leave out which trades are under suspicion, but they name the subject, and on Polymarket that narrows it to a handful of markets.

03 · Nine accountsThe Iran bets, recounted

Start with the bigger case. Bubblemaps, a blockchain analytics firm, named nine Polymarket accounts that it says are linked, and 60 Minutes put them on air. They bet on the war almost from the day they were opened, and on the moments that decided it: when the strikes would start, and when a ceasefire would come.

Every Polymarket account is a wallet on Polygon. We found each account's wallet and rebuilt its history from the chain alone, every share it received and every dollar that moved in or out. Then we checked the result against what the chain holds for each wallet today. It matched to the cent.

Bubblemaps' numbers hold up. Its total is within a fraction of a percent of ours, and each account lands close. The accounts were opened in two groups. Five were opened about two weeks before the first strikes. The other four were opened in March, after the war had started.

04 · The recordHow to read a 98% win rate

Here a bet means one account's position in one market, however many times it bought or sold. The nine accounts have 101 bets on markets that have settled, and 86 of them made money.

The reported 98% is the other way of counting, by money. The losing bets were small, so they barely dent the total. Keep only the bigger bets on the war, and there are about as many as the "more than 80 bets" that was reported. Even those won less than 98% of the time by count.

A few of those losses say something. Four were bets that the US would strike on earlier dates in February, dates that came and went. The accounts had the day wrong before they had it right.

05 · The strike dateMost of the money was a bet on a date

Nearly three-quarters of the profit came from markets that asked whether the US, or Israel, would strike Iran on or by a certain date. One of them, a US strike by the end of February, made more than half on its own.

Five accounts held that bet, the five opened in February. Over the next two weeks they bought just over two million Yes shares, at an average of 15 cents.

The buying came in two bursts. The first came right after the accounts were opened. The second came in the last two days before the strikes, when they spent more than in the whole first burst, almost a third of it at under 10 cents a share. Their last purchase went through several hours before the strikes began, just after midnight UTC. The market settled Yes that morning.

They sold about a third of those shares before the strikes, and still made $1.28 million on the market.

The later bets were of a different kind. Once the war had started, the accounts put large sums on things that would not happen, such as a ceasefire by the end of March or US troops in Iran by then. On those two markets they paid 87 and 77 cents a share on average, so each share could make only 13 to 23 cents. Their long shots after the strikes mostly lost money. The one that paid came on the eve of the ceasefire, when Merlin11111 paid 28 cents a share on a ceasefire by the end of April. The market settled Yes early the next morning, and the bet made about $47,000.

06 · One network?What ties the nine together

Bubblemaps calls the nine one network. The chain shows how alike they behave. Five were opened within three days of each other. All nine brought money in the same way, from wallets on Ethereum and Solana through Relay, a bridge that moves money between chains. They bet on the same few markets in the same windows, and they cashed out the same way.

Tying them together by money is harder. We found no direct transfer between any two of them. What we found are shared exits. Five of the accounts sent money, directly or one step later, into three Binance deposit addresses: flowjj and trevors4 into one, flowjj and whopperlover into a second, gaba4 and fuego66 into a third. A Binance deposit address belongs to one Binance account, so money from two of the nine ended up in the same place, three times over.

That falls short of proof that one person runs them. Each of those three addresses has taken money from dozens of other senders since early 2024. They could belong to desks that turn crypto into cash for many clients. We could not confirm the one-network claim from money flows alone. Binance knows who holds those accounts.

07 · The exitsWhere the money went

The nine put in about $3.1 million and took out about $5.1 million. All of it left through Relay, nearly all of it to Ethereum. We followed each withdrawal for up to two steps, until it reached an exchange or a coin-swap service. All but about 2% of the money did.

Most of it went to Binance and Bybit. The rest went to ChangeNOW and ChangeHero, services that swap one coin for another, and a little to HTX. About $87,000 went to wallets we could not label. The three biggest cash-outs went first to private wallets, which split the money into smaller pieces and sent each piece to a different Binance deposit address. One account, trevors4, sent its last withdrawals through three new wallets that each passed the money on within about half a minute and were never used again.

The three private wallets that split the biggest cash-outs draw attention of their own. Someone keeps filling their histories with fake USDC transfers to and from lookalike addresses, the scam known as address poisoning. If you trace these wallets yourself, follow the real USDC contract, or you will count millions of dollars of fake transfers.

08 · After 60 MinutesThe money kept moving

Two days after 60 Minutes aired the story, alealeg began emptying its account. It was done within a fortnight. A second account followed in June and kept withdrawing into August.

Most of the money taken out after the broadcast left in June or later, after the end of May, when WIRED reports the CFTC approved its Iran order. One account never withdrew at all: propescia still holds about $508,000 on Polymarket, as of 22 September. None of the nine has placed a bet since early July.

09 · The pardon betsFinding the two accounts

Back to Biden's last morning. NPR's report, built on Bubblemaps' work, left the accounts unnamed but gave enough numbers to find them: two accounts, a perfect record on Biden pardon markets, and one bet on Jim Biden, placed at long odds, that returned almost $200,000.

We rebuilt every purchase in the Jim Biden market from the raw token transfers on Polygon, and read each market's question from the chain itself, where Polymarket publishes it when a market opens. One wallet stood out at once. Its Jim Biden stake matches NPR's figures to the share.

The wallet is 0xd9be…1d98, d9be for short. Every withdrawal it made went to one address, 0x0a65…8d7e, which the labeling service MetaSleuth marks as a Kraken deposit address. On Polygon, every dollar that address has ever received came from one of two wallets. The second is 0xa416…025e, a416 for short. Later that day the two took turns paying into it, minutes apart. Both had been funded from Kraken in the first place. That is the pair NPR described. Here are all three addresses in full.

The record NPR described holds. The pair bet on the five names it listed and won all five: Hunter Biden in the autumn of 2024, weeks before his pardon, then Cheney, Schiff, Kinzinger and Jim Biden in January. Their only other pardon bet was small and lost. They put $774 and $141 on Trump pardoning himself in his first hundred days, then sold at a loss the day after he took office. One figure differs. NPR put their stake on the four January names at about $64,000, and we count about $50,000.

Every share they bought in those January markets was bought before the news moved the price. The morning pardons moved Cheney, Schiff and Kinzinger a little after seven in Washington. Jim Biden's price jumped 23 minutes before noon, and the pair's last purchases came before that, the final one more than half an hour earlier. The only trades after a jump were sales, when d9be took some Schiff profit at nearly a dollar a share.

They were not the only winners that morning. More than five thousand wallets traded those four markets, and about a dozen made more than $50,000 on them. d9be made the most, and a416 came fifth.

d9be sold its last shares and made its last withdrawal the next morning, and has not traded since. a416 kept trading into the spring of 2026, and some of that trading was on the war with Iran. It put $75,704 into 23 markets on the war and came out $11,379 down. Its biggest bet was that the Iranian regime would fall by the end of June, and it lost. Its withdrawals still went to the same Kraken address, by then through Relay to Ethereum. On Ethereum that address also took $16,705 in USDT from a third wallet, a busy one that pays many other addresses.

Nothing on the chain ties a416 to the nine Iran accounts. They share no wallets and no exits. They met once, when the order book matched a $2,000 purchase by a416 with a sale by fuego66.

10 · What the chain cannot sayWhat this shows, and what it does not

The chain shows who bet what, when, at what price, and where the money went. It does not show who held the keys, or what anybody knew. A well-timed bet can come from a hunch or from somewhere else, and trading records cannot tell the two apart. Plenty of people bought cheap pardon shares that morning. A few bought a lot of them.

What the chain does show is where each trail ends. For the pardon pair it ends at one Kraken deposit address. For the Iran accounts almost all of it ends at Binance, Bybit and a few smaller exchanges and swap services. Those companies know who owns the accounts, and an investigation order gives the CFTC the power to ask them.

Earlier this month we looked at a related case, a set of accounts that beat the odds on KPMG's audit clients. In August we asked how much of Polymarket is bots. The method is the same one: read the whole record, then check it against the chain.

11 · MethodHow we did it

You can run the same queries through our Polymarket API, or trace any of the wallets above with Bitquery MCP.