Live

· case study · investigations

Case study — the Iran-war funding cluster

A walkthrough of how CrowdIntel identified a coordinated wallet cluster active on Middle East conflict markets. Authoring template — replace investigation details before publication.

By CrowdIntel

In the spring of 2026, a group of Polymarket wallets started taking aggressive positions on Middle East conflict markets. Individually each wallet looked like a reasonably confident political trader. Together, once you traced the funding, they turned out to be one operator running ten accounts. This is how CrowdIntel found them.

Ten proxy wallets, one common funder at the center. Three concentric rings reflect the staggering of trade entries across the cluster — the innermost ring entered first.

The opening trade

The first thing that caught our scorer was a set of positions on [market slug] — a prediction on whether [specific escalation event] would happen in a defined window. The market was trading at around [price]. Over about 48 hours, a handful of wallets opened large positions on the same side.

will-iran-close-strait-of-hormuz-in-2026

polymarket · view market →

Example live market embed — replace the slug with the actual market the cluster traded before publishing. The market image, volume, and whale count are pulled live at render time.

Individually, none of these would have tripped a single-wallet investigation. The sizes weren't absurd by Polymarket standards. The win rates on the wallets were decent but not exceptional. What did stand out: the wallets were recent, the bets were coordinated in time, and the sizes were similar enough to suggest a shared bankroll.

[Placeholder] Iran-war funding cluster

read case →
Win rate
p-value

Replace the static card with <LiveInvestigation id={REAL_ID} /> once the investigation is published. Live embed fetches wallet count, win rate, and p-value at render time.

Pulling the funding thread

CrowdIntel's funding-graph analysis traced each of the ten wallets back to a common non-exchange address. That address itself had no trading history — it existed only to fund these ten wallets. The pattern:

  1. A single source wallet acquires USDC (via a CEX withdrawal, off-chain swap, or OTC deal).
  2. The source wallet distributes USDC to ten fresh proxy wallets within a narrow window.
  3. Each proxy wallet then trades.

This is the classic funding-cluster signature. Detail on how it shows up in the graph lives in The anatomy of a funding cluster.

What the wallets did

Over the weeks that followed, the cluster traded [N] markets in the Middle East conflict category. Their pattern:

  • Same direction on most markets. On the markets where our data has them taking positions, [approximate %] of their volume was on one side.
  • Entries clustered in time. New positions opened within tight windows across multiple wallets — a human operator executing a plan, not ten independent traders converging.
  • Sizing consistent with a shared bankroll. Individual trades in the $[range]–$[range] range, per wallet.

When the markets resolved

As markets in the category resolved, the cluster's aggregate win rate sat at [placeholder — insert real figure] across [N] resolved bets, with combined realized PnL of [placeholder]. The category's base rate for "yes" resolution in the same window was [X%]; the cluster's edge above the base rate was [Y] percentage points.

Whale 0x0000...0000

view full dossier →

Live dossier unavailable.

Before publishing: replace with one of the cluster's real wallet addresses. The dossier card auto-fetches trade count, volume, win rate, and PnL at render time.

Statistical significance: the p-value against a no-skill null hypothesis was [placeholder]. We treat p ≤ 0.1 as an internal floor to open a case; this one cleared it comfortably.

Why we published

When the numbers cleared our publication bar — sample size, excess win rate, positive PnL, low p-value, and on-chain coordination evidence — the cluster moved from "flagged candidate" to "published investigation." The public investigation page at /investigations/0-iran-cluster (placeholder ID) lists:

  • All ten wallets with links to their dossiers
  • The funder address with a full transaction trail
  • The timeline of every trade the cluster placed
  • The markets they targeted, ranked by volume

What this doesn't prove

CrowdIntel proves statistical anomalies. It does not prove:

  • Who operates the cluster. The person behind the funder is unknown. Could be a political-risk desk at a hedge fund, a well-informed journalist, a government staffer, or someone with a good Twitter feed.
  • That they had non-public information. Excellent public information + a clear analytical framework can also produce the pattern. What the data rules out is pure luck; what it doesn't rule out is earned skill.
  • That any legal line was crossed. Polymarket's legal status varies by jurisdiction; insider-trading law doesn't translate cleanly to prediction markets. CrowdIntel publishes evidence, not accusations.

What it does prove

That someone, or some group, has a real edge on Middle East conflict markets — and they spent meaningful operational effort to disguise it. That's useful information for anyone on the other side of those trades.

How to use this research

If you're trading a Middle East conflict market:

  • Check whether any of the cluster's wallets are currently holding positions on the market you're looking at — go to the market page and see the top-holders list.
  • If the cluster is on the side you're planning to take, that's a weak confirmation. If they're on the other side, size down.
  • If the cluster has already exited, the information advantage may have been consumed; reassess independently.

More from the blog

Live
Beta
···v0.1.0