On-chain tracking of Polymarket's Khamenei market insider: 521 addresses precisely lurking, with a few entities targeting with precision

Author: Frank, PANews

In the early hours of February 28, 2026, the geopolitical landscape of the world experienced a震动, as the US-Iran conflict reignited. This black swan event, which changed the geopolitical pattern, triggered intense chain reactions in the physical world and also caused a chaotic capital vortex in the digital realm.

On the decentralized prediction market Polymarket, a contract titled “Will Khamenei step down as Iran’s Supreme Leader before February 28?” attracted a total trading volume of $81.63 million. As the news of the physical world’s death was gradually confirmed, the settlement of this massive smart contract faced severe paralysis and controversy. Both Yes proposals were rejected twice, and the market was forced into the final review stage by the UMA oracle. This dispute once again sparked debate about the judgment standards of prediction markets, and multiple addresses were exposed, suspected of insider trading, reaping profits of over a million dollars.

PANews conducted in-depth tracking and multi-dimensional analysis of the on-chain transaction data of this market. In this betting event, it was found that 521 suspicious profit-making addresses were building positions wildly during specific vacuum periods, with 62 addresses only betting once on the Iran situation across the entire platform. Some wallets earned thousands of times returns with just $300.

Beyond the firelines, debates raged, and some were making huge profits.

Deadly Time Difference Black Hole and the $81.6 Million Settlement Deadlock

To understand the behind-the-scenes mysteries of the data, it’s essential to clarify the fatal contradictions in the rules of this event.

According to the official rules document of the Polymarket market, the condition for Yes settlement is that Khamenei resigns, is detained, loses his position, or is prevented from performing his duties.

After analysis, PANews found that the main reasons for the two disputes over this contract are as follows:

1. Dispute over incorrect timing:

The first controversy concerns a serious misalignment of timelines. The deadline set by the smart contract is 11:59 PM Eastern Time on February 28. The time when U.S. President Trump explicitly announced Khamenei’s death on social media was 6:12 PM that afternoon, well within the deadline. However, Iran’s official response, for stability reasons, initially denied the news, and only after midnight on March 1, beyond the deadline, did they officially release the obituary via national TV. This led to disputes between Yes and No sides over whether the event occurred within the deadline.

2. Dispute over semantic interpretation:

Besides the timing dispute, there is also controversy caused by vague contract interpretation. The rules state that the market settles as Yes if Khamenei resigns, is detained, loses his position, or is prevented from performing his duties. Perhaps to avoid legal pressure, the rules deliberately omit words like “death” or “assassination,” creating a textual compromise that harbors risks. The No camp argues that since the contract explicitly excludes the word “death,” it does not automatically equate death with resignation unless the formal transfer of power process is initiated.

Faced with massive capital inflows, Polymarket’s official made a rare centralized intervention, quickly adding a vague statement on the page indicating that the market might remain open until consensus is reached. This move was immediately met with fierce criticism from the community, seen as undermining the core principle of the immutability of smart contracts.

Currently, the fate of this market has been handed over to the underlying UMA decentralized oracle for final review. If the final result is judged as NO, it will set a record for the largest prediction market misjudgment.

521 Ghost Accounts: The “Prophets” with 100% Win Rate and Vacuum Period Positioning

Beyond the controversy, a group of insider addresses once again quietly began their layout.

By capturing all on-chain transaction data from Polymarket, PANews set up eight suspicious scoring criteria for all profit-making addresses, including early buy-in of winning sides, trading only in the winning direction, precise sniping, concentrated trading times, large holdings until settlement, high return on investment, very short active periods, and large absolute profits.

Systematic screening revealed that 521 addresses exhibited highly suspicious trading behaviors. Further analysis showed that 62 addresses had no other participation records across the entire Polymarket platform, only trading on Iran-related markets, with a 100% focus on Khamenei. Additionally, 95 addresses’ Iran market trades accounted for over half of their activity.

Combining multiple abnormal trading conditions, PANews found that the top 15 addresses alone earned a total profit of $900,000 from this market.

From the timeline, these position-building behaviors show a terrifying level of premonition.

The first abnormal window was from January 14 to 17, early in the market’s creation. During this period, a large number of highly suspicious addresses bought Yes shares at just $0.03 to $0.05, seemingly preparing for the upcoming upheaval two months later. Notably, the second abnormal window was on February 27-28, just hours before the settlement date and the release of explosive news. Dozens of “one-time wallets” that existed for less than a day or two flooded in, executing crude buy-and-redeem operations. Some even completed all their transactions within minutes in the same block.

From $300 to $40,000: On-Chain Data Reconstructs the Whale’s Harvest Path

Summarizing the data only sketches the outline of this puzzle. When we zoom in, the on-chain operations of these whales and “prophets” become even more naked.

PANews selected a representative address with a suspicious score of 130 out of 130: 0x88c4919d. It participated in only 10 markets across the platform, all related to Iran. This address completed all fifteen transactions in the Khamenei market within just an hour and a half, only buying Yes. Interestingly, its biggest profit did not come from this controversial market but from the “Will the US attack Iran before the end of March?” market, where it made $266,000. This pattern indicates it is not an ordinary retail investor but a highly professional institution focused on Iranian political intelligence.

Another typical “one-time wallet” example is 0x37545ab7, which opened on February 27, with only two transactions on the platform. It bought Yes for just $51, then two days later redeemed all for $3,911, with a return of 7,569%. The actions—opening, entering, withdrawing, disappearing—are clean and swift, resembling a premeditated targeted harvest.

The second-place profit earner, 0x2e29fc8a, reaped a total profit of $241,000. It only engaged in two relevant markets during its entire platform lifetime, starting with $6,202 and earning over $100,000 in just two days. However, it also suffered a $40,000 loss in the earlier Khamenei market in January, confirming that even intelligence-driven players are not always victorious.

A Systematic Hunt Led by a Few Entities

Furthermore, after cross-referencing the number of markets, direction consistency, and time overlap, PANews found that many of these large-volume trading accounts are likely controlled by just a few major players.

Among these over 500 suspicious sources, at least three highly interconnected address clusters can be clearly identified.

For example, one highly active cluster includes four addresses that frequently act together. They participate in 20 to 70 markets, moving in unison, cross-referencing each other, with astonishing coordination. In another identified batch of coordinated operations, two addresses not only share the same trading direction but also place bets in up to 150 similar derivative markets simultaneously. Such extensive overlap strongly indicates that these addresses are controlled by a single program or entity.

To hide fund flows and disperse risk, some entities have also carefully constructed networks of dozens of small bets worth only a few dollars each. This suggests that the actual behind-the-scenes manipulation team behind these 521 addresses may be controlled by only a few entities.

A week ago, an institutional report accused only six suspicious wallets of stealing over $1 million. But when PANews extended its scan across the entire network of over 500 addresses, it became clear that this is no longer a matter of a few opportunists but a systemic hunt led by insiders, targeting ordinary liquidity providers.

When $332 can instantly grow into $40,000 within a few blocks, and 62 wallets with keen eyes on Tehran’s skies operate across thousands of categories, the data on the chain does not lie. These suspicious addresses, with returns of thousands of times, prove that when anonymity and geopolitical secrets merge, the so-called collective intelligence is just a cover for a few monopolists to harvest retail investors. Respect the market, follow the trend, maintain independent thinking and cautious judgment—perhaps these are the only rules for survival amid the decentralized carnival.