Forensic Review: Coordinated Outcome Trading Between `0xbcc3...41b1` and `0x4b67...ccba`

Bottom line: the evidence supports deliberate coordination between Wallet A and Wallet B at high confidence. Twenty-six executions across 16 markets paired the wallets at the same millisecond, under the same HyperCore execution hash, for the same quantity and on complementary outcomes. All 26 involved a short-resting limit order from one wallet followed by a crossing order from the other. A separate cross-chain trace proves that Wallet A transferred approximately 23,000 USDC directly to Wallet B, after which Wallet B moved a near-equivalent amount into HyperCore.

The economic pattern is consistent with coordinated reward farming or circular volume. At cluster level, the wallets carried almost no directional exposure. A gross trading loss of 3.420000 USDC, plus 274.029504 USDC in reported settlement fees, produced a reconstructed trading loss of 277.449504 USDC. The wallets received 523.493601 USDC in rewards. A further 55.746785 USDC was finalised but unpaid at the evidence cut-off. Paid rewards exceeded the reconstructed trading loss by a scoped apparent surplus of 246.044097 USDC before bridge charges, native gas, and unrelated activity.

The public record does not establish that one person owns both wallets. It also does not establish involvement by an Outcome founder, employee, deployer, or treasury controller. There is no public basis to describe this as insider trading. Both wallets predate the 2026 campaign: Wallet B was active by January 2023 and Wallet A by February 2025. That history shows neither wallet was created solely for this campaign, but it does not identify who operated them in 2026 or weaken the evidence of campaign coordination.

The community memo reached the right conclusion about coordination, but its main ownership argument was wrong. Address 0x6b9e...0a24 is Circle's shared CoreDepositWallet, not a private funding wallet. It routed funds to more than 21,000 destinations during the examined window. Its appearance in Wallet A, Wallet B and treasury records creates no ownership link.

The evidence supports the following classification:

High-confidence wallet coordination. Activity consistent with excluded circular reward farming. Operator identity unresolved. No present basis for an insider allegation.

The investigation addressed six questions:

1. Were the two wallets genuinely paired in the same executions?
2. Did the wallets recycle capital between each other?
3. What economic risk did the pair retain?
4. Did paid rewards exceed the reconstructed trading loss before excluded costs?
5. Can either wallet be linked to Outcome founders, staff, deployers or treasury control?
6. Can transaction timing support a geographic attribution?

All timestamps were normalised to UTC. Public-chain records and public APIs were used for transaction, order, reward, and contract-role verification. Internal KYC, IP, device, session, API-key, referral, and beneficial-owner records were not available. This is an investigative assessment, not a legal determination.

Addresses identify onchain accounts, not people. References to A and B do not imply that the same person controls both private keys.

Outcome uses a merged binary order book. Buying YES at 0.40 can match someone buying NO at 0.60. One YES token and one NO token form a complete set worth 1 USDC at settlement. This is documented in Outcome's order-book guide and token and pricing guide.

This has an important forensic consequence:

• A YES price and a NO price summing to 1 is expected protocol behaviour.
• The same execution time, quantity and hash are also expected for opposing legs of one match.
• Those facts are not suspicious in isolation.
• The evidence becomes significant because the same two wallets repeat the structure 26 times, finish with exactly mirrored inventory, participate in the same rewarded markets, and directly recycle capital from A to B.

The pattern should therefore be described as repeated reciprocal or circular execution, not as a protocol anomaly.

The dates below are the earliest events identified across the reviewed public records, not proof of private-key creation. An inbound transfer shows when an address was first touched; it does not prove owner control. The review covered major public EVM mainnets and separately checked Hyperliquid fills and ledger activity, but it cannot exclude earlier activity on an unreviewed or unindexed network.

#5.1 Aggregate results

Every paired execution placed A and B on opposite sides of the same binary market. One wallet first submitted a Limit/GTC order. The other crossed it after a short but positive interval.

This corrects one key statement in the memo. The paired maker orders did rest. They rested for between 0.736 and 18.852 seconds. A later snapshot showing zero open orders only proves that no order remained open at that later moment.

#5.2 Representative executions

The full 26-row execution table appears in Appendix A.

#5.3 Fragmented smaller fills

Thirteen smaller rows did not pair row-for-row under the strict hash rule. They were limited to O1345 and O1383:

• A accumulated 1,842 additional YES shares.
• B accumulated 1,842 additional NO shares.
• The combined purchase notional was 1,845.420 USDC.
• The resulting inventory still matched exactly across the two wallets.

The memo quoted 2,451 USDC for these fills. That figure could not be reproduced.

#5.4 Mirrored inventory

All 16 examined markets ended with exact mirror positions. Examples:

Settlement paid 1 USDC per winning share and 0 USDC per losing share. Taken as a cluster, the pair had almost no directional exposure. Its combined gross settlement result was a loss of 3.42 USDC before reported fees.

Before rewards, the cluster lost 277.449504 USDC. Paid rewards exceeded that cost by:

523.493601 - 277.449504 = 246.044097 USDC

If the additional finalised awards are paid, the scoped apparent surplus becomes:

579.240386 - 277.449504 = 301.790882 USDC

The comparison excludes network gas, bridge costs, and PnL from unrelated activity. Accordingly, 246.044097 USDC is a scoped apparent surplus, not a complete net-profit figure. The supported conclusion is that the examined trading was loss-making before incentives and that paid rewards exceeded the reconstructed trading loss before excluded costs.

This is the strongest linkage in the investigation.

#7.1 Reconstructed route

The route took 36 minutes and 40.946 seconds from A's HyperCore withdrawal to B's HyperCore credit. The difference between the opening withdrawal and final credit was 2.796991 USDC, before native-chain gas accounting.

The Across FundsDeposited event explicitly records A as depositor, B as recipient, Arbitrum as origin and Base as destination. The Base FilledRelay event repeats the same depositor, recipient and deposit ID 4,604,805. B then signed both CCTP source transactions used to move a near-equivalent amount into HyperCore.

This establishes an intentional, recipient-directed value transfer from A to B. Because USDC is fungible and intermediate balances differ slightly, this is a reconstructed value route rather than a trace of unique coin units. It does not prove that one person controlled both keys.

Decoded bridge-event identifiers:

#7.2 Circle message identifiers

These identifiers make each CCTP leg independently reproducible through Circle's messages API.

#8.1 Why 0x6b9e...0a24 is not a common private funder

The community memo treats 0x6b9e...0a24 as a wallet that may connect A, B and the reward treasury. That interpretation is incorrect.

Circle's HyperCore contract register identifies 0x6B9E773128f453f5c2C60935Ee2DE2CBc5390A24 as the mainnet HyperEVM CoreDepositWallet. Circle's contract interface explains that it deposits USDC into HyperCore and credits the selected recipient.

Complete pagination for the examined period confirms infrastructure behaviour. The first and last returned ledger rows in the captured period were timestamped 29 August 2026, 00:00:28.057 UTC and 4 September 2026, 08:34:27.455 UTC.

A shared system contract must be excluded from ownership clustering. Treating this address as a common funder would create thousands of false links.

All six A/B CCTP deposits processed through this infrastructure were initiated on Arbitrum by the corresponding recipient wallet:

This rules out 0x6b9e...0a24 as the alleged private common funder. It does not identify every upstream beneficial funding source.

#8.2 Coordinated campaign funding

At the start of the examined campaign window, A and B each received a net HyperCore credit of 4,999.6 USDC, 14.016 seconds apart:

Immediately before these burns, both wallets received 4,999.8 USDC from the same StrategyExecutor smart account, approximately 50 seconds apart. The account's native owner is labelled as Binance infrastructure by public explorers:

• B receipt: Arbitrum transaction 0xfe70...a3b
• A receipt: Arbitrum transaction 0x645c...be9

The sending StrategyExecutor proxy is 0xee7...4055. Its onchain native-owner value is 0xB38e...891D, which public explorer labels associate with Binance. The label is supporting attribution, not identity evidence for A or B.

The close timing and equal amounts support coordinated preparation. They do not prove common ownership because the source is high-volume exchange infrastructure. Exchange hot wallets and strategy executors serve many unrelated customers.

#8.3 Treasury ledger

The rewards treasury ledger for the examined window contained 6,783 rows, with 6,773 outgoing payments and 10 incoming transfers. Seven incoming transfers totalling 51,167.6 USDC came through the Circle deposit route. Three additional transfers totalling 15.2 USDC came from 0x047a1c608406972d7c26132f189bbfb0cfefd413.

The memo's statement that 0x6b9e...0a24 was the treasury's only funding source is therefore false even at ledger level. More importantly, the address is infrastructure rather than an owner.

Outcome's published programme allocates each market reward as follows:

Both wallets approved the official Outcome builder address and earned programme rewards. Agent metadata captured at the evidence cut-off showed separate Outcome agent keys for A and B:

Separate agent keys do not establish separate beneficial owners. They show only that the two main accounts were configured separately at the time of the query. Agent approvals can change, so this snapshot does not prove which keys were used during the campaign.

#9.1 Paid and pending rewards

The public reward service defines paid USDC as value already transferred from the treasury and pending USDC as finalised awards not yet swept. The values above are a point-in-time snapshot and can change.

The paginated treasury capture preceded Wallet B's O1409 payment and showed nine payments to B totalling 236.111634 USDC. The later reward-service snapshot at 09:15:59 UTC includes the O1409 payment sent at 09:15:21.961 UTC, bringing B to ten payments and 306.609328 USDC paid. The table therefore uses the later reward-service snapshot; the two captures are temporally consistent rather than simultaneous.

Wallet B's O1409 allocation moved from pending to sent at 09:15:21.961 UTC, 37 seconds before the evidence cut-off. Wallet A's O1409 allocation remained pending. This illustrates why payout status must always be tied to a precise snapshot time.

#9.2 Rules in force

The published Outcome liquidity-reward rules state that the following activity does not score:

self-trading, related-wallet churn, wash trading or circular volume

The exclusion language appeared in commit 56cd9a2, committed on 28 August 2026 at 21:54:29 UTC. This predates the first examined paired execution by just over 22 hours.

Public records show that rewards were nevertheless awarded and paid. They cannot show whether an authorised exception existed. In the absence of a documented exception, this points to a reward-screening and enforcement gap.

Both wallets had verified public-chain and Hyperliquid activity before the examined campaign. Wallet A first appeared in the reviewed public-chain records on 6 February 2025, signed its first identified transaction minutes later, deposited to Hyperliquid on 28 August 2025, and had its first returned fill on 23 September 2025. Wallet B first appeared in the reviewed public-chain records on 26 January 2023, signed its first identified transaction the next day, deposited to Hyperliquid on 19 December 2023, and had its first returned fill on 20 February 2024.

The returned Hyperliquid histories contained 18 pre-window fills for Wallet A and 375 for Wallet B across BTC, ETH, HYPE, and other products.

This disproves the memo's global statement that the wallets only traded against each other. It does not weaken the evidence of coordination during the Outcome campaign. Existing wallets can later be coordinated, delegated or operated through a shared service.

No shared, non-zero execution hash was found in the returned pre-campaign fill histories. This limits the publicly demonstrated coordination period to the activity examined here. It does not identify when the relationship began.

#10.1 What links A and B

The strongest linkage factors are:

1. Twenty-six opposing fills with the same millisecond, hash, market and quantity
2. Complementary prices and exact mirrored inventory across all 16 examined markets
3. Repeated short sequence of maker order followed by the other wallet's crossing order
4. Equal, near-simultaneous campaign funding
5. A direct, signed A-to-B cross-chain transfer of approximately 23,000 USDC
6. Both wallets received programme rewards in markets where the reciprocal activity occurred

#10.2 What does not link A and B to Outcome personnel

No public evidence connected either wallet to:

• the live out venue deployer or the separate documentation-listed deployer
• a founder or employee address
• the reward treasury's control keys
• a team funding wallet
• a public identity belonging to Outcome personnel
• access to nonpublic market information

The Circle deposit contract cannot be used for that purpose. Builder approval also cannot be used as an ownership link because it is required for ordinary reward eligibility.

The memo's timing characterisation is incorrect. Of the 26 paired executions:

• 10 occurred less than one hour before the relevant market expiry.
• 4 occurred between one and three hours before expiry.
• 12 occurred more than three hours before expiry.
• The full range was 3 minutes 22.787 seconds to 23 hours 27 minutes 30.283 seconds before expiry.

The activity clustered around scheduled markets, including a session around 11:48 UTC and sessions from roughly 18:45 to 22:01 UTC. This is consistent with automation and awareness of incentive or expiry schedules. It does not support a country or time zone inference.

The most likely explanations are either one operator using two wallets or two users deliberately cooperating. Public records cannot distinguish those two cases.

Terms such as circular and wash-like describe the observed mechanics. Any statutory or regulatory classification should be handled separately by counsel.

The public record supports deliberate coordination between Wallet A and Wallet B at high confidence. It directly establishes a transfer of approximately 23,000 USDC from A to B, followed by B moving a near-equivalent amount into HyperCore.

The trading pattern is consistent with reward farming through matched complementary positions. At cluster level, paid rewards exceeded the reconstructed trading loss before bridge charges, native gas and unrelated activity. The activity is also consistent with categories excluded by the published programme rules.

The evidence does not establish common beneficial ownership, employee involvement, access to nonpublic information, or geographic origin.

The core pairing condition can be reproduced as:

pair(A_fill, B_fill) when:
    A_fill.time == B_fill.time
    and A_fill.hash == B_fill.hash
    and market(A_fill.coin) == market(B_fill.coin)
    and side(A_fill.coin) != side(B_fill.coin)
    and A_fill.size == B_fill.size
    and A_fill.price + B_fill.price == 1

Maker rest time was calculated as:

maker_rest_ms = fill.time_ms - historical_order.timestamp_ms

Every identified maker rest time was positive.

Prices were parsed and compared using exact decimal arithmetic rather than binary floating-point arithmetic.

#Hyperliquid fills

POST https://api.hyperliquid.xyz/info

{
  "type": "userFillsByTime",
  "user": "0xbcc3237bb9b0468c32fabb7f000b799be33441b1",
  "startTime": 1787961600000,
  "endTime": 1788566400000,
  "aggregateByTime": false
}

All wallet-specific queries in this appendix were repeated with Wallet B by substituting 0x4b67c7f8893bd8fbc819fa57b9dd9dde0b03ccba for the user value. The requested end boundary was 5 September 2026, 00:00 UTC so the capture included all records available during 4 September.

#Historical orders

{
  "type": "historicalOrders",
  "user": "0xbcc3237bb9b0468c32fabb7f000b799be33441b1"
}

#Non-funding ledger

{
  "type": "userNonFundingLedgerUpdates",
  "user": "0xbcc3237bb9b0468c32fabb7f000b799be33441b1",
  "startTime": 1787961600000,
  "endTime": 1788566400000
}

The ledger endpoint returns at most 2,000 rows per response. Complete reconstruction within a requested time window requires pagination with overlap-safe deduplication.

#Agents and builders

{ "type": "extraAgents", "user": "0xbcc3237bb9b0468c32fabb7f000b799be33441b1" }

{ "type": "approvedBuilders", "user": "0xbcc3237bb9b0468c32fabb7f000b799be33441b1" }

#Live Outcome metadata

{ "type": "outcomeMeta" }

#Outcome rewards

GET https://pd-liquidity-rewards-payouts.outcome-e91.workers.dev/v1/rewards/0xbcc3237bb9b0468c32fabb7f000b799be33441b1
GET https://pd-liquidity-rewards-payouts.outcome-e91.workers.dev/v1/rewards/0x4b67c7f8893bd8fbc819fa57b9dd9dde0b03ccba

#Circle CCTP messages

GET https://iris-api.circle.com/v2/messages/{sourceDomain}?nonce={nonce}

Use source domains 19, 6 and 3 with the nonces listed in section 7.2.

Public data can establish transaction sequence, account signatures, contract interaction, fill structure, balances and reward transfers. It cannot by itself establish:

• the human or company behind an address
• whether two keys were held by one person
• physical location
• intent or private communications
• IP, device or browser identity
• historical API-key ownership beyond exposed agent metadata
• whether an internal authorisation or exception existed
• a legal finding of wash trading, fraud or insider trading

These limits are the reason this report reaches a strong finding on coordination and activity consistent with excluded circular reward farming, while keeping operator identity and internal involvement unresolved.

• Hyperliquid Info API documentation
• Circle HyperCore CCTP contract addresses
• Circle CoreDepositWallet interface
• Circle CCTP messages API
• Outcome liquidity-reward rules
• Reward exclusions commit
• Outcome architecture and documentation-listed addresses
• Outcome merged order-book explanation
• Outcome complete-set pricing explanation
• Outcome reward API documentation