# Reasoning

1. Cluster funding

These 4 addresses were involved in funding the wallets :

- 0xc55002bd20718e67d6a52704abB3b7E203388635 = ~10k wallets
- 0x741b44F42ac66EC69306E51d347daCd10f660450 = 5000 wallets
- 0x75DA953C58B68D35B0a3bd54B64cCe9697e955F1 & 0x1193A4F3Acb05876AB96dE7468dbc7db91985574 (both funded the same set of wallets) = 900 wallets

2. funding wallets connection

0xc55 , 0x741 , 0x75 and 0x119 are connected through same Binance deposit address.

0xc55 depositing celo to binance
https://celoscan.io/address/0xa9eac8d04441b37837b802154de28e66df1a122d

0x741 depositing eth to binance
https://etherscan.io/tx/0x4ecaac174b5929f0d17d75b8a1b42dfb64d82492cd768dc18727ccb305c99bbb

0x75DA953C58B68D35B0a3bd54B64cCe9697e955F1 depositing USDC to binance
https://polygonscan.com/tx/0x645a64a41f5c16dbe3ccdd6d8d5d482cddf3f8489a3889a80dca16bd8f06ec36

0x1193A4F3Acb05876AB96dE7468dbc7db91985574 depositing ETH to binance
https://arbiscan.io/tx/0xcd478976046a0c133f4125a8cf46b860cf199f42f27bbd3d1446d03a86edc795

trace to show the connection (celo isn't supported by Arkham so 0xc55 celo deposit amount doesnt add up in the flow):

### funding of ~10k wallets from 0xc55 Using disperse on polygon

https://polygonscan.com/tx/0xcbe873e376eea34ff0e8ad7065ca5cb2eb2f3b1842c93a20c15a75eb632d7dc6
https://polygonscan.com/tx/0xa40e299fb6c1e87c046858c1d7a43f202360800608eb4897bb6fac01014f0d10
https://polygonscan.com/tx/0x3e24d6a1cef01bb3571ab23b80ddf94542ebfb600b8021ff85cac911bb7e576b
https://polygonscan.com/tx/0x83e6d4a140aa506130e92e34856f9a8a8ca2ba530052f2e25031095b8fcd21ce
https://polygonscan.com/tx/0xfe4772c556f4f038a672134c37fbaf79a4347cc3d89c8a007a8d89e5b56e2498
https://polygonscan.com/tx/0x0fea52d9516092f5bfaf6143d3edd24ea16ed11678c8330373e0ad52b9399e0f
https://polygonscan.com/tx/0x8c7ebdbb06eed50680e1dd05d943d18c93e39414f41926fa9992d0c6a97eb3ae
https://polygonscan.com/tx/0x449d370764460b50d1e56cba8894d175e0ba1841d524d68fa4cfa5a771fd2172
https://polygonscan.com/tx/0x60f1dd4c5d38ebba2bb814feb409292571a29b13a2158c377b9436d3c8d00b50
https://polygonscan.com/tx/0x8656b690f9700dbb80008c3160d4ca7d452dd14afb164d65bb6c559be041b6d9
https://polygonscan.com/tx/0x0ac7a66fd3c0add6679591eaba675f0a5b2ca05059f94c544266322a93548bd9
https://polygonscan.com/tx/0x2bf6803f931eaadbfaf48e591e5a999b9451e4819306abacfe2d4abd07338851
https://polygonscan.com/tx/0x46f60dac5f615ac55475075910c6c44388272f0f785114aface29877776727fe
https://polygonscan.com/tx/0xda98e82b596eff262082c7dbff0302495688a034c82f559d49f03e99605ed0e8

**Mostly all wallets funded by 0xc55 follow the same pattern :**

1. Mostly 11 txns (10 or 12 in some cases)
2. First L0 txn is from BNB to Harmony chain using Harmony bridge 11months ago
3. Last L0 txn is from Polygon to Fuse chain using No gem app about 2months ago
4. 7 active months and and almost same L0 age

### 0x741 funding 5000 wallets on celo using disperse

https://celoscan.io/tx/0xb15739cc2dbc13e76cc67f2f78ac1a28e96afaef216a608b033e35661445bd9c
https://celoscan.io/tx/0x12ec4d628aa7b4228a9abc940d45dfe99530b07ed296050ef4ea0afb6e43686b
https://celoscan.io/tx/0x40174233e3afa16aeced562ab389f4ab55b2e7bc6154b82216f6f8fd0e026813
https://celoscan.io/tx/0x40a9b97612f3e43eb447c1a096eecaab4bec18852203f9b07db13b5a4ac801c8
https://celoscan.io/tx/0x33b5c108dca3cd6d56b6bac7c51da9e56c2580db1693c885811dc7dc0330b0c2
https://celoscan.io/tx/0xc82259448bce5a8c3b78ea90b38219bc103922c2894c26c7d2ed773caaf6140c
https://celoscan.io/tx/0x67ea5967e073d6992341255d3755b1e7f7d8dc41a2c44624992c3e093b755464
https://celoscan.io/tx/0xd4417ef5d3cfcef1c2775f7809145c1b545964d3dfbfb2de8efb27d970212907
https://celoscan.io/tx/0x1040e0eee699211c5af7883ec0365ca6c1d48432e198ddef58bbb5ae6f51a3af
https://celoscan.io/tx/0xd26217269f5e60219050d6f867498811a4ff3a232bd327f12c671c0ce3699ccd
https://celoscan.io/tx/0xfcb5d754001df44eb30b50a1c49b2990d1833909251fef02505d21453270a80a
https://celoscan.io/tx/0x44604efd17dc40796ffb998b2d92fa763080059f4f8a9ffd16ba3b97c5388af0
https://celoscan.io/tx/0xb72cd042a9d1900515f5b2502b4b4f2d25ba945831e53b26e9a76ea5bc21493d
https://celoscan.io/tx/0x09ca5237cbb6904306595785ad37058f896e962608e5b06efef9d81b4062b539
https://celoscan.io/tx/0x6b34c3e7e902d839098e5deabb303812ecd81288657bb9cc0955909b366fae97
https://celoscan.io/tx/0x0db79eb56632b0b6e665dbed87d90d24daf3ac47ec1d7d8b3ab2f27ba0d7526f
https://celoscan.io/tx/0x9455b997b271a643d673eb2946eace21d753b3da42db364835a47c6ae14eb38e
https://celoscan.io/tx/0x0527d00c1ce3303e512bbd0edc6cfda2700157f8fd299057fa4c31f806fa2fd4
https://celoscan.io/tx/0xf31c8afb95639833b7cb74e9db576c13212de4fe135722f023de3c5dcc37c29d
https://celoscan.io/tx/0xdd84e9ca7ef2adbf4f6de7e89da6f520663d8cafc352c764c876061fd7064eb4
https://celoscan.io/tx/0x59b299eb7021de5a1890b021627e0582b645b1b54b251d1942fc8db882ce8fb2
https://celoscan.io/tx/0x352f47051324db5909d21da648a39524545dbd4ca32ba53d80d691d5e3cde57a
https://celoscan.io/tx/0x73a9064ebe682c19a7e44d7b89f675aa32f9d09a081f0b65f3a14dc89b3b649e
https://celoscan.io/tx/0x87c04f41299501b7c4e243c6fe589b5a23b3bfcd6b6b741243d4f0272e3427c9
https://celoscan.io/tx/0x31823e166a04259cd69aa77b17cebadfe4e07d68d773fd5e8ab2a0f75243fa22

**pattern followed by wallets funded by 0x741:**

1. Every wallet has same LayerZero age
2. First L0 txn on Every wallet is a merkly refuel from Moonriver to kava chain
3. Last L0 txn on Every wallet is a merkly refeul from Polygon to DFK chain 2months ago
4. total L0 Txns on all wallets vary from from 9-14 (mostly same Oapps have been used)

Another connection of 0x741 with 0xc55 : 0x741 Used disperse on Ethereum to send MEME token. 0x74 dispersed funds to 2k+ wallets that were initially funded by 0xc55 :
https://etherscan.io/tx/0x2329e299c05aedda98e84d6b7d827abbff0653fe80fcc8f75576aae96dfbdec9
https://etherscan.io/tx/0x89def4a32adf785f82df756be23540205d6a9163bbb2b9ad41e70963b058d647
https://etherscan.io/tx/0xb61e6b2213cfae6949ff569d1571f48ea70f74465c9e8499e92ae89dc105d616
https://etherscan.io/tx/0x9723643268b9c0a2f6ea41b71be1ef0feedeb80ca763bd0e99e74a388434b97d

### 0x119 and 0x75D funding the same 900 wallets on ARB and Polygon respectively using Disperse app :

https://arbiscan.io/tx/0x2ac067ffcf1978f2c9d64e05f379cf4a1c3eb00159017a32a9212abe63f12e39
https://arbiscan.io/tx/0xadb757b3d3630e865443f31be7d837c6cb1164aa0137561fe096c745c03668bd
https://polygonscan.com/tx/0x7733c6e3e2b842540e59efb10f1466d60c87d209c3e15644f1902328305c6d60

**pattern followed by wallets funded by 0x119 & 0x75D (this set of wallets is higher quality compared to the other 2):**

1. First txn on every wallet was within a week of each other
2. All wallets try to hit the same 3 chains in the first 3 L0 txns. It's either Avalanche > fantom > polygon > avalanche or Polygon > fantom > avalanche > polygon
3. After the first 3 txns all wallets use the exact same Oapps in the same order. Testnet bridge > harmony bridge > coredao bridge > BTC.b bridge
4. total L0 Txns on all wallets vary from 21-22
5. The last L0 txn on every wallet is a message from base chain to fuse mainnet using the same Oapp Nogem

biggest wallet in the cluster **0x91a55d0048f101083405e81f4b46c90bc7c3c45a** was caught because it uses the same binance deposit address (0xa9eac8d04441B37837B802154dE28e66dF1a122d) that is used by other funding wallets frequently :
https://arbiscan.io/tx/0x39c19638da6a54fb7b717d21e361aa4c0d06a8dc4d3b103046bc6f2b8f2bee60

Also a second binance deposit address (0x47Df9bdb261c09C8E3E8A0CB3879ddff9F1ecc82) that 0x91a used to use until 1 year ago was also used by 0x741 wallet 2years ago
0x741 txn :
https://etherscan.io/tx/0xc0cfc1f0f1967dac3b56228b9002805797d8ba7642546d15f20c5708699728b2

0x91a txns :
https://etherscan.io/tx/0xccaae2a8c186aa7fa2971607cf54c7b8b375abc0e795e017a0ffd9bcaf834df3

# Methodology & Walkthrough

Almost all the work was done manually

The Initial set of cluster was identified through same day first layerZero txn from bnb chain to harmony chain and repeated same pattern of txns across 1000+ wallets.

after reverse tracking this set of wallets i got the funding source which was mainly done through Disperse app on different chains. after Finding the binance deposit address of the first funder i found the other 3 funder addresses that were using disperse app heavily to distribute funds to 1000s of wallets.

# Reward Address (If Eligible)

0xc0D735C93a24fa756ceb5FDD1398eeA16A2Ef830