One ring already took $2.4M here. We built the machine that watches for the next.

The ring was real. We rebuilt it.

Start with the thing that makes the rest of this urgent. In May 2026, 60 Minutes and Bubblemaps reported a cluster of nine connected accounts that won roughly $2.4 million at a ~98% win rate on US-Iran military-strike markets. We did not take that on faith. Working from public data only, RINGER independently reconstructed the case — the reference specimen we call Tehran Nine.

Five of the nine wallets resolved cleanly on-chain. Pooled, they carry an odds-anomaly of z = 4.77 — on the order of one in a million by chance. Four of the five wallets were born inside a 33-hour burst. They moved $1.9M in settled notional and landed 12 sub-0.40 longshot wins — big tickets on outcomes the odds said should lose — where chance allowed only 3.6. That is not a lucky streak. That is the fingerprint of information the rest of the market didn’t have. Rings like this are not hypothetical. One already happened here.

So we left the detector running on everything

If one ring drained millions out of these markets and left a trace we could rebuild after the fact, the obvious question is: how would we see the next one? So we stopped analyzing one case and pointed the detector at the whole market. It now runs on a continuous trade tape of 5.08 million trades across 199,090 wallets, and every single day two scans sweep the entire field — a behavioral ring scan and this funding-graph cluster scan — both live on our Quebec host. The moment any candidate crosses the CRITICAL bar, the system emails a human. Nothing auto-publishes. A person looks first, every time.

The meter above is that watch, rendered. It is not a one-time chart — it is the latest reading of a machine that is still running as you read this. The funding-graph map keeps growing, too: 20,997 wallets are fully funding-mapped today — of which the roughly 15,799 that resolved to a personal (non-exchange) funder are what this scan could actually cluster on — and that map climbs toward the full 199,090 as on-chain funding backfills. More of the market comes into view every day.

Today’s reading: clear. And clear is not the same as clean.

Here is what this scan found: 43 coordinated operator clusters — groups of wallets seeded with money from the same personal hand. Of the 37 with enough settled bets to score, zero crossed the insider-signature line. The average cluster’s z is 0.13 — dead-on chance. That is the watchtower reading clear. For now.

And read the next sentence carefully, because it is the whole point. Those 43 clusters are coordinated, not guilty. People pool wallets, seed fleets from one account, and bet together all the time — for tax reasons, for convenience, for market-making, for fun. That is coordination, and coordination is not wrongdoing. Finding a shared funder is the start of a question, not the end of one. Not one of these 43 is a ring, or a suspect, or an accusation. The meter reads clear precisely because we refuse to call ordinary coordination a scandal.

The clusters that look most like a scandal are the ones the internet would scream about — and the ones that fall apart on inspection. Our reference case for that benign species is Glass Anvil (Report #0): nine of ten wallets seeded by a single personal funder, $69,913 deployed — but at an average entry of 0.93, deep favorites the market already expected to win. We flagged it as favorite-carry, not insider information. One operator, real money, and still not a ring in any sense the word implies. Coordination, cleared. That discipline — separating the ring from the crowd around it — is exactly what lets you trust the meter when it does turn red.

How we tell the ring from the crowd

First, how a cluster forms at all. This lane is a funding-graph detector: an operator running a fleet of wallets usually pays for stake out of one pocket, so we follow the money backwards to the first account that funded each wallet and union together strangers who share a personal funder (one that touched 2–25 wallets — exchange hot wallets are excluded, or they’d fuse a whole customer base into a fake mega-ring). Then, for each cluster with ≥8 settled bets, we ask whether it won more than the exact odds it paid predicted it should — an odds-conditioned z-score, where the winning side of every market comes from the venue’s own on-chain settlement record, never proxied from a price feed.

But a high z alone is never enough — with ~40 clusters, someone looks lucky by pure chance. The luckiest-of-N ceiling here is √(2·ln 37) ≈ 2.69, and the top cluster we observed scored ~2.9 — statistically indistinguishable from “luckiest of forty coin-flippers.” So the CRITICAL gate — the one that pages a human — demands the odds anomaly land on top of money, concentration, and freshness:

The score is favorite-carry-immune: because the null is conditioned on the exact odds accepted, a cluster can’t score high just by buying safe favorites the market already loved. To move the needle it has to win longshots. And the money proves the point. The two highest-z clusters in the scan (both INFO, at 2.94 and 2.79) are dollar-dust — their “wins” are single-digit and five-dollar tickets. Where there is real money, there is no surprise; where there is surprise, there is no money. That cross-tab is the fingerprint of a market behaving, not being gamed.

What “clear” does and doesn’t mean

Be precise about the good news, because we won’t oversell it. Zero CRITICALs does not mean the market is clean. It means no funding-graph insider signature surfaced in this lane on this day — the lane working as designed. And this lane is forensic, not predictive: it catches a ring after its bets settle and it has already won, not before. It does not predict the next ring and it cannot prevent one. It is a watchtower, not a wall. Three structural blind spots bound every conclusion here:

• It is a look-back over settled markets, not a live alarm on activity in flight.
• It only surfaces winners — a coordinated cell that lost scores negative and never flags.
• It is blind to exchange-routed coordination — wallets seeded through an exchange have no shared personal funder to union on. That is exactly the gap that sent Tehran Nine to our second, behavioral detector — the daily scan that runs alongside this one and caught the real ring. The two lanes cover for each other’s blind spots.

When, not if

Rings are rare. But rare is not never — we rebuilt one at one-in-a-million odds, and the conditions that produced it haven’t gone anywhere. The next one won’t send a press release. It will look like an ordinary cluster right up until its longshots keep cashing — and when they do, it will show up here first, on this meter, and this line turns red. A human gets paged within the hour. That is the whole reason the watch runs every day.

And this is why we publish the clear days too. When RINGER files a CRITICAL dossier, we are asking readers, journalists, and platforms to take a serious claim seriously. The only way that trust is real is if we also show you the days we looked hard and found nothing worth naming — and cleared those clusters loudly. This is the Bellingcat move: the methodology and the misses are the product as much as the hits. Today’s scan clears 37 clusters and accuses no one. The day it doesn’t, you’ll want to be watching.

Scope: v1 funding-graph lane only; the behavioral (v2) ring scan runs daily alongside it. As-of scan 2026-07-14 14:59:14 UTC, host predict-pipeline-qc. Public $2.4M / ~98% figures are attributed to 60 Minutes / Bubblemaps reporting; RINGER’s reconstructed figures (z = 4.77, $1.9M settled, 5 of 9 wallets resolved) are our own. Cluster labels are anonymized; no person and no wallet is named. Read the full methodology field note for the per-cluster walkthrough and the exact gate.