TIBBIR Universe · Saved post receipt · 2098903138061197362

Hank Moody

@Hank69Moody · Published: Sat Sep 12 22:34:38 +0000 2026

Original post on X · Full data receipt · Backup index

Saved archive render, not a screenshot of the original X page. Full captured content is retained below; capture gaps are stated explicitly. Video files are not stored.

THE WALLET FILES: FOLLOWING THE GREEN FROG

We followed a $TIBBIR 🐸 payment. It took us back to $WALLET’s first day and then much further...

THE WALLET FILES: Part VI ended with a strange transfer.

A Definitive programmable trading vault/account called c41E sent 52 TIBBIR to mickym.eth, the address our research associated with Micky Malka, founder of Ribbit Capital

So we decided to follow the payment.

We started at the account that sent it and went back in time.

We started on July 10, 2026.

WALLET’s launch transaction appeared at 01:02:04 UTC.

About nine hours later, c41E made its first WALLET purchase.

But the activity immediately before that purchase was worth opening too.

On Base, an address we call 0f5a, 0x0f5a1f44c5aa33173e3054437aa33ad65cadda91, sent c41E almost 20,000 USDC.

A little over two minutes later, c41E sent approximately 19,779.99 USDC into Relay.

Five seconds after that, the same c41E address received approximately 19,771.99 USDG on Robinhood Chain.

Then we looked at what happened next.

10:02:24: USDG arrives.

10:03:01: c41E buys roughly 915,000 WALLET.

Thirty-seven seconds.

And that purchase was only the beginning.

We reconstructed the rest of the day.

Thirty purchases. Approximately 27.49 million WALLET acquired.

By July 21, the record had grown to 35 purchases, spending roughly 49,320 USDG to acquire about 30.13 million WALLET across those trades.

A trading account holding WALLET was no longer a surprise. We had already found those in THE WALLET FILES: Part VI.

The date changed the picture.

The account that later sent 52 TIBBIR to mickym.eth had been buying WALLET repeatedly on its very first day.

So we asked the obvious question:

Who was behind c41E?

THE KEY LED TO A NAME

A Definitive vault is a trading account operated by software. To understand who uses it, following the token balance is only half the job.

You also have to follow the keys allowed to instruct it.

For c41E, that took us back to 3cB68, 0x3cB68a1f877a34495204620dc33f68e5dc4b3462, its client and authorization address.

We already knew that relationship. What we had not yet explained was how 3cB68 itself got started.

Its early funding on Base led to another address:

9f63: 0x9f63db22d8bdb8ec90cc6370229b1be6df9f4444

That address had directly sent it ETH.

We checked 9f63 against Polymarket’s public profile data.

A name appeared:

de8a.

A public pseudonym on a prediction market.

The Polymarket profile used a separate trading wallet, while 9f63 was the underlying account associated with it. The important part for us was that 9f63 was also appearing in c41E’s financial history.

But 9f63 wasn't just the address that had funded c41E's authorization key.

Across Base and Ethereum, we found 46 transfers from 9f63 into c41E and 19 going back.

This wasn't a one-off interaction. The public pseudonym de8a now sat behind a recurring financial relationship with the same programmable account that had bought 27.49 million WALLET on launch day.

But de8a wasn't where the strangest trail led.

For that, we went back to mickym.eth.

THE NAME WAS OLDER THAN THE TOKEN

TIBBIR is RIBBIT backward.

That was easy to notice.

What we wanted to know was whether the name had a history beyond the token.

So we left the transaction ledger for a moment and opened the corporate filings.

In a securities disclosure dated February 14, 2023, we found:

Tibbir DE Trust.

The filing listed 102,183 Robinhood shares and named Meyer Malka as the trust’s settlor, the person who established it, and investment adviser.

The name we had reached through a TIBBIR payment was already sitting inside a formal Robinhood shareholder disclosure.

In 2023.

Years before the token existed.

And it wasn't just similar.

It was the same word:

TIBBIR.

So we stopped looking at the fifty-two-token payment.

And started investigating TIBBIR itself.

THE FROG, THE PUNK AND CROSSMINT

First we followed mickym.eth backward.

In January 2025, it sent 0.1 ETH to 80a8: 0x80a8F11201Bc1962D0Dfff0a5B9C49B14bb2b7c2

Ten minutes and thirty-four seconds later, 80a8 signed the Virtuals launch call for Ribbita/TIBBIR.

TIBBIR/Ribbita is an AI-agent project in the Virtuals ecosystem. Its story included CryptoPunk #9098, a numbered digital collectible.

A separate NFT collection called TIB98 described itself as commemorating Ribbita’s acquisition of that CryptoPunk. The 80a8 address received TIB98 tokenId 1.

We traced the commemorative collection’s contract.

Its August 15, 2025 deployment led into:

Crossmint’s infrastructure.

Crossmint also brought a familiar set of screenshots back into view.

In material attributed to Alex Acuña, we had seen AA, 33, and white rabbit and green frog imagery.

And our wider investigation had begun with an address ending in aa33.

It was the kind of resemblance that makes you stop scrolling.

THE TRAIL LED BACK TO AA33

At first, the finding looked small.

Months before WALLET was launched by aa33, aa33 had swapped PARTI into TIBBIR.

That alone could have been dismissed as one tiny trade.

So we opened the surrounding history.

And the picture changed completely.

aa33 was moving through a cluster of AI-agent and AI-infrastructure tokens:

Luna by Virtuals.

Mamo.

Backroom by Virtuals.

717ai / WIRE.

Bankr.

Ribbita / TIBBIR.

Sapien.

Not as random incoming tokens.

aa33 was actively buying and selling them.

And it was doing it fast.

In one sequence, three consecutive Base transactions bought three agent-related assets:

ROOM → MAMO → WIRE

through the same 0x Settler.

Then, five days later, the WIRE position reappeared.

aa33 sold:

WIRE → PARTI

and shortly after:

PARTI → TIBBIR.

So the TIBBIR purchase was not an isolated event.

We could trace it directly back to an earlier Virtuals-linked AI position.

And the rapid-fire pattern continued.

Near the end of another trading session, four of five consecutive swaps touched AI-agent or AI-infrastructure projects:

Bankr.

717ai.

Ribbita.

Sapien.

This wasn’t happening just once.

We found the same behavior earlier with Luna and Mamo.

Across the examined history, aa33 had repeatedly entered, exited and rotated positions across at least 7 AI-agent or AI-infrastructure projects.

So months before WALLET existed, its future launcher was already actively moving through the emerging agent economy.

And one of those positions ended in:

TIBBIR.

That made the small trade much harder to dismiss.

The question was no longer:

Why did aa33 once buy TIBBIR?

It was:

Why was WALLET’s future launcher repeatedly trading AI-agent projects at all?

And why did one of those rapid-fire rotations lead straight into Ribbita?

WE TRIED THE SAME QUESTION ON THE OTHER FAMILY

The older trades had made aa33 a bigger question, not supplied a name.

But elsewhere in the investigation, following funding had already helped us identify a recurring client relationship: de8a and c41E.

Could the same approach tell us more about the other Definitive trading accounts/vaults from THE WALLET FILES: Part VI?

We returned to:

058f: 0x058f346e53C21E55A6e48893E6AF443c45101037

325e: 0x325ef2734F2b8C8ad223803518067A042E875dcA

7E63: 0x7e63b754a9e61451e196b694d6e0748851eebf8a (ADMIN)

Before we even followed their funding, we found something else.

3C77, the vault we investigated in THE WALLET FILES: Part VI, wasn't the only Definitive account where TIBBIR capital ended up in WALLET.

On July 24, 058f sold TIBBIR on Base for USDC.

The money entered Relay, crossed to Robinhood Chain as USDG, and was then used by the same account to acquire approximately:

194,150 WALLET.

Another route:

TIBBIR → USDC → Relay → USDG → WALLET.

Different vault.

Same Definitive family.

The route we found in Part VI was no longer alone.

So we kept digging into the family.

Their Base funding led to the same address:

b726: 0xB7267B31b943DAb687fF4a9A63B3dA28eF2B9337

On July 10, b726 sent 058f 100 USDC.

Forty-six seconds later, it sent approximately 100,910 USDC.

Six days later, it funded 325e.

First 10 USDC.

Then approximately 41,980 USDC.

The small-payment-followed-by-a-large-payment pattern appeared again on July 24, and again on September 2.

Across eight direct transfers into the two vaults, b726 supplied approximately 186,252 USDC.

Then we checked where else b726 had sent money.

B433 was there too: 0xB43341D20df16C11F8B390Dc1a9131a353d75f5E

On June 12, 2025, b726 had funded B433 on Base and Ethereum roughly eighty seconds apart.

B433 was the capital address behind the original 3C77 investigation in THE WALLET FILES: PART VI.

Now its earlier funding source was appearing as a direct supplier of trading capital to two other vaults in the same 7E63 family.

The funding history was beginning to explain more than the token balances alone.

We could see money going into the accounts.

We could also see how it travelled.

Inside 325e’s July 16 LI.FI transaction, a routing label appeared:

definitive-prod.

A separate field named Across as the bridge.

LI.FI had arranged the route. Across received the bridge deposit. The deposit specified 41,964.777415 USDG for 325e on Robinhood Chain.

The same amount appeared at the destination two seconds later.

But when we compared that arrival with the account’s creation transaction, another detail emerged.

The money had arrived more than four hours before 325e’s account software was deployed there.

058f showed the same ordering. Its large USDG credit arrived on July 10. Its account was deployed early on July 11.

We had already explained this mechanism around 3C77 in THE WALLET FILES: Part VI. A future smart-account address can be calculated in advance, allowing tokens to arrive before the account’s software is installed.

The new finding was the repetition.

It was not just 3C77.

Other accounts in that family had also been funded first and deployed later.

And c41E, in the separate client family, had received its first USDG on Robinhood Chain 54 minutes before its own deployment on launch day.

The funding was visible.

The account software was visible.

The clients behind those arrangements were much harder to identify.

So we followed the money in the other direction.

TWO BRANCHES REACHED D23

On September 3, 325e sent out three WALLET amounts:

3,333,342.

3,333,343.

3,333,315.

We had mentioned the roughly 3.333 million-sized transfers in THE WALLET FILES: Part VI.

This time, we added them precisely and followed their destination.

Together, they made:

10,000,000 WALLET.

All three went to:

D23: 0xD23Ac16fBe3Da4c65eC500E61E1Abadd5bbDA7F0

The repeated threes had drawn our attention.

The exact ten million, and where it went, gave us something more concrete to investigate.

Three days later, D23 appeared again.

This time on Base.

B433 sent one million TIBBIR to 3C77.

54 seconds later, 3C77 forwarded almost the entire million to D23.

We were looking at two different vaults from the same family, moving two different tokens on two different chains.

Their paths reached the same receiving address.

There were smaller movements around those transfers too.

On September 3, 325e sent D23 33.33 USDG. 8 seconds later, D23 forwarded that amount to Relay.

On September 6, 3C77 sent D23 33.33 USDC. 6 seconds later, that amount went into Relay on Base.

The large token transfers showed us where the assets arrived.

The stablecoin transfers showed D23 doing something after receipt: passing funds onward within seconds.

We had found a common funding source around part of the family.

Now we had found a recurring destination too.

Neither had supplied a public name.

But the space between the incoming capital and the outgoing assets was becoming much easier to see.

BACK TO THE 52

That was where the investigations left us.

Around the 7E63 family, we could see common funding, accounts provisioned before deployment, another TIBBIR-to-WALLET sequence, and assets converging on D23.

Around c41E, the history gave us a public pseudonym, repeated deposits and returns, and 30 WALLET purchases on launch day.

Then it gave us the fresh TIBBIR distribution.

The 52 tokens sent to mickym.eth were part of a newly funded sequence with two other recipients

Following the recipient took us backward into TIBBIR’s history.

Following that history brought Crossmint into view.

And aa33’s own transactions opened a much larger chapter than we had first written down.

Not just a small TIBBIR purchase.

An earlier Luna and Mamo pair. Three consecutive purchases of agent-related tokens. Positions acquired on one date and rotated on another. Bankr, Ribbita and Sapien appearing near the end of a much larger trading session.

All before the wallet behind those trades launched $WALLET.

We had started with one payment.

The investigation had brought us back to the address that started the entire series.

The 52 tokens had not changed.

The history around them had become much bigger.

And now the payment had led us to two unresolved questions:

Why did this WALLET-buying account send TIBBIR to mickym.eth?

And what had WALLET’s future launcher been doing in the agent economy all those months before?

Image source: https://pbs.twimg.com/media/HSDMrY3bgAADs8F.jpg?name=orig

Image source: https://pbs.twimg.com/media/HSDHD9takAAA5aQ.jpg?name=orig

Image source: https://pbs.twimg.com/media/HSDEWn7aAAESlo1.jpg?name=orig

Image source: https://pbs.twimg.com/media/HSCl6hJasAA9bxJ.jpg?name=orig

Image source: https://pbs.twimg.com/media/HSCYDLwbMAApTGu.jpg?name=orig

Image source: https://pbs.twimg.com/media/HSCs6aGXsAc46HJ.jpg?name=orig

Image source: https://pbs.twimg.com/media/HSDAbE0aIAAUEOj.jpg?name=orig

Image source: https://pbs.twimg.com/media/HSCfHjLbcAAKjzm.jpg?name=orig

Image source: https://pbs.twimg.com/profile_images/1864783118831325184/DTTJAE9R_200x200.jpg

{
  "path": "sources/community-deep-dive-2026-10-14/fx-2098903138061197362.json",
  "sha256": "7a0e7bbc3936399452fe905aad2d4f7cbf9e706f436c1e0966ed9ce45d99bfa7",
  "retrieved_at": null
}