The attacker’s routes. Car’s funding network. Every arrow backed by a transaction you can open.
Explore the money map ↘A monitoring script loaded from DebugBear’s CDN contained code to find an existing Polymarket trading client, inspect balances, sell positions or transfer shares, and route funds to the collector. The code was designed to use the logged-in session’s existing trading client and signing access. DebugBear acknowledged a security incident and asked customers to remove its RUM embed. The vendor’s original point of compromise remains undisclosed.
DebugBear’s own warning ↗Polymarket’s own leaderboard returns this name for the main collector, 0x3f991…ffc18. An older Gamma response used tre54355 via a proxy binding. The current response has no user ID, so a same-user rename is unproven.
Fresh platform responses confirm author deletion for the original loss claim and frontend followup. A separate preserved rescue post says he moved roughly $700k to a friend who runs bots with him. That screenshot is marked edited; the version history is unknown.
Original claim response ↗ Followup response ↗ Rescue-post evidence ↗Three verified paths: shared funding, Car’s Perps deposit, and the attacker-linked bridge/payment route. Click a node or arrow for the receipt.
Scroll to move through the chart. Use + to enlarge it. All wallet addresses are written in full inside the map.
Car sent 111 pUSD to 5mTraderYes on August 6. E044 sent it 333 pUSD the next day. The recipient then sent 537 pUSD to 0x6d132…a64be. All three signatures recover to their respective known keys.
E044 also funded Car and lolzzzlol before the incident. These are proven financial links. Car’s control of E044’s key has not been established.
Car sent 750,000 pUSD to established recipient lolzzzlol during the incident. Later, 753,333 pUSD returned. Those funds cannot be counted as an outstanding $750k theft. His forced-sale claim needs a separate valuation: the chain verifies rapid liquidation, but gross proceeds do not measure the loss.
May 16: 3e837…c2132 sent 22 USDC on Arbitrum through an intermediary and Relay. The route ended as the first 22 pUSD credit to 6d132…a64be. Four successful receipts and the matching bridge settlement bind the route.
May 17: Car put 111 pUSD through Relay to that same wallet. It received 111 native USDC, swapped it into USDC.e, then minted 110.981860 pUSD. Car’s actual signature and the recipient’s signed conversion batches are verified.
August: Car’s 111 pUSD was the first cash seed into 5mTraderYes. E044’s 333 pUSD was its only other external canonical collateral credit. The wallet also received 710 pUSD from position redemptions, spent 616.927670 pUSD in markets and sent 537 pUSD to 6d132, leaving 0.072330 pUSD. All 26 collateral receipts reconcile.
The two recipient wallets use distinct owner keys. We recovered all 17 explicit batch authorizations: 12 for 6d132 and five for 5mTraderYes. Their funding relationship is established; Car’s control of those keys remains unproven.
On January 22, 2025, already-known funding lead 46c11…40650 sent Car’s signer 0.007 ETH. Forty-eight seconds later, Car’s key signed its only ordinary Ethereum transaction, transferring 150 USDC from his Ethereum proxy to that gas funder. The route is independently verified. It is historical activity, with no verified attacker connection.
We checked 404 direct settlement counterparties across 920 fills in the selected 82 SELL receipts. None of their wallet or claimed signer addresses exactly matched the 86-address Car lead set, its 344 derived addresses, the ten known attacker endpoints or the additional verified funding keys. Those third-party signer fields were not independently recovered.
The direct same-token BUY subset has 326 buyers, covering 518,814.839670 pUSD of trade consideration between 17:16:10 and 17:17:40 UTC. This excludes complementary-token settlement paths and Car’s maker-side sales. Every buyer/transaction group reconciles against genuine cash and share transfers.
Open the independent receipt audit ↗ · Inspect all direct buyers ↗A public repository’s preserved checkout-challenge extract contains the exact payment operator, collector, 1% fee and fee address seen here. Coinbase’s public page confirms that separate historical session’s amount and receiver; DefiLlama independently attributes the operator to Coinbase Business. The live Coinbase page does not publish the operator/fee pair, so this is corroborated provider attribution. The incident merchant and customer remain unidentified.
Open the source-by-source assessment ↗The bridge signature recovers to the attacker-linked 3f701 key and commits to the amount, Base chain and 1332 recipient. On Base, a separate key authorized a Commerce payment. Capture paid 1,511.6607 USDC to receiver 5638 and charged a 15.2693 USDC fee.
The receiver’s next sweep sent 2,267.694 USDC to an address explorers label Coinbase 14. The sweep included 756.0333 USDC already there. It reaches a service address; it does not identify an exchange customer or prove that the payment recipient belongs to the attacker.
Balances in the ten-address tracked cluster at each pinned cutoff. Position-token inventories are outside this table.
| Chain | Wallet | Balance | Snapshot UTC |
|---|---|---|---|
| Ethereum | 0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6 | 0.5 ETH | 2026-10-30 17:46:23 |
| Ethereum | 0xc91ee0574a14446de200923729c349b9cae19b60 | 58.333930583210084939 ETH | 2026-10-30 17:46:23 |
| Ethereum | 0x3f7019221a925537dc20767c38e80a7127fb1ffa | 0.50824437123767711 ETH 21.517025 USDT | 2026-10-30 17:46:23 |
| Ethereum | 0x74e940e4eb470a9d8b78c5eb8919938041219897 | 0.000002085655144 ETH | 2026-10-30 17:46:23 |
| Ethereum | 0xe5e76a4d73f3bfb5cc9a8f53d4f8459fcac495f6 | 126.096675659426539853 ETH | 2026-10-30 17:46:23 |
| Ethereum | 0x9ab3c17b1a37886f1d702945fcf8016e3e549b18 | 6.917446E-7 ETH | 2026-10-30 17:46:23 |
| Polygon | 0x3f99139f1c5854bb628c2e576aaf638e99dffc18 | 4.8E-8 POL 11.020032 USDC.e | 2026-10-30 17:46:31 |
| Polygon | 0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6 | 15331308.287708954252254001 POL | 2026-10-30 17:46:31 |
| Polygon | 0x5392587814ce8c6af6789764f88e5e9ab0b9962c | 4295442 POL | 2026-10-30 17:46:31 |
| Polygon | 0xc91ee0574a14446de200923729c349b9cae19b60 | 4235982.731885163313955003 POL | 2026-10-30 17:46:31 |
| Polygon | 0x3f7019221a925537dc20767c38e80a7127fb1ffa | 3.052420374918193426 POL | 2026-10-30 17:46:31 |
| Polygon | 0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b | 4759.433599 pUSD | 2026-10-30 17:46:31 |
| Optimism | 0x3f7019221a925537dc20767c38e80a7127fb1ffa | 0.360967751344140708 ETH | 2026-10-30 17:46:29 |
Seven-chain review: Ethereum, Polygon, Base, Optimism, Arbitrum, BNB Chain and Avalanche. First six chain snapshots are 17:46:23–31 UTC; Avalanche is 17:56:07 UTC. Major reviewed attacker holdings are unchanged. Optimism’s 0.360967751344140708 ETH remainder reconciles exactly to its bridge receipts and fees. Open provenance ↗
Car → 5mTraderYes
111pUSD0x05c7aa20db6818ef565840478382dc857932366c6230307fa856d748c96e084dE044 → 5mTraderYes
333pUSD0x986cea209c2082dbed42ba1e52705ce2e283ef5e7c92f4eece776b86edc30caa5mTraderYes → 6d132
537pUSD0x927ce3e750e993c0eb22d135274733ef4dbc07c97c6dc37d856a4de4bed3a8f4Car → Polymarket Perps, creditCar signer
50,000pUSD0x94fdfeb0cd13c7b994dfdb3c414d7adb23ae6ba3d4869b96a3adf095fb743c5a3f701 → router → 3f701
0.70020298ETH → 1,548.447025USDT0xb7693fa1951570731d9f77451caafa013ff5c4af2ae4738f65b751144b59b0d63f701 authorizes Permit2 allowance
Unlimited USDT allowance0x6bd9b95e0c321a1e143fdbcbf731fafe7f868441b508d73dd43c954d5a9af34f3f701 → Across → Base recipient1332
1,526.93USDT0xe2ce0c202b3b396660c8ddacd5843ef161ee7f822c1e0038dfde824ad3d09c2eAcross → 1332
1,526.93USDC0xd76de27a568ac7d591dcfd5ac19dc207a287c17de95b60123a91c623c6023b641332 authorizes payment
1,526.93USDC0xd424133bf4d8052c51acdcb0bd547f8be7613c3e952a27ef5b0d827b8ef4391dToken store → receiver5638 + fee receiver
1,511.6607USDC net +15.2693fee0xd0aafc461c2092361a1fca4d784e66821d985aed7a2ba592dfcb8408130079b85638 → explorer-tagged Coinbase14
2,267.694USDC incl.756.0333prior balance0x0b81f92ca0795c955bda95fdf792fec74189283bf5b3810b43c7c6073a220f9d0x3e8379fa4e49648d88dc6c885abd776adbdc2132 → 0x08fe5bed47b87b5a3fb7d1c07eccb2d0d5bc5ff6
22 USDC0x62de5e27b0c32e0cb3a9ebd22bea4716be6aa1a5cfe9b75916ad7c0a04ef03fb0x08fe5bed47b87b5a3fb7d1c07eccb2d0d5bc5ff6 → 0x4cd00e387622c35bddb9b4c962c136462338bc31
22 USDC0x30dda475465108177241214b460b2780494321f71bd7b9daad653fbd7dbb531f0xf70da97812cb96acdf810712aa562db8dfa3dbef → 0x08fe5bed47b87b5a3fb7d1c07eccb2d0d5bc5ff6
22 USDC.e0xf40a3afaea00c719aa049daa843b5022c43e7a00d7bce36382c3f5e2a9a74b260x0000000000000000000000000000000000000000 → 0x6d13220445f0ab4f34e8e90ca5cdae8a372a64be
22 pUSD0x2015c80b7bfc8a86744999e7d2b116e1add242d5d99638ce9c29bcadf5bc8ef50x7c3db723f1d4d8cb9c550095203b686cb11e5c6b → 0xc011a7e12a19f7b1f670d46f03b03f3342e82dfb
111 pUSD0x6bb4df33bc0106f98e0f95f174c68fbbf4b9a498e88b424cbcde62f0ccadfe880xf70da97812cb96acdf810712aa562db8dfa3dbef → 0x6d13220445f0ab4f34e8e90ca5cdae8a372a64be
111 USDC0x8e7f37e28fb22ca9677f1d614f27f61bae16bf007dd862e54e9674d7430bba140xd36ec33c8bed5a9f7b6630855f1533455b98a418 → 0x6d13220445f0ab4f34e8e90ca5cdae8a372a64be
110.98186 USDC.e0xd66cbf01fbbb2d1785f003d1b5bad106f826f5210df298c940564747c05313bd0x0000000000000000000000000000000000000000 → 0x6d13220445f0ab4f34e8e90ca5cdae8a372a64be
110.98186 pUSD0x4671a3e41ce61bc8d5b103f917da2ef0720625023bfea82b60c83a5da553f8310xfee5be290d4a1a50caff611389ba2120a4095d78 → 0x7c3db723f1d4d8cb9c550095203b686cb11e5c6b
150 USDC0xdf6e4f76807d6a7f054e0d68abccbec0ced4a56e1d65f45d73a2ca47966144310x46c11f0c4b29a2626d786dd10147518b69b40650 → 0x1f64f2739a19fc5cdfd7c3f50c42463aa8983e82
0.007 ETH0xccf5f074eb38353aca273813b2e43c2f33abfbff08b7de2794705810217968f00x7c3db723f1d4d8cb9c550095203b686cb11e5c6b → 0x46c11f0c4b29a2626d786dd10147518b69b40650
150 USDC0xdd0ed89dfeba165308985d3d74590db23ac81be8a34f8c08a5db51c254249f060x5b176f0921fd5b06058e64697a3aa36eb1e67952 → 0x7c3db723f1d4d8cb9c550095203b686cb11e5c6b
109 USDC0x3e4966e0e3bf3c9b7affe92228d78f9f81ddc25e3335eff07ee068235eaead60Download this update’s evidence ↗
Download the earlier verified proof pack ↗ File hashes ↗
This frozen collector-based ledger records pUSD redemptions and position transfers. Its amounts describe observed transfers, before refunds; position tokens are listed separately and are not assigned a dollar loss here. It is not an exhaustive incident-wide victim count.
Download full CSV ↗| Source wallet | pUSD redeemed | Position transfer txs |
|---|