Car’s comments.
A matched trade.

On 19 May 2024, while traders were discussing Iran’s president Ebrahim Raisi, Car’s Polymarket account claimed a conversation with a presidential spokesperson and suggested Raisi was alive and taking a short vacation. It later said he had walked away from the crash and that it was buying more NO shares.

The market was Will Iran President Raisi be found today? Here is the sequence, tied to the primary comments and settled trades:

Polymarket attributes these comments to user 0x1f64f2739a19fc5cdfd7c3f50c42463aa8983e82 and embeds Car’s known wallet 0x7c3db723f1d4d8cb9c550095203b686cb11e5c6b. The actual authorizations for the three highlighted trades recover to that same signer address.

Three trade authorizations and archived holding checks ↗ · All 54 matched trade cashflows ↗ · Full case chronology and context ↗ · Official market record ↗

In comment 33797, the account points to 0x7f3773c5ed56801ca9398f3018d5c2aa47b8af1a. The buyer’s actual order signature recovers to that address, and its proxy 0xe5ddf947d781fd3c6434e8f59391f28be69f3e45 received the 100.02 NO shares in the 23:10:52 settlement.

That is a concrete match between the public discussion and an executed trade. The account’s later reply includes the phrase:

“at the time I spreaded misinformation”

The thread also contains banter, sarcastic wording and competing refund requests. Its tone leaves room for more than one reading. The comment’s 89¢ sale reference differs from the matched 84¢ fill. Car was the maker: the buyer filled Car’s listed sell order. The records do not date when that order was posted or show what prompted the buyer.

The account’s claims and its reference to misinformation are preserved. Which specific item was false, whether the comments moved the price, whether the buyer relied on them and whether any refund happened remain unresolved. The wider returned market trade cash is negative. The records establish a profitable first pair, rather than a causal price impact or complete profit-and-loss account.

Named buyer’s actual authorization ↗ · Read the full first-party reply context ↗

At 21:26:31 UTC on 30 October, wallet 0x0121542f76e5e81d06a4301be03fdd9d31dc2023 redeemed collateral and sent 4,116.719567 USDC.e to the known collector 0x3f99139f1c5854bb628c2e576aaf638e99dffc18.

This source was already affected during the original incident. On 29 October at 17:40:38 it transferred positions in five token IDs to the collector. Eight seconds later, it redeemed 9,996.421369 pUSD; the resulting swap delivered 104,808.925298700895931499 POL to the collector.

It then received 9,996.42 pUSD on 29 October at 22:19:39 and 610.52 pUSD on 30 October at 18:21:10 from the same distributor. The new payment followed both credits. The receipts establish the payments and sequence; their purpose needs separate platform evidence.

All eight checked wallet batches, nonces 0–7, recover to 0x2db7fe00eca7f651e23339325bc31148c39f9ef3, matching the wallet’s historical owner field. The latest batch is nonce 7. Its deadline was 22:26:24 UTC; that does not date the signature. Execution after the platform’s fix can have several explanations and does not itself establish that the website remained compromised.

No exact match for this source, controller or outer relayer was found in the combined Car account and lead inventory: 112 unique addresses from the 40-format/key inventory and 88 leads. A valid signature establishes authorization by a key; informed user intent and the human operating that key remain separate questions.

New transfer receipt ↗ · Actual signed batch and collector transfer ↗ · Original incident, distributor credits and all eight batches ↗ · Complete exact-address comparison ↗

These fixed-block observations cover the known tracked addresses and listed assets. Each row keeps its chain’s cutoff.

Seven-chain fixed-block snapshot ↗

Polymarket’s 30 October, 20:07 UTC postmortem confirms that a replaced performance-monitoring script used active sessions to sell positions and move funds. The platform reports removing it, clearing caches, resetting sessions and adding integrity controls.

It says 95% of affected wallets across drained and goodwill categories were refunded in full as of that afternoon, and reports $3.9M returned: $2.7M plus $1.2M for pause-related losses. This notice contains no recipient wallet list or reimbursement transaction hashes.

These are different component records. Neither notice establishes the last malicious transfer or identifies the operator behind the collector.

Two primary notices, timestamps and exact source hashes ↗

A public drain allegation was already posted on 22 June, before Car’s 24 June accusation against Choice. The official 25 June vendor-breach statement names neither Choice nor Car. The June 22 report has not been independently bound to the exact June 25 consolidation cluster.

A separate normal-transaction lookup across seven reported June Ethereum addresses found only the standard USDC contract among exact inventory matches. It does not cover internal transfers, token logs or bridge customer identities. No payment, code or control link joins the commercial dispute to the June or October operator.

Primary post dates and chronology ↗ · Bounded Ethereum history and exact-address matches ↗

The Raisi case ties contemporaneous claims, later misinformation wording and a named buyer to a real signed trade. Price impact and reliance remain unproved. The fresh collector payment adds a verified source, signature and sequence to the money trail. A connection between Car and the drainer remains unestablished.

A separate public-source check found no exact known drainer identifiers in 27 current PredictFolio and Choice application resources. Car’s recovered June 25 post states he sold his PredictFolio stake; the legal transfer and any continuing access were not independently verified.

Current public-code check and its coverage ↗ · Recovered divestment statement and current operator footer ↗

Download the new evidence ↗