34 signatures.
Three swap records.

Three transactions. The same fee address.

These records were executed on October 29, 2026. The new work decodes their signatures, route fields and actual payments. Each row below is a separate transaction.

The first and third swaps pay the fee directly from the collector. In the OpenOcean swap, the executor pays it. USDC.e and USDC are separate token contracts. The displayed fees are token amounts. New findings and prior records ↗

The source match now reaches two protocols.

The shared address is 0xcd6b980029e6e6e0733ac8ec3e02be9410d09799. Kyber records it as a fee receiver. The OpenOcean transaction includes it in the signed referrer field and pays it 24.644023 USDC.e. Official OpenOcean sources confirm the router, function and field names. Official protocol match ↗

That address also appears in Rabby’s official mobile Lending / ParaSwap configuration. This is a public service association. It does not identify a customer or establish who controls the address. Earlier Rabby source evidence ↗

Current generic Rabby swap code separately configures 0x39041f1b366fe33f9a5a79de5120f2aee2577ebc as SWAP_FEE_ADDRESS. The cd6b match is specifically in Lending / ParaSwap. This current-source difference neither authenticates nor excludes historical or backend-selected Rabby use. Current code path and fee configurations ↗

The new Kyber RouteID is 94b1e8b9llJCxoVb:ddf9d1d8pw9ChIjj. Its Source: rabby label and route bytes are bound to the collector’s signature and repeated in the event. They are caller-provided metadata, rather than an authenticated login or identity record. Exact bytes and event ↗

A signed instruction names another recipient.

The OpenOcean executor sent 679.910591174725921613 POL to 0x3692dea4346c95eb3957d8022c40373ab2a21369. That address appears inside call 8 of the collector-signed transaction, at calldata bytes 4948–4967. The receipt records the payment in log 191.

The same execution unwraps 103,050.345845461353600508 POL: 102,370.435254286627678895 goes to the collector and 679.910591174725921613 to this other recipient. Signed parameter and payment proof ↗

The executor’s code at the transaction block matches the runtime we analyzed. Its payment path sends the balance above the signed guaranteed amount to the encoded recipient: 103,050.345845461353600508 − 102,370.435254286627678895 = 679.910591174725921613 POL. This explains the extra payout. The recipient’s owner and business identity remain unresolved. Payment mechanism and receipt ↗ · Static bytecode proof ↗ · Historical code match ↗

The executor was deployed on June 24, 2026. Its creator key also signed the creation of an Ethereum router listed in OpenOcean’s official documentation. Both creation signatures and resulting contract addresses verify. OpenOcean deployment association ↗

The exact executor-to-recipient payment pair appears in 15 transactions before the collector’s swap: 14 before the first retained drain and one during it. Three earlier examples, at 09:43:05, 09:43:17 and 10:08:59 UTC, have three distinct verified outer signing keys. This establishes a preexisting payment pattern. Deployment and earlier-payment proof ↗ · Exact chronology ↗

Open each transaction’s trail.

Every direct transaction in the register.

The collector is 0x3f99139f1c5854bb628c2e576aaf638e99dffc18. A nonce is its ordinary transaction counter. The verified sequence runs from 0 through 33: three approvals, 25 outcome-share transfers, three swaps and three native POL sends. We rebuilt 33 type-2 transactions and one legacy transaction; every signature recovers the collector. Full signature and transaction index ↗

The known selling account is gfg44433, deposit wallet 0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b. Retained public profile ↗. The new full RouteID returned no match in the bounded retained Car-record check. This pass establishes no Car–attacker control link. Exact identifier check ↗

No matching transactions.

The separate October 31 check.

The latest pinned sample is 18:13:23 UTC on Ethereum and 18:13:27 on Polygon. All 30 selected state fields match the 17:44 sample. The selling account’s sampled balance is 4,939.424699 pUSD. State comparison ↗

The activity checks cover 17:00–17:44 UTC and identified no new movements in their successful scopes. The later state sample does not rule out intervening activity. Ethereum’s broad all-contract transfer check has uncovered ranges, so the successful checks do not establish complete token inactivity. Latest scope and balances ↗ · Exact interval coverage ↗ · Separate payment-route check ↗