The new logs copy the old money trail.

Two lookalikes. Exact copied amounts.

At 19:05:33 and 19:20:31 UTC on October 31, two transactions emitted transfer logs that named the collector and E4 as senders. The destinations resemble the real wallets: their first four and last four hex characters match, while the middle differs. Each event copies the raw amount of an earlier real POL transfer exactly.

Both new events came from token contract 0x91b0232d85a33f0a2586b93980d7c0457d151b4e, rather than the canonical POL token. The transactions were signed by keys outside the ten established cluster addresses. The claimed sender, lookalike destination and amount were supplied in those signed calls. The pattern supports an address-poisoning interpretation: planting a misleading entry in a wallet’s transfer history. It does not establish who operates the lookalikes or connect them to Car.

Exact addresses, recovered signatures and copied-amount comparison ↗

Tornado: 105 withdrawals checked

We independently recovered C91’s signature on the 0.1 ETH deposit of October 29 at 20:02:23 UTC. Its Ethereum transaction count remained one through 19:27:47 UTC on October 31.

After that deposit, the same pool recorded 142 more deposits and 105 withdrawals to 76 different recipients. None of those withdrawal recipients or listed relayers matched the ten established cluster addresses. An exact search for the deposit’s unique commitment across Ethereum contracts returned only its original deposit in the checked window.

No withdrawal has been linked to C91. A later 0.1 ETH withdrawal is not enough to make that link. The deposit record remains stored even after a withdrawal, so its presence also cannot tell us whether this note has been spent. Deposit, pool events and exact-match tests ↗

A separate direct comparison found no exact recipient or listed-relayer match among those 105 withdrawals to the selected five Car financial keys, 34 market-counterparty keys or 77 financial addresses including counterparties. Market counterparties remain a separate comparison group. Direct Tornado-to-Car comparison ↗

The Car hypothesis was tested against signatures and payments

All 77 retained actor transactions were reconstructed and their signing keys recovered, extending the earlier 34-transaction collector audit. The four recovered actor keys did not match the five recovered keys in the selected Car financial records, the 34 separately verified market-counterparty keys, or the four June-campaign keys.

The selected direct payments, token transfers and 25 position-token handoffs produced no recipient link to the tested Car financial records. Twenty-four signed bridge-call trailers also produced no exact match in four retained Car funding and bridge sources. These are bounded tests; they establish no Car–attacker control or funding connection. Key and payment comparisons ↗ · Bridge-call comparisons ↗

A separate DNS incident supplied another wallet lead

GoPlus’s October 31 alert names a receiving Safe and its owner in the Flap/Kintsu DNS incident. A fresh BNB Chain check confirmed that 0x24497068ca4166ca32a04ae530ce00cf79755bd5 currently lists 0x33dfc810365193bff54326812d7df34b3e438da3 as its sole owner, with a one-signature threshold.

Neither address produced an exact match in the retained Polymarket actor, Car financial or June-campaign comparison sets. A similar DNS attack method does not establish a shared operator. Original GoPlus alert ↗ · Pinned owner check ↗ · Exact-address comparison ↗

We also compared the public keys in 64 returned Flap/Kintsu certificates with the retained DebugBear delivery certificate. None matched. The Flap certificate with the reported 23:53:03 validity start was among them; its key differed too. Both query responses had further pages that were not followed. This yields no certificate-key connection between the incidents. Certificate comparison and timing ↗

The checked funds remain in the same wallets

The 30 selected state fields were unchanged from 18:59 through 19:28:35 UTC on Ethereum and 19:28:42 on Polygon. The checked canonical-token, position-token and Polygon native-transfer event scopes show no new transfer in that interval. The two imitation logs are reported separately above.

The three main Polygon branches retain roughly 23.86 million POL; E5 retains 126.0967 ETH and C91 58.3339 ETH. The selling account retains 4,939.424699 pUSD. Fresh state, event coverage and gaps ↗

Download this evidence collection ↗Earlier funding chronology ↗Published file hashes ↗Download certificate and Tornado–Car appendix ↗