No verified
connection.
We checked every counterparty order in Car’s retained trades on the July meeting market and verified the first funding of 74e9, an Ethereum address on the proceeds route. Neither check produced a Car–drainer connection.
Follow the new checks ↘The native-ETH origin gap is closed.
The already-observed route runs 3f701 → 74e9 → E5. Actual transaction signatures now verify the first two senders. On October 29 at 18:36:47 UTC, 3f701 sent 19.32956478 ETH to 74e9. At 18:47:47, 74e9 forwarded 19.32951879 ETH to E5. E5 is the recipient here; this check recovers no new E5 action signature. First handoff ↗ · Forwarding ↗
A successful incoming-native-trace query from genesis through the preceding block returns no earlier credit, matching two contiguous partitions and positive controls at the first credit. The native account reconciles exactly, including fees and later incoming dust. Its 0.000002085655144 ETH closing balance belongs to the October 30, 08:59:23 UTC snapshot. It is a historical balance. Four events from two noncanonical token contracts reported 74e9 as sender; the actual outer signatures belong elsewhere. Those token events do not authenticate a native-ETH action by 74e9. Two zero-value transactions and a later tiny third-party credit are separately classified. Origin, signatures and exclusions ↗
Every retained July counterparty signature is recovered.
The complete checked condition contains 383 executed counterparty order appearances across 95 trade transactions, rather than only the seven highlighted trades. Replaying 332 standard-signature appearances and 51 nested contract-wallet signature appearances yields 172 distinct authorizing keys. The nested messages match the original application domain, order contents and type description. All 47 historical owner calls and 51 signature-validation calls corroborate the recovered keys. No authorization remains unresolved in this retained scope. Complete comparison ↗ · Nested-signature replay ↗
The address lists keep their different roles.
There are zero exact matches to the 18 unique attacker-comparison addresses, the selected 26 observed-profile/private-associate addresses, or the broader 117-address mixed inventory. The latter adds five verified financial endpoints missing from the earlier 112-address input. These are bounded comparison lists. They include different roles, including associates, public services and computed wallet formats; they are neither exhaustive networks nor lists of human ownership. Ordinary anonymous exchange matching would itself need further context. Classified comparison inputs ↗
The source and session questions remain open.
The newly recovered PredictFolio runtime adds historical code coverage. It contains none of the ten checked campaign markers; six referenced resources remain unrecovered. This supplies no malicious deployment or control connection. The missing evidence would bind an actual private payment or signing authority, the exact malicious artifact’s deployment access, or an authenticated client session to the incident. Deletion metadata and prior oracle disputes supply none of those links. Infrastructure result ↗ · Evidence requirements and gaps ↗
The original full cash account still matters.
The seven selected July 3 trades show +461.722780 pUSD cash. Complete condition activity through July 6, 05:16:35 UTC, block 89740000 instead nets −3,108.079358 pUSD: trading −10,229.295958, plus merges 7,121.216600. Small positions remain. These cash figures are not full profit calculations, and the new counterparty checks do not change them. Read the full condition account ↗
Open the actual route and the checked scopes.
The two arrows represent actual native-ETH transfers. Each card opens its source record.