A transfer.
A declared
recovery address.
E4 sent 0.1 ETH on Ethereum to the exact address listed as Polymarket’s asset-recovery address on Polygon. A second signed transaction carried a statement and no ETH.
Open the two transactions ↘Two separate E4-authorized transactions.
At 04:39:35 on October 31, E4 sent 0.1 ETH to 0x3dce0a29139a851da1dfca56af8e8a6440b4d952, carrying 1,201 opaque input bytes. At 04:44:47, it sent the same address 0 ETH with an 81-byte statement. The statement says responded.
and references the exact first transaction hash. Its wording establishes no recipient reply or conversation. Payment receipt ↗ · Statement receipt ↗
Two independent reconstructions recover the E4 key from both signed transactions and rebuild their complete transaction hashes. The signatures bind those exact actions. The first payload’s contents, encoding and purpose remain unidentified. Neither receipt emits logs; the retained traces contain no subcalls. Independent signature checks ↗ · Activity and bounded coverage ↗
The balances reconcile at a fixed historical block.
At 05:45:59 UTC, block 26,310,742, E4 holds 0.3997874672242106 ETH and the recipient holds 0.1 ETH. The checked starting 0.5 ETH equals the payment, 0.0002125327757894 ETH in combined fees, and E4’s remainder. These are balances at that recorded block, not live readings. The recipient has empty runtime and ordinary nonce zero in those Ethereum checks. Balance and gas reconciliation ↗
The declared recovery role is on Polygon.
Security Alliance’s primary Safe Harbor entry names the same address as Polymarket’s asset-recovery address on Polygon. Its linked onchain registration succeeded on October 19, 2024 at 00:49:53 UTC, well before this incident. The registered project name, address and chain are primary declaration data. They do not automatically extend that role to Ethereum. Registration receipt ↗ · Exact role and provenance ↗
A Polygon Safe with seven configured owners.
At the separate Polygon snapshot, October 31, 05:51:09 UTC, block 96,480,275, the address has a deployed 3-of-7 Safe. Its getters return seven owners, threshold three and version 1.3.0. The implementation’s runtime hash matches the official Safe deployment record. These current configured owners are separate from the 2024 registration caller. Pinned owners and runtime ↗
The original Polygon Safe was created on November 22, 2022 as 2-of-3. Its CREATE2 derivation and a read-only Ethereum factory simulation return the same target address. A hypothetical Ethereum deployment using that original initializer would start 2-of-3; current Polygon 3-of-7 settings would not automatically carry over. This is address and configuration verification, without an observed Ethereum deployment or proof of fund access. Original setup and read-only simulation ↗
The Safe, seven owner addresses and public implementation produce zero exact matches against the selected 26-address comparison, mixed 117-address inventory and five retained actually recovered attacker keys. Those inputs keep their different roles and are bounded comparisons, not exhaustive networks or human ownership lists. Role-specific comparisons ↗
What the new evidence establishes.
Empty Ethereum runtime and nonce zero do not identify a private-key account, establish recipient signing authority or prove that Polygon controls apply there. No Ethereum recipient action signature has been recovered. The full linked agreement PDF remains unrecovered, and registry update history is incomplete. The available facts establish no legal eligibility, negotiated return, recipient acceptance, session authorship, human controller or Car connection. Recovery-role findings and limits ↗
Open the transaction and the separate Polygon record.
The single arrow is the actual Ethereum payment. The Polygon panels describe a separate chain at its recorded block.