Where did the attacker’s money come from?
The visible money trail begins with stolen funds. Some transaction fees were paid by the systems submitting them. We have not independently established a financier who funded it before the theft. That leaves the initial compromise’s cost and whoever paid it unresolved.
The first visible money came from a victim
At 17:10:23 UTC on October 29, a victim’s funds were converted and roughly 1,957 POL reached the collector—the main receiving wallet. POL is Polygon’s coin; these are coin amounts, not dollar amounts. The wallet held no POL in the preceding block. This first observed credit was already part of the theft. It does not identify an outside sponsor. Initial funding proof ↗
Other addresses submitted withdrawals and paid their network fees. The selling account was also set up through a sponsored transaction. These addresses processed the transactions; that does not establish who financed the attack. Later transaction fees could be paid from the stolen proceeds. Transaction and deployment records ↗
On October 30, four tracked wallets also received 0.025 POL each with notices pointing to recovery messages. The sender was one of the verified signers of the Safe listed by SEAL as Polymarket’s recovery wallet. These later notices do not establish pre-attack financing; the encrypted message terms remain unread. Notice transfers ↗ · Recovery-wallet registry and signature link ↗
The proceeds were split three ways
Between 18:28 and 18:38 UTC on October 29, the collector sent 28,636,284.445005680443738570 POL into three branches. These amounts describe token movements, not a dollar loss total. Each box opens its transaction.
E4 then sent 3,282,275.71115973 POL onward to another wallet. Parts were swapped and moved between networks, including Optimism and Ethereum. One receiving wallet on Ethereum holds about 126.10 ETH; the C91 branch holds about 58.33 ETH. Large POL balances remain in the three original branches. Bridge provenance ↗ · Latest selected holdings ↗
One confirmed mixer deposit
At 20:02:23 UTC on October 29, C91 deposited 0.1 ETH into Tornado Cash. We have not linked a withdrawal to a particular recipient. This record does not establish that the rest of the proceeds were mixed. Confirmed deposit ↗
A separate trail sent 1,526.93 USDT through a bridge. It arrived on the Base network as USDC and went through a payment service. A different key authorized that payment; the purchase and customer remain unidentified. Payment-route evidence ↗
What remains visible now
The Polymarket account gfg44433 received and sold stolen bets. Its sampled cash balance is 4,939.424699 pUSD. It is a public account, not a real-world identity. Account record ↗
The holdings below are selected balances at 18:59:23 UTC on Ethereum and 18:59:25 on Polygon, October 31. Positions are outside this table; there is no combined stolen-value estimate.
Open all 12 selected holdings and wallet addresses
What we can infer—and what remains unknown
Inference: splitting funds, moving value between networks and testing a mixer fits an effort to move and obscure proceeds. It does not identify the person or an earlier backer. The retained public evidence establishes no Car-funding link. A separate Tornado-prefunding claim was not verified for this Polymarket incident. Claim check ↗
Open the funding chronology and source records ↗ · Download balances as CSV ↗ · Download this funding collection ↗