A monitoring script loaded from DebugBear’s CDN contained code to find an existing Polymarket trading client, inspect balances, sell positions or transfer shares, and route funds to the collector. The code was designed to use the logged-in session’s existing trading client and signing access. DebugBear acknowledged a security incident and asked customers to remove its RUM embed. The vendor’s original point of compromise remains undisclosed.
Eight public wallets. One account deliberately left out.
The earlier six-account list was incomplete. On September 1 at 22:11:06 UTC, Car posted a collection containing eight wallets. It adds flying-wheel and kyskyskyskys to his February list. X’s own syndication response retains the exact eight-address link; current Polymarket profiles and Safe owners match both additions.
He also says he removed one account because it was private. That account’s address is absent from the post. His separate “-Optimus” claim and the strongly connected lolzzzlol account remain active ownership leads.
A recurring recipient, the emergency transfer, and the money back.
0x7b259edf41df29db6916f9c0fdd672ddc334e4be received 13 verified preincident topups totalling 45,334 pUSD from Car. During the incident, Car sent it 750,000 pUSD; 753,333 pUSD later returned.
This account belongs prominently in the investigation. Its owner key is 0x2e6a087ab35aed7a9a146180f80adcb4b571f95d. A different key does not establish a different human operator. We have not located Car’s direct ownership admission for this wallet.
Another similarly named account, 15mmarketslol, received a Car-signed 333 pUSD transfer 48.4 seconds after its profile was created. Open that funding proof ↗
His later post puts slippage damage at about $12,000.
At 13:27:41 UTC on October 30, Car estimated roughly $12k of slippage losses and asked for compensation for foregone expected value. X’s own syndication and embedding endpoints preserve the statement under his established author ID.
That is a more specific claim than his original $800k drain post. It is his estimate, rather than an independently calculated loss or proof of a refund payment. The forced liquidation, the temporary 750,000 pUSD transfer and execution losses are distinct facts.
On April 2, 2025 at 17:58:44 UTC, his established Polymarket identity wrote: I proposed this, adding that he intended to push it through. The comment is on the Russia-sanctions market whose earlier YES proposal came from the 3e837 wallet.
Before a later YES proposal on the same question, Car’s key authorized 650 USDC.e to that wallet. The proposal followed 94 seconds later. This joins a direct public claim of involvement with signed funding and successful proposal receipts. It does not establish that the answer was dishonest or connect the wallet to the drainer.
The main drainer wallets have not sent funds onward.
The refreshed Ethereum, Polygon, Base and selected Optimism checks found no new tracked outgoing transaction or material-token movement. E5 still holds 126.0967 ETH; C91 holds 58.3339 ETH. Polygon’s three largest wallets retain about 23.86 million POL. The secondary Polymarket account holds 4,759.433599 pUSD.
Four wallets received 0.025 POL each with notices pointing to encrypted messages and reply instructions. The messages came from the exact Safe listed as Polymarket’s asset-recovery address in SEAL’s public registry; all three actual authorizers were recovered. The encrypted terms are unknown, and no attacker-signed reply was observed by the cutoff.
Eight named profiles, with wallets and signer keys.
The later September 1 disclosure adds flying-wheel and kyskyskyskys to the original six. The account page now shows all eight disclosed profiles, their keys and fresh checks of 40 addresses across seven chains.
The six-key 20:10 inventory is preserved in the earlier evidence pack. The expanded 280-row inventory has its own later fixed cutoffs.
Car funded an oracle proposer before it answered in favour of his position.
On April 22 at 17:55:48 UTC, Car’s established key authorized 1,555 USDC.e to 0x3e8379fa4e49648d88dc6c885abd776adbdc2132. Eight hours, 19 minutes and 30 seconds later, that wallet proposed YES on “US x Iran ceasefire extended by April 22, 2026?”
Car already held 44,785.664210 YES shares before the proposal. Another wallet disputed it 22 seconds later. The original oracle request settled at the ignore/retry sentinel; the market’s final payout is NO.
Car’s signed transfer 1,555 USDC.e→3e837 proposer 8h 19m 30s later: YES→External dispute 22 seconds later→Final market payout NO
This documents funding and a financial interest in the proposed answer. It does not establish a dishonest proposal, common ownership or a connection to the drainer. The wider oracle-count claims have not been independently reproduced.
These checks look for a private funding or control link between Car’s older or recent activity and the attacker’s trail.
SPECIFIC RECEIVING ADDRESS
Car, 3e837 and 46c paid the same address.
ce523…ff187 received their funds across Polygon, Arbitrum and Ethereum, then forwarded funds to MEXC-labelled addresses. The sampled transfers and Car’s authorizations are independently verified. An exchange customer identity is not established.
This endpoint and 38 other candidates had no match among 70 actual attacker/payment counterparties in the parsed cache.
Ethereum and Polygon: genesis through October 30, 18:31–18:32 UTC; five specified stablecoins, 92 investigative addresses against 15 route/payment endpoints, both directions. All 60 filters succeeded; five historical positive controls passed.
Base: October 28 through October 30, 18:46 UTC. All 52 USDC/USDbC filters succeeded, with no matching transfers. Optimism, Arbitrum, BNB Chain and Avalanche add 360 completed filters across 17 specified tokens, October 28 through October 30 at 18:57 UTC, also with no matches. These five chains have recent-window coverage; their lifetime histories are not fully scanned.
The five actual signatures recover his established key and bind 227,792.028898 pUSD to his own recipient. Changing the signed amount or recipient fails recovery to that key.
A separate global scan of 120,415 deposit/withdrawal events, from deployment through 18:36 UTC, found no unknown depositor crediting Car, no other withdrawal account paying him and no tested attacker/payment endpoint. Offchain internal book transfers are not exposed by these events.
The wallet behind the collector’s first observed POL inflow was associated with a profile created 51 days earlier. Its initial 4 pUSD funding traces through Relay to another established account, with historical controller and receipt checks.
The five participants did not match the tested Car inputs, derived addresses or specific deposit candidates. This check produced no evidence of a Car-funded pre-positioned seed.
Public accounts, bridge recipients and shared services
Thirteen profile/leaderboard records and 643 public comments produced no exact cross-group account-ID, handle, proxy or direct-reply match. Car’s middle comment history remains missing because the API rejects further pagination.
Of 150 cached Relay records, 118 are Car-as-user requests with 22 distinct EVM recipients; none matches the reviewed attacker/payment endpoints. Coverage runs from November 2025 to October 2026 and has an explicit pagination gap.
One real shared node is Relay’s payout address f70…3dbef: it served Car’s May 17 route and later paid the attacker’s C91 wallet. That establishes use of the same service infrastructure, not a private customer or signing-key link.
The 92-address set contains verified accounts, financial leads and service nodes. The 15-endpoint set contains ten established route wallets and five separately labelled payment/service addresses. Membership is not a claim that all addresses share an owner.
04
New leads worth following.
ATTACKER ACCOUNT
The collector has a current leaderboard label: retr544.
Polymarket’s own leaderboard returns this name for the main collector, 0x3f991…ffc18. An older Gamma response used tre54355 via a proxy binding. The current response has no user ID, so a same-user rename is unproven.
X now explicitly marks all three incident posts as author-deleted.
Fresh platform responses confirm author deletion for the original loss claim and frontend followup. A separate preserved rescue post says he moved roughly $700k to a friend who runs bots with him. That screenshot is marked edited; the version history is unknown.
Scroll to move through the chart. Use + to enlarge it. All wallet addresses are written in full inside the map.
06
Car: the older links and the latest transfer.
Another shared recipient.
Car sent 111 pUSD to 5mTraderYes on August 6. E044 sent it 333 pUSD the next day. The recipient then sent 537 pUSD to 0x6d132…a64be. All three signatures recover to their respective known keys.
E044 also funded Car and lolzzzlol before the incident. These are proven financial links. Car’s control of E044’s key has not been established.
The 750,000 pUSD transfer came back.
Car sent 750,000 pUSD to established recipient lolzzzlol during the incident. Later, 753,333 pUSD returned. Those funds cannot be counted as an outstanding $750k theft. His forced-sale claim needs a separate valuation: the chain verifies rapid liquidation, but gross proceeds do not measure the loss.
The new history closes a longer funding chain.
May 16:3e837…c2132 sent 22 USDC on Arbitrum through an intermediary and Relay. The route ended as the first 22 pUSD credit to 6d132…a64be. Four successful receipts and the matching bridge settlement bind the route.
May 17: Car put 111 pUSD through Relay to that same wallet. It received 111 native USDC, swapped it into USDC.e, then minted 110.981860 pUSD. Car’s actual signature and the recipient’s signed conversion batches are verified.
August: Car’s 111 pUSD was the first cash seed into 5mTraderYes. E044’s 333 pUSD was its only other external canonical collateral credit. The wallet also received 710 pUSD from position redemptions, spent 616.927670 pUSD in markets and sent 537 pUSD to 6d132, leaving 0.072330 pUSD. All 26 collateral receipts reconcile.
The two recipient wallets use distinct owner keys. We recovered all 17 explicit batch authorizations: 12 for 6d132 and five for 5mTraderYes. Their funding relationship is established; Car’s control of those keys remains unproven.
Older Ethereum link: gas in, 150 USDC back
On January 22, 2025, already-known funding lead 46c11…40650 sent Car’s signer 0.007 ETH. Forty-eight seconds later, Car’s key signed its only ordinary Ethereum transaction, transferring 150 USDC from his Ethereum proxy to that gas funder. The route is independently verified. It is historical activity, with no verified attacker connection.
We checked 404 direct settlement counterparties across 920 fills in the selected 82 SELL receipts. None of their wallet or claimed signer addresses exactly matched the 86-address Car lead set, its 344 derived addresses, the ten known attacker endpoints or the additional verified funding keys. Those third-party signer fields were not independently recovered.
The direct same-token BUY subset has 326 buyers, covering 518,814.839670 pUSD of trade consideration between 17:16:10 and 17:17:40 UTC. This excludes complementary-token settlement paths and Car’s maker-side sales. Every buyer/transaction group reconciles against genuine cash and share transfers.
3f701 1,526.93 USDT→Across bridge Base USDC→Captured payment 1,511.6607 net→Pooled sweep Coinbase 14 tag
NEW PROVIDER LEAD
The operator and fee pair match a Coinbase-hosted checkout path.
A public repository’s preserved checkout-challenge extract contains the exact payment operator, collector, 1% fee and fee address seen here. Coinbase’s public page confirms that separate historical session’s amount and receiver; DefiLlama independently attributes the operator to Coinbase Business. The live Coinbase page does not publish the operator/fee pair, so this is corroborated provider attribution. The incident merchant and customer remain unidentified.
The bridge signature recovers to the attacker-linked 3f701 key and commits to the amount, Base chain and 1332 recipient. On Base, a separate key authorized a Commerce payment. Capture paid 1,511.6607 USDC to receiver 5638 and charged a 15.2693 USDC fee.
The receiver’s next sweep sent 2,267.694 USDC to an address explorers label Coinbase 14. The sweep included 756.0333 USDC already there. It reaches a service address; it does not identify an exchange customer or prove that the payment recipient belongs to the attacker.
All nonzero tracked material balances · chain by chain
Balances in the ten-address tracked cluster at each pinned cutoff. Position-token inventories are outside this table.
The associated payment receiver also has older activity: its first ordinary transaction, on March 31, swept 3,019.5 USDC to an address Blockscan labels Coinbase 36. Its earlier incoming origin is unresolved, and this receiver is not established as attacker-owned. Open the old sweep and address-label evidence ↗
E5 · ETHEREUM126.0967 ETH
C91 · ETHEREUM58.3339 ETH
SECONDARY POLYMARKET ACCOUNT4,759.433599 pUSD
Seven-chain review: Ethereum, Polygon, Base, Optimism, Arbitrum, BNB Chain and Avalanche. Targeted Ethereum, Polygon, Base and selected Optimism checks run through 20:01:59–20:02:24 UTC. No tracked outgoing movement was found; four Polygon wallets each received 0.025 POL message notices. Other rows retain their own earlier cutoffs. Optimism’s 0.360967751344140708 ETH remainder reconciles exactly to its bridge receipts and fees. Open provenance ↗
This frozen collector-based ledger records pUSD redemptions and position transfers. Its amounts describe observed transfers, before refunds; position tokens are listed separately and are not assigned a dollar loss here. It is not an exhaustive incident-wide victim count.
