A June payment.
A second wallet.

A public complaint cites a transfer from 0x520d8406d896cf179a265eb62f431b0859253b93 to 0xc29309bb2ce2f46bc888cfad1f630c01db278ce3. The successful receipt records 8.690148 pUSD at 09:46:40 on 25 June. C293 is the address named in the complaint; unauthorized purpose and its place in a larger campaign remain unproved.

Thirteen seconds later, an operation signed by the C293 key unwraps the 8.690148 pUSD into USDC.e. At 09:47:07 it deposits 8.690436 USDC.e with Relay. The extra 0.000288 USDC.e had arrived from the same source Safe at 09:46:38.

The retained Relay request explicitly pairs that deposit with a 09:47:10 native-USDC payout to 0x8234362ad17321cc81748b6a783b54c5eae4c4d5. Both sides are on Polygon. This is a conversion through a shared service.

The first conversion has an explicit Relay origin/payout association. For the second conversion, the retained receipts establish the separate transfer legs, amounts and chronology; a service-specific request binding was not recovered. The later 8234 signature directly commits to the final mint recipient and amount.

Full route, cash receipts and limits ↗ · Actual authorizations and receipt checks ↗

The final recipient is 0xe3c8bd89c4d91b6607df1ad115457803eb876ecc. The current official profile calls it Virtual-College, user 6271579, created 27 February 2026. Archived state at the June 25 mint and the current checked state both give the Safe one owner, 0x6e3c00847114ed5f4d37a0695110e8095cfb9ee7, with threshold one.

Four retained C293-to-8234 Relay conversions total 80.264498. In each sequence, an operation signed by 8234 later mints the same amount of pUSD to Safe E3c8:

The relationship has another dated payment: on 22 April at 16:11:52, the same Safe-owner key 6e3c signed a direct transfer of 212.61161316364178 POL to 8234. The transaction hash and actual signer were reconstructed.

The 8234 signatures authorize the precise mint beneficiary and amounts. Receipt of funds does not establish that the Safe owner controlled C293 or approved the receipt. The post gives no loss amount. The broader reported June $3M estimate is separate and is not bound to this transfer. Shared Relay, delegate or paymaster use does not establish a common operator.

Sixteen account operations, two delegations and native-funding signature ↗ · Earlier native funding ↗ · Official destination profile ↗

A separate account, 0x8528236e523925f096310d9a59c3cebbbb83771a, funded the October affected source 0x0121542f76e5e81d06a4301be03fdd9d31dc2023 before the incident. Its actual signatures authorize two conversions and two pUSD mint calls to that source. The two mints total 13,268.970589 pUSD.

All four account-operation signatures and the initial delegation authorization recover 8528 itself. Historical hash getters and a second RPC provider match the retained inputs and receipts. Fifty successful canonical-token queries found eight cash transfers in the stated window, reconciling from zero opening to zero closing cash.

This identifies the funding key’s actual authorizations. Who held that key, any custodial role and its relationship to source owner 2db7 remain unresolved. The newly verified origin of the 11,269.020589 Relay payout is traced below. These payments do not establish that Car funded a drainer.

Two funding paths, exact receipts and bounded ledger ↗ · Four account signatures and initial delegation ↗

The 11,269.020589 USDC paid to funding key 8528 on 28 October now has an exact upstream route. A signed withdrawal from 0x8dcbed1d8cf9d8b41817672b7de7101743c48b68 unwraps the same amount of pUSD and deposits the resulting USDC.e with Relay. The current official profile names this wallet evildexter, user 9937761, created 11 October at 16:40:57 UTC. Official profile ↗

At 13:46:28 UTC, the deposit receipt records 11,269.020589 USDC.e sent to Relay’s depository. At 13:46:29, Relay’s payout wallet sends 11,269.020589 native USDC to 0x8528236e523925f096310d9a59c3cebbbb83771a. Both are on Polygon. The exact onchain deposit identifier appears in both records: 0xc34d102a7b292d09364d971c1f34477f0eff6f2ee8352e4899f738688e43a9f1.

The actual deposit signature recovers 0x5e557bf612de99e76a72ed7b7bf0b882434d3746, matching the wallet’s historical owner getter and runtime. The batch commits to the deposit identifier; it does not name 8528 in plaintext. The matching identifier and amount bind the observed payout. The API parent request ID remains unresolved.

8528 then authorizes a same-chain conversion back into USDC.e and a 13:46:44 mint of 11,269.020589 pUSD to the known affected source 0121. Signed origin deposit ↗ · Matched payout ↗ · Full route and boundaries ↗ · Actual signature and historical owner ↗

A separate earlier series contains 49 bc44-authorized mints totaling 64,326.321819 pUSD to evildexter, from 11 October 16:56:36 to 28 October 13:00:26 UTC. All 49 signatures and historical operation-hash getters match. Cash is fungible; this does not assign the later withdrawal to a particular earlier credit. Earlier funding authorizations ↗

These are funding records for an affected source. They do not identify the new wallets as attackers or establish a Car relationship. The new observed endpoints and candidate address formats have no exact match against the retained 112-address Car inventory. Four-token cash reconciles to zero after the origin withdrawal; positions, other assets and net worth are outside that check.

Fresh checks retain their own limits.

The ten tracked incident addresses show no matching movement across the explicitly queried assets and events from the prior 03:44 snapshots through 04:14:47 UTC on Ethereum and 04:14:51 on Polygon, 31 October; 140 state values were unchanged. This is a bounded half-hour query, not an all-chain inactivity claim. Fixed blocks, queried assets and coverage ↗

The recovered June 7 PredictFolio homepage and nine referenced JavaScript resources archived April 23 contain no exact known October payload indicators; seven scripts remain unavailable, so historical site-wide behavior is unresolved. Archive scope and hashes ↗

Download the new evidence pack ↗

The buyer identified in the previous Raisi-market case uses Safe 0xe5ddf947d781fd3c6434e8f59391f28be69f3e45 and signer 0x7f3773c5ed56801ca9398f3018d5c2aa47b8af1a. Deployment state, the matched trade checkpoints and the current check retain that signer as the sole Safe owner. The queried control-event history contains the initial setup only.

On 18 May 2024, that same key signed an Arbitrum transaction spending 255 USDT and depositing 255.075493 USDC into an Across route. The matched Polygon fill delivered 254.980191 USDC to the same key. At 19:35:40, it sent that amount to its own Safe.

Arbitrum signed origin ↗ · Matched Polygon fill ↗ · Own Safe funding ↗ · Historical owner, actual signatures and funding route ↗

The earlier Car trade proves a real counterparty. This funding route does not establish that Car owned or funded the buyer. The buyer’s earlier Ethereum funding came from another key, whose human identity and relationship to the buyer remain unresolved.

The buyer lane queried direct Polygon USDC, USDC.e and pUSD transfers in both directions between its signer/Safe and the retained Car, October and June endpoint groups. The additional test against 8234, E3c8 and 6e3c also returned no matching transfers through block 96473940, 31 October 03:12:46 UTC. A positive control with the same large peer-list size recovered the known exchange settlement.

A broader check used all five buyer address formats against 27 June-route addresses: the three cash tokens and Polygon native-transfer events, both directions, returned zero matches. The indexed Ethereum/Optimism history exposed one shared Relay-depository use; no private destination binding was recovered.

Five buyer formats versus 27 June-route addresses ↗ · Buyer versus the new June endpoints ↗ · Known-settlement positive control ↗ · Broader buyer checks and retrieval limits ↗

A zero exact match or queried transfer count does not prove unrelated people or rule out every asset, chain, internal transfer or offchain relationship. Shared public services are not ownership evidence. No control, payment or coordination evidence here establishes Car’s involvement in a drain.

At 01:07:39 UTC on 31 October, a transaction authorized by Car’s actual key 0x1f64f2739a19fc5cdfd7c3f50c42463aa8983e82 converted 350,000 pUSD into a pair of outcome positions. The market asks: Will Alexandria Ocasio-Cortez win the 2028 Democratic presidential nomination?

The receipt delivers 350,000 YES and 350,000 NO shares to Car’s same wallet, 0x7c3db723f1d4d8cb9c550095203b686cb11e5c6b. Before the transaction it held 0.009335 YES and zero NO. Afterward it held 350,000.009335 YES and 350,000 NO; those balances were unchanged at the 03:19:12 UTC snapshot.

At that snapshot Car’s main wallet held 56,783.763186 pUSD. Its pUSD cash change over the checked window was −356,941.560283, including the 350,000 collateral split. The remaining cash change was −6,941.560283; that figure is not a profit-and-loss calculation.

The remaining cash change is fully accounted for: market-settlement cash totaled −10,351.268783 pUSD, a position merge returned 3,200.2 pUSD, and the official activity API labels credits of 203.8184 pUSD as REWARD and 5.6901 pUSD as YIELD. Receipt classifications and official activity labels ↗

Signed split and position receipt ↗ · Official market and outcome IDs ↗ · Actual authorization and before/after positions ↗

Eight-profile cash reconciliation and exact coverage ↗

The split converts collateral into complementary positions received by Car. It is not a cash-out to another wallet. The two share counts do not represent $700,000 in cash. The cash table excludes positions, native assets and offchain funds; neither the split nor the cash change establishes a drainer link.

A full check of the canonical Conditional Tokens contract on Polygon adds 721 transfer logs across 599 transactions for the four June-route addresses, from genesis through block 96475134, 31 October 03:42:37 UTC. Every transfer is receipt- and header-bound; 261 closing position balances reconcile. C293 and 8234 have no transfers in this canonical CTF scope.

One actual match involves notworthit, an account with earlier financing from Car. At 09:46:37 UTC on 25 June, Safe 0x520d8406d896cf179a265eb62f431b0859253b93 sells 10 YES shares for 0.53 pUSD. Deposit wallet 0x1b3f38e1be9bb1ad7ee10c86f5f333002d96b538 sells 10 complementary NO shares for 9.47 pUSD. The market asks: Will US withdraw from NATO before 2027?

Both orders sell into the exchange. The adapter burns the complementary positions, releases 10 USDC.e of collateral and mints 10 pUSD to the exchange. The exchange credits 0.53 pUSD to the source Safe and 9.47 pUSD to notworthit. The receipt contains no direct payment or share transfer from the source Safe to notworthit.

The actual source-order signature recovers 0x608f0d8d3525f3e21e0f5b7a0742a68c7dce12b5. The deposit-wallet order uses an ERC7739 nested signature recovering 0x685267a27a84f836048626ed6de5cd8290c66417. The historical wallet owner and signature-validation getters agree. Actual settlement receipt ↗ · Independent order, authorization and cash audit ↗

The same exact signed notworthit order has 15 retained fills, including five before this settlement. Its first observed fill is 07:26:29 UTC, 2 hours 20 minutes 8 seconds earlier. A June 22 timestamp appears inside the signed message; it is not an independently measured creation time. Earlier fill with the identical signed order ↗

The separate financing trail records eight Car-authorized transfers totaling 53,886 pUSD from 6–19 June to notworthit, followed by two owner-authorized returns totaling 48,454 pUSD on 7 August. These payments establish financing and returns. They do not establish that Car controlled the deposit wallet or its authorizing key. Earlier funding and return findings ↗ · Ten actual payment authorizations ↗

The source Safe already held 8.690148 pUSD before the five sales in the settlement block. Those sales add 0.958 pUSD, and 0.958 pUSD remains after the cited 8.690148 pUSD withdrawal. The later withdrawal cannot be uniquely assigned to the 0.53 pUSD from this particular fill.

The cited public complaint gives no loss amount. The broader June $3M estimate is separate and unbound to this transfer. These receipts show the normal complementary-position merge mechanism; they do not establish common control, coordination, theft intent or a causal Car–drainer relationship. This check covers the canonical Polygon CTF contract, with unpriced closing shares. It does not cover every ERC1155 contract, position ledger, chain or offchain asset.

Three further notworthit hits in an earlier batched receipt involve another counterparty; they are not additional direct matches with the four checked June-route addresses. Complete coverage and receipt-context limits ↗ · Classified position-transfer ledger ↗

Raw settlement transaction and receipt ↗ · Official outcome IDs and historical CTF binding ↗ · All ten signatures from the five source-sale transactions ↗ · Independent receipt and historical wallet getters ↗ · Retained financial RPC capsule ↗ · Complaint version and bounded public context ↗

Open the focused settlement map ↗ Download the position-audit evidence ZIP ↗

The evidence contains retained RPC replies, receipt/header bindings, Relay request records, dated profile and owner checks, exact query filters and offline public-signature verifiers. Each research lane keeps failed retrievals and its own coverage boundaries. No private keys or signing are involved.

Download the new evidence ZIP ↗

A causal relationship between Car and the drainer remains unproved.