The hack, the attacker and Car.
We have not identified the attacker’s real-world identity, and we have not proved Car was involved. We have traced stolen assets, checked his incident story and found a separate, concrete self-trading case.
The working thesis
The evidence supports a real attack through compromised website software. Car’s account underwent rapid selling, and a large transfer later came back. His original $800,000 headline has not been verified as a final loss. His earlier trading record gives us a concrete self-trading case to examine. We have not found the connection needed to say he organized the hack.
How the attack got in
The best-supported explanation is a supply-chain attack: malicious code arrived through DebugBear, a monitoring service loaded inside Polymarket. That gave the code a place inside a website people already trusted. It used people’s already logged-in sessions to act through their accounts. Users could be exposed simply by using the site. Polymarket’s postmortem ↗
“Collector” means the main receiving wallet. Stolen bets reached it, and some were moved into a Polymarket account called gfg44433 to sell. That gives us a public account and a money trail. It does not tell us the person behind them. Account record ↗ · Verified collector transactions ↗
What the newer leads tell us
The collector’s swaps contain Rabby-labelled route information and payments through Kyber and OpenOcean. We verified the actual transactions and payment mechanisms. These identify services and records worth checking; they do not identify the customer using them or the attacker. Shared use of a swap service does not make its other users accomplices. Service evidence ↗ · Expanded transaction register ↗
Car’s incident story needs separating into parts
The rapid liquidation was real. His account sold positions rapidly, producing about 677,000 pUSD in gross sale proceeds. pUSD is Polymarket’s cash token. Sale proceeds are money received from selling; they do not measure how much value he lost. The records alone do not establish who caused the sales. Liquidation assessment and transaction evidence ↗
His wallet also sent 750,000 pUSD to another account, lolzzzlol, that had received money from him months earlier. Later, 753,333 pUSD returned. That branch cannot be counted as a permanent 750,000 loss. The return does not establish his intent or prove the hack story was fabricated. Outgoing transfers ↗ · Returns ↗
On October 30, Car estimated about $12,000 of slippage: damage from rushed sales at worse prices. That is his estimate, not an independently calculated loss or proof of reimbursement. We still do not have a verified final loss calculation explaining his original $800,000 claim, the returned money and this later estimate. His later statement ↗
The surviving rescue-post screenshot is marked edited. The platform confirms author deletion, but the original wording and edit history remain missing. It cannot settle intent. Preserved post evidence ↗
The older self-trading case is real
On November 25, 2025, Car’s main account traded with another account he later publicly acknowledged using. They bought opposite sides of the same bet and closed all 28,000 paired positions about seven minutes later. Together, their money and bets ended where they started, while 840 USDC.e, a dollar token, shifted from his main account to the other account. We verified the trades and balances. This is concrete evidence of a self-trading pattern; its purpose and any reward benefit remain unproved. Verified case ↗ · Independent audit ↗
That deserves scrutiny. To connect Car to the hack, we would still need evidence tying him to the malicious code or control of the attacker’s funds. The investigation has not established that bridge.