Funding origin and later statements —31October2026

The new onchain route traces funding INTO an affected Polymarket account.
It does not identify attacker financing or a Car-controlled wallet.

On28October at13:46:28UTC, DepositWallet8dcb (current public profile name
evildexter) unwrapped11,269.020589pUSD intoUSDC.e and deposited it toRelay.
The exact signed c34d deposit identifier is also appended to the nativeUSDC
payout to8528 one second later on the SAME chain137. The service API parent
request ID remains unknown; the onchain deposit match supplies the linkage.
The actual deposit authorizer is5e55, matching historical owner/runtime.

Forty-nine earlier actual bc44 authorizations funded8dcb with64,326.321819
pUSD. Their signatures, successful emitted hashes and historical hash-getter
responses match. Four unrelated operations in shared outer bundles are not
attributed to the funding key. The final11,269 cannot be earmarked to one
particular earlier fungible credit.738 specified-token logs reconcile to
zero closing cash across four tokens; this is not the account's net worth.
The new keys and ten computed formats have zero exact matches in the retained
Car112 inventory. Computed undeployed formats are candidates, not observed
accounts. Shared public adapters and delegation code do not establish control.

Tracked attacker monitoring covers Ethereum03:44:35–04:14:47UTC and Polygon
03:44:48–04:14:51UTC at fixed blocks.140 values are unchanged.36 explicit
cash/native/CTF/emitted-event queries return no matches, and each full query
matches two contiguous partitions. This is not all-chain/all-asset inactivity.

A separate public Discord archive ATTRIBUTES four later statements to a
Car-labelled user. Its displayed China time was normalized using exactUTC
attributes and message-ID timestamps. Agreement across views of this same
archive is internal consistency, not independent authentication. The official
message page returned an app shell; the API returned401. No authentication
was attempted. Primary message content and author binding remain unavailable.

The initial800k X statement is preserved in a FxTwitter-style mirror response
and publisher quotations. Its initial raw retrieval time/HTTP were not saved;
no currently recovered first-party platform body is claimed. The archive's
later20k account is an attributed claim, not a reconciled loss. Drained assets
and permanent loss are different concepts. These wordings alone do not prove
a literal contradiction, fraud or dishonest intent. The referral context is
chronological adjacency, not a recovered formal reply edge. Other users'
accusations are not factual findings. Only six words from the archive are
quoted; full pages/messages/translated summaries remain local.

Historical infrastructure checks recovered June7 PredictFolio HTML and nine
referenced resources archived April23. Seven resources remain unavailable.
Zero exact payload indicators in the recovered subset is not a complete clean
bill. Public search coverage is separately documented. No vendor-access or
code-control relationship to the drainer was found.

VERIFY_ALL.py checks all package hashes and JSON/Python syntax, then replays
retained public financial signatures, hashes, receipts, headers, query scopes,
and exact declared metadata with sockets and DNS disabled. It does not prove
chain consensus or authenticate omitted social source bodies. The independent
audits record their own source hashes and boundaries. No signing or broadcast.

Run: python3 VERIFY_ALL.py

All preceding proof archives and the historical398-ID register are preserved.
No Car-drainer causal/control/payment/coordination relationship is established.
