E044 history: a second shared recipient and five closed funding routes

History frozen at Polygon block 96,448,944, October 30, 2026, 16:47:52 UTC.
This establishes a larger financial network. It does not establish that Car
owns E044 or that the network operated the drainer.

CONTROL AND DEPLOYMENT

All 33 recovered wallet authorizations return the E044 key:
0xe04499be354b9596c3b8ac74d3100dd7a57fdd00. These comprise six legacy
RelayHub messages, nonces 0–5, and 27 DepositWallet batches, nonces 0–26.
They add 29 messages beyond the four recovered in the earlier frozen report.
No recovered E044 key matches the independently recovered attacker keys.

The public profile was created April 17 at 03:29:50.912924 UTC. The legacy
proxy edbf71d94c5997c27b06cbca2e0604c8e21b4f9d appeared eight seconds later,
at block 85,638,277, 03:29:58 UTC. Its code was empty at the parent block.
The successful setup transaction was:
https://polygonscan.com/tx/0x432f7f91c5f0131a4936703eddec8549d26195c5d77379b0e39c9b5304da69dd
Its actual RelayHub signature recovers E044, nonce 0. Another approval batch
followed four seconds later. Three more approval batches executed July 20;
nonce 5 migrated the collateral July 21. The legacy proxy does not expose
owner()/nonce() getters; authority is established by actual recovered messages.

Beacon wallet 0b46c19958d0032466eb3f2adb6e9d2b66cccd0b was deployed July 21
at 14:45:39 UTC, block 90,626,761:
https://polygonscan.com/tx/0xb61b7f4cafb6e274ed26e01623076d6a2dd746252b8a56ab80c4f1e93f6b338a
Code was empty at the parent block. Initialization assigns ownership from
zero to E044. Historical owner() at deployment and the frozen current getter
return E044. The full own-event history has only this initial ownership event.
No later ownership change was observed.

The beacon's 27 batches encode 53 calls. Nonce 0 sets approvals July 21 at
14:46:01. The last explicit batch, nonce 26, executes September 28 at 16:29:15.
This does not date the last CLOB signature, login or human activity: ordinary
exchange settlement uses a separate authorization path. The derived Safe and
UUPS formats have empty code; legacy and beacon formats are deployed.

COLLATERAL LEDGERS

Genesis queries cover pUSD, bridged USDC.e and native USDC in both directions.
They returned 714 entries, with one internal migration appearing in both
queries: 713 unique logs. Both ledgers reconcile to archive balances exactly.

Legacy: two incoming pUSD mints, 11 and 5,555 on July 20; one outgoing
5,566 pUSD migration July 21. Closing pUSD: zero.

Beacon: 300 incoming logs, 168,046.857023 pUSD; 411 outgoing logs,
162,929.094629 pUSD. Closing pUSD: 5,117.762394, zero difference.
The successful queries found no direct USDC.e or native-USDC transfer events
to or from these two wallets. This does not cover positions or other assets.

NEW SHARED RECIPIENT

Car sent 111 pUSD to cfc5462b4e0a023b7532ea01625e92c80f4e08d1 on August 6
at 19:15:39 UTC. Its actual RelayHub nonce 3354 signature recovers Car's 1f64:
https://polygonscan.com/tx/0x05c7aa20db6818ef565840478382dc857932366c6230307fa856d748c96e084d

E044 sent the same wallet 333 pUSD August 7 at 00:14:09 UTC. Its actual
batch nonce 6 signature independently recovers E044:
https://polygonscan.com/tx/0x986cea209c2082dbed42ba1e52705ce2e283ef5e7c92f4eece776b86edc30caa

The recipient sent 537 pUSD to 6d13220445f0ab4f34e8e90ca5cdae8a372a64be
August 8 at 13:00:37 UTC. Its actual batch nonce 4 signature recovers
7df8fbb45378e1b5f53b711ad4455ee38d893d11, matching its current owner getter:
https://polygonscan.com/tx/0x927ce3e750e993c0eb22d135274733ef4dbc07c97c6dc37d856a4de4bed3a8f4

These are successful direct transfers with no reverse position transfer.
Gamma currently names cfc546 “5mTraderYes,” with profile creation August 6
at 16:45:25.088628 UTC. The 6d132 destination is an existing research-directory
lead, not an authenticated Car account.

The recovered 7df8 owner and four derived formats have no exact match to the
86 earlier inputs, 344 derived addresses, 731 incident sources or ten known
attacker endpoints. The cfc beacon is deployed; the other three formats have
empty code. Both full-history collateral filters against the 86 inputs
succeeded, returning only Car's 111 payment and the recipient's 537 payment.
An exact-address nonmatch does not erase a financial edge: Car's payment is
verified even though the recipient was absent from the earlier directory.
Neither a payment nor different keys establish common human ownership.

FIVE COMPLETE POLYGON FUNDING ROUTES

Five later routes total 19,797.438732 USDC/pUSD, all on Polygon chain 137:
July 28 14:12:05 UTC: 32.001398
July 28 21:32:07 UTC: 2,999.989000
July 29 01:08:05 UTC: 2,373.696299
July 29 01:55:06 UTC: 4,399.990000
August 10 22:36:07 UTC: 9,991.762035

Each source transaction is an EIP-155 legacy transaction. Independent RLP
hash reconstruction and ecrecover return source 51e3:
0x51e3d44172868acc60d68ca99591ce4230bc75e0.
It sends native USDC to 8837591c311280a46b011014bab8ee52ab7b41ae. That
account deposits into Relay's 4cd00... contract, receives corresponding
USDC.e from f70da..., then mints pUSD for E044's beacon wallet.

For all five, the deposit event's 32-byte settlement nonce exactly matches
the corresponding payout calldata. All 20 receipts succeed. This closes the
routes with identifiers and actual transfer events, not amount/timing alone.
The first swap also has an official Relay API record confirming chain 137
to 137. Other Relay API requests returned 429; their failures are preserved.

Etherscan and Blockscan label source 51e3 “MEXC 8.” A third-party mirror of
a former MEXC address announcement also lists it for Polygon USDC. Current
original content could not be retrieved. The source signature proves payout
authority, not the exchange customer's identity or Car/E044 control of a
custody service.
https://etherscan.io/address/0x51e3d44172868acc60d68ca99591ce4230bc75e0

883759 and the earlier 87752 intermediary currently share an EIP-7702
implementation, e6cae83... . Shared code is not a shared signing key.
Their UserOperation signers were not recovered.

BOUNDS AND PRIMARY FILES

No recovered key in this addition matches the known operator keys. Ethereum's
Across SpokePoolPeriphery service address,
97ccdbea4632140639ad5ea9b944aa034eb15fd4, was checked as an exploratory
endpoint. It is absent from the 713-log E044 collateral ledger and the new
recipient's derived formats. This is a bounded Polygon endpoint comparison.
The Base payout recipient is 133243d447026345c2b368d7ffe435dbe3c566eb;
97cc is public protocol infrastructure, not that destination recipient.

A broader 676-transaction metadata fetch was rate-limited. Therefore, this
pass does not classify every other collateral counterparty as a private
funder. The quoted manual actions and routes have successful actual receipts.
No contact, login, signing request, transaction, payload execution or
private-key derivation was performed.

E044-HISTORY-SUMMARY.json
all-six-legacy-signatures-recovered.json
all-27-beacon-batch-signatures-recovered.json
333-network-two-signatures-recovered.json
five-native-usdc-source-signatures-recovered.json
five-complete-Polygon-USDC-Relay-pUSD-routes.json / .csv
complete-canonical-collateral-ledger.csv
333-recipient-derived-wallets-check.json
333-recipient-to86-genesis.json / 86-to333-recipient-genesis.json

The subsequent Across signature audit is separate:
ACROSS-PERMIT2-FINDINGS.txt
across-permit2-witness-signature-recovered.json
