POLYMARKET / CAR · OLDER HISTORY AND FRESH TRANSACTIONS · 30 OCTOBER 2026

Another shared recipient, a deleted rescue explanation, and a new attacker payment trail

The older history adds a second wallet funded by both Car and E044. Car’s latest 50,000 pUSD movement goes to his own Polymarket Perps account. A separate attacker-linked branch crossed Ethereum to Base and funded a captured merchant payment, followed by a pooled sweep to an exchange-tagged address.

These findings establish funding and transaction paths. They do not establish that Car owns E044’s key or controlled the confirmed drainer wallets.

Open the 9,600 px clickable chart · Download the new proof pack · Primary transaction index · Vector chart PDF

1. A separate deleted Car post describes a rescue

A publisher-preserved screenshot shows Car reporting that he saved roughly $700,000 by transferring it to a friend with whom he runs trading bots, while another roughly $100,000 remained safe. The linked post is 2115881859704078520, separate from the two posts examined earlier.

X’s own syndication response explicitly states that this post was deleted by its author. Its ID encodes creation at 19:02:01.194 UTC on October 29. The screenshot is marked edited; we have no edit history or exact deletion time. The wording cannot be assumed to have been present in every earlier version.

The explanation is consistent with the already verified liquidation, 750,000 pUSD transfer to an established recipient and 753,333 pUSD later returned. It is Car’s reported account of events, not independent proof of his intent or the friend’s identity. The known cash branch should not be described as an outstanding 750,000 pUSD theft.

2. Older history adds another shared recipient

Both Car and the E044-controlled wallet paid 5mTraderYes, wallet cfc546…. Each signed call is a direct pUSD transfer, with no position transfer back in the same transaction. The recipient subsequently paid another wallet, 6d132….

The 111 payment recovers Car’s established 1f64… key, the 333 payment recovers E044, and the 537 payment recovers 5mTraderYes owner 7df8…. This is a second verified shared recipient, alongside lolzzzlol. It adds a financial relationship; it supplies no shared-key proof that Car owns the other accounts. The 6d132 wallet remains an address lead, not a verified Car account.

The E044 audit now covers its full legacy/beacon manual-batch history: 33 independently recovered authorizations, legacy nonces 0–5 and beacon nonces 0–26. The legacy wallet was deployed April 17; the beacon wallet was deployed July 21, followed by the verified 5,566 pUSD same-key migration. No later owner-change event was observed. The latest explicit beacon batch was September 28; this excludes neither later gasless order fills nor other activity outside those batch events.

Both wallets’ canonical collateral histories reconcile exactly: 713unique transfer logs, with the beacon closing at 5,117.762394 pUSD. Five additional deposits from July 28–August 10 total 19,797.438732 pUSD. All 20 source/swap/payout/mint receipts are successful, and settlement nonces bind the Relay input and payout legs. The source is an address explorers label MEXC8; this does not identify the exchange customer who requested those payouts.

3. Newest Car activity:50,000 pUSD into Polymarket Perps

At 01:59:12 UTC on October 30, Car’s key signed a 50,000 pUSD deposit to contract DCA4…. Its credited account is Car’s known signer 1f64…. The signed legacy nonce is 3910.

Polymarket’s funding documentation identifies the exact contract and deposit parameters. Archive RPC ties its actual implementation at the deposit block to the verified ExchangeV1 source. This is a Perps collateral deposit credited to Car, not a verified payment to a private peer. The source activity API calls it WITHDRAWAL because money left the prediction-market wallet.

Perps trading and account balances are maintained offchain. The public deposit therefore does not reveal Car’s subsequent trades, internal transfers or present Perps balance.

All 255 fresh collateral events were classified using 251 successful receipts and official activity records. Car’s cash ledger closes exactly: 705,174.396585 + 16,596.210410 − 302,867.116358=418,903.490637 pUSD. The 50,000 deposit is included in those debits; the rest of the outflow is market activity. No unexplained large incoming refund or compensation transfer appeared in these three wallets in the reviewed window.

4. A small attacker-linked branch reached a payment capture and exchange-tagged sweep

The Ethereum wallet 3f701… is already linked to the drained proceeds by the earlier cash trace. It made three new ordinary transactions: a 0.5 ETH transfer to the known E4 wallet, an ETH-to-USDT swap, and an unlimited USDT approval to Permit2. A separate relayed transaction then moved the USDT without increasing 3f701’s ordinary transaction nonce.

We independently recovered that Permit2 witness signature to 3f701. It commits to 1,526.93 USDT and Base recipient 1332…. Changing the recipient or destination-chain field fails recovery to the expected key. The bridge route is bound by the signature and the matching Across deposit ID, not inferred from timing or equal amounts.

The payment uses the Commerce Payments contracts published by Base. The 1332 payer authorization independently recovers to the 1332 key, which differs from 3f701 and the reviewed Car-network keys. Control of 1332 by the attacker has not been established. A Roundhouse address page and its appearance in unrelated Across documentation examples do not identify its owner.

The payment was captured, not left pending:1,511.6607 USDC went to the configured5638receiver and 15.2693 USDC was charged as a 1% fee. Getter proofs identify 47c5 as the pooled protocol token store. No same-payment refund, void or reclaim occurred through 16:54:49 UTC. Refundable-amount bookkeeping does not mean the captured funds remain in escrow.

The 5638 receiver’s first subsequent sweep is exact: 756.0333 USDC already present+1,511.6607specific payout=2,267.694 USDC sent to 20fe51…, leaving zero. Explorers label that destination Coinbase 14. This reaches an exchange-tagged service after pooling; it does not identify a customer or prove that the merchant receiver is attacker-controlled. Three zero-value lookalike-address transfers were excluded from the funds path.

5. Most reviewed attacker holdings did not move

From the previous cutoff through 16:48:18 UTC, all 35 Polygon log queries succeeded, with no gaps and no new collateral, native-POL or position transfers involving the ten known drainer endpoints or the collector’s derived proxy. The secondary Polymarket account still holds 4,759.433599 pUSD.

At16:48:23 UTC, the main Ethereum holding wallets still contained 126.096675659426539853 ETH (E5) and 58.333930583210084939 ETH (C91). The smaller 3f701 wallet held 0.508244371237677110 ETH and 21.517025 USDT; E4 held its new 0.5 ETH transfer. This report traces the small new USDT branch, not a cashout of the entire incident balance.

Public refund update

At14:37 UTC, the PolymarketTrade account reported 689 of 726 affected wallets fully refunded, with 37 still being verified, plus $1.19 million for 5,500 wallets affected by trading-pause losses or taken positions. It described a rounded $3.9 million total. These are the account’s reported payments and scope; they are not an independently reconciled onchain theft total or proof that Car received a refund.

What remains unproven

The evidence strengthens the pre-existing Car/E044 funding network and supplies a preserved explanation for the rescued cash. It also adds a cryptographically authorized attacker payment route. No recovered key or verified funding edge joins those two groups. Car’s ownership of E044 or 5mTraderYes, the identity behind the attacker keys, and the meaning of the original $800,000 loss claim remain unresolved.

Chart and evidence

Large clickable chart · 11 new transaction proofs · Older funding CSV · New route CSV · Proof pack

Complete E044 history · New shared-recipient signatures · Attacker bridge signature · Fresh Polygon reconciliation · Payment capture and sweep proofs · Deleted-post evidence · Perps implementation proof