{
  "capturedUTC": "2026-10-30T18:29:12.899607+00:00",
  "question": "Do specific private/deposit endpoints from Car/3e837/46c financial history recur in actual known attacker-cluster transaction counterparties?",
  "result": "No exact overlap between the39 Car/3e837/46c private/deposit/service-reference candidates and actual attacker or associated-payment counterparties in the normalized cached evidence. Specific longstanding sharedCar-network financial endpoints are proven, but no drainer connection follows.",
  "candidateScope": {
    "total": 39,
    "specificPrivateDepositOrInboxCandidates": 35,
    "excludedProtocolServiceReferences": 4,
    "list": "car-exact-join-candidates.json",
    "origin": "Explicit outgoing/financial source endpoints from old86-lead/allegationCSV plus primaryverified historical Car funders. Oldlabels/totals are leads rather than ownership assertions."
  },
  "confirmedSharedEndpoint": {
    "address": "0xce523a3637da9ce7361cad128fcdfc79686ff187",
    "classification": "Specific shared receiving EOA with deposit-like forwarding to explorer-labeled MEXC services; exchange customer and exclusiveassignment unproven.",
    "CarProof": [
      {
        "transactionHash": "0xa9df9a280a95954c037205f2b3b2bc8a01f700816ad1f2787ff2dbb9dbf6ebd6",
        "metaNonce": 320,
        "recoveredSigner": "0x1f64f2739a19fc5cdfd7c3f50c42463aa8983e82"
      },
      {
        "transactionHash": "0x3a50724a7afd86a0504a840eda03beb27df9479aa4eeefa7d9bffbead4461b66",
        "metaNonce": 2072,
        "recoveredSigner": "0x1f64f2739a19fc5cdfd7c3f50c42463aa8983e82"
      }
    ],
    "sampleSuccessfulReceipts": 12,
    "edges": "verified-ce523-sample-edges.csv",
    "summary": "ce523-primary-proof-summary.json",
    "importantExamples": [
      {
        "chain": "Polygon",
        "UTC": "2024-10-04T17:51:58Z",
        "source": "Car proxy7c3",
        "asset": "nativeUSDC",
        "amount": "1.000007",
        "transactionHash": "0xa9df9a280a95954c037205f2b3b2bc8a01f700816ad1f2787ff2dbb9dbf6ebd6",
        "authorization": "ActualCar1f64 meta-nonce320. Exactdirecttokenrecipient andamount are in signedcalldata."
      },
      {
        "chain": "Polygon",
        "UTC": "2026-01-27T02:17:45Z",
        "source": "Car-signed swap route",
        "asset": "nativeUSDC",
        "amount": "9995.196058",
        "transactionHash": "0x3a50724a7afd86a0504a840eda03beb27df9479aa4eeefa7d9bffbead4461b66",
        "authorization": "ActualCar1f64 meta-nonce2072. ce523 appears in signedroute; actualoutput paid byf504liquidityservice. Do not label event sender asCarproxy or claim outputspecificamount fixed without route decoding."
      },
      {
        "chain": "Polygon",
        "UTC": "2025-01-19T21:44:58Z",
        "source": "3e837",
        "asset": "USDC.e",
        "amount": "750",
        "transactionHash": "0xbc7d1a0789fff9cf369ca98ea96b072f0e270a329c389427a8d0c06123d817e7"
      },
      {
        "chain": "Ethereum",
        "UTC": "2024-11-03T19:41:47Z",
        "source": "46c11",
        "asset": "USDT",
        "amount": "812.240181",
        "transactionHash": "0x3e9b25ae59d6bf481cfa68d312bc2cf7b8f256223ae4687a98baec5feb67e8f3"
      },
      {
        "chain": "Ethereum",
        "UTC": "2025-08-03T21:59:47Z",
        "source": "46c11",
        "asset": "ETH",
        "amount": "2.14",
        "transactionHash": "0xb211b7193ea5c9a4c3bf104875670786bfedc455c996200d316650511320f447"
      },
      {
        "chain": "Arbitrum",
        "UTC": "2026-09-02T18:03:29Z",
        "source": "3e837",
        "asset": "USDC",
        "amount": "5531",
        "transactionHash": "0x2aee4cb9ea9a2aca71dbee64cb902d200e50325ce092121b481a532ecfdc13b9"
      },
      {
        "chain": "Arbitrum",
        "UTC": "2026-09-02T18:04:31Z",
        "source": "ce523",
        "recipient": "0x9b64203878f24eb0cdf55c8c6fa7d08ba0cf77e5",
        "recipientRole": "Explorer-labeledMEXC10; pooledserviceexcluded",
        "asset": "USDC",
        "amount": "5531",
        "transactionHash": "0x41352ca2f40ae50f1877070b9dba0477d15c187b5a68e355a67d1c60b17b7dbb"
      }
    ]
  },
  "ce523PolygonCoverage": {
    "fromBlock": 0,
    "throughBlock": 96452588,
    "canonicalTokens": [
      "pUSDc011",
      "USDC.e2791",
      "nativeUSDC3c499"
    ],
    "incomingPositiveLogs": 63,
    "outgoingPositiveLogs": 57,
    "outgoingZeroLogsExcluded": 32,
    "zeroLogDetail": "32zero transfers to lookalike576b* addresses are not financial transfers and do not establish private counterparties.",
    "positiveSweepDestinations": [
      "0x576b81f0c21edbc920ad63feeeb2b0736b018a58",
      "0x51e3d44172868acc60d68ca99591ce4230bc75e0"
    ],
    "aggregateProof": "ce523-Polygon-collateral-summary.json"
  },
  "limits": [
    "Current state probes cover seven chains; the actual normalized cached transaction/event corpus has rows on Ethereum, Polygon, Optimism and Base only. It is not a complete seven-chain transaction-history exclusion.",
    "Repeatedexact financial destination within the Car network is not an attacker link.",
    "MEXC customer assignment, account access and human identities require evidence not available onchain here.",
    "Shared pooledexchange hotwallets, bridges, marketmakers, publicrelayers, routers, zero transfers, and addresssimilarity are excluded as common-control evidence.",
    "OldCSV claimed61Car payments and aggregate totals were not adopted; this pass proves the specificsample transactions and fullcanonicalPolygonendpointlogs.",
    "Queries that fail or receive429 are preserved as failures rather than negative findings."
  ],
  "cachedAttackerJoin": {
    "provenance": "Independent normalization by onward_trace, inspected from final saved artifacts.",
    "parsedCachedFiles": 1392,
    "normalizationFailures": [
      {
        "file": "car-resume-20261030/scope/relayhub-blockscout-smartcontract.json",
        "error": "Expecting value: line 1 column 1 (char 0)"
      }
    ],
    "normalizedRows": 3485,
    "uniqueCounterparties": 70,
    "actualCachedRowChains": {
      "1": 56,
      "137": 1149,
      "10": 2,
      "8453": 2278
    },
    "candidate39ExactMatches": 0,
    "Car344DerivedAndNewVerifiedFundingExactMatches": 0,
    "Car86OnlyMatch": {
      "0x4d97dcd97ec945f40cf65f87097ace5ea0476045": 25
    },
    "proofs": [
      "../attacker-counterparty-overlap/SUMMARY.json",
      "../attacker-counterparty-overlap/exact-join-matches.json",
      "../attacker-counterparty-overlap/actual-counterparty-address-set.json",
      "../attacker-counterparty-overlap/normalized-transaction-edges.json",
      "../attacker-counterparty-overlap/cache-coverage-manifest.json"
    ],
    "limits": [
      "This normalizes transaction-like objects and canonical transfer logs from cached primary proofs, not arbitrary address strings. It is not a fresh complete historical scan.",
      "Ordinary native, internal traces and native-event rows can describe the same movement; row totals must not be added as principal.",
      "Ordinary zero-value transactions are interactions, not positive financial funding.",
      "Unknown-token logs are quarantined and excluded from genuine canonical-asset counterparties.",
      "Route-associated payer/merchant/operator keys are included for joins but are not assigned attacker ownership.",
      "Current native/nonce/material balance checks cover seven chains; cached positive native/token histories are narrower.",
      "The large full lol canonical incoming/outgoing caches and155-distribution receipt cache were also parsed. A zero join still does not cover unknown addresses, unrecorded histories or offchain accounts."
    ]
  },
  "CarProviderRouteJoin": {
    "CarInitiatedRequests": 118,
    "separateIncomingRequestsToCar": 32,
    "outgoingStatusCounts": {
      "success": 115,
      "refund": 3
    },
    "distinctEVMRecipients": 22,
    "directRecipientMatchesToCoreOrAssociatedPaymentRoles": [],
    "recipientMatchesToActualCounterparties": [],
    "CarReferrers": {
      "funxyz|su4gnoxz14": 116,
      "None": 2
    },
    "attackerReferrers": {
      "relay.link": 24
    },
    "sameReferrers": [],
    "proof": "../attacker-counterparty-overlap/car-bridge-and-deposit-exact-join.json",
    "limits": [
      "The150-request older pagination capture ended withHTTP429 and a continuation; old all-time Car bridge history is not complete.",
      "Of150 cached requests,118 haveCar asuser and32 are incomingtoCar fromotherusers; do not silently treat all150 asCar-initiated.",
      "No transaction from a pooled solver/hot wallet implies shared customer control.",
      "A matching request recipient is a financial route association; no same-human conclusion follows without signature/customer deposit authority.",
      "Only cached request histories are inspected here; no contact or private account access."
    ]
  },
  "supplementaryPrimaryVerification": {
    "summary": "other-specific-candidate-proof-summary.json",
    "successfulReceipts": 10,
    "CarRecoveredAuthorizations": [
      {
        "hash": "0x7b7e59c0542ad1e212a4a2c277adf92f678ad545d3eaf3b848f3f869153aeb63",
        "recoveredSigner": "0x1f64f2739a19fc5cdfd7c3f50c42463aa8983e82",
        "metaNonce": 3506
      },
      {
        "hash": "0x566d4735e2d64a3565fd26005a0517cf8f6bc1abd5aab566acb86d987512baae",
        "recoveredSigner": "0x1f64f2739a19fc5cdfd7c3f50c42463aa8983e82",
        "metaNonce": 3507
      },
      {
        "hash": "0x14558e382e5bc465541fada8fcc9eaadcc1c81199696c541e7a561b50b459d27",
        "recoveredSigner": "0x1f64f2739a19fc5cdfd7c3f50c42463aa8983e82",
        "metaNonce": 2359
      },
      {
        "hash": "0x24969e5cb4cfcefb687d8b8c808b631afc12038185a060848357ba48f1337a56",
        "recoveredSigner": "0x1f64f2739a19fc5cdfd7c3f50c42463aa8983e82",
        "metaNonce": 1644
      }
    ],
    "financialRecipientConfidence": [
      "0507 is a proven 3e837 USDC recipient on Arbitrum; an exchange/customer assignment is unproven.",
      "f1e1 is a proven Car Relay payout recipient on Base; an exchange/customer assignment is unproven.",
      "3389 is a proven Car Relay payout recipient on Arbitrum; an exchange/customer assignment is unproven.",
      "c620 is a proven 3e837 11000 USDC recipient on Polygon; its identity is unproven."
    ],
    "shared4336Route": {
      "status": "3e837 pays11 canonicalUSDC on Arbitrum; two actual Car1f64 authorizations each spend11 USDC.e on Polygon through Relay. Successful Ethereum payout receipts confirm10.977743USDC and0.004317238611125110ETH to4336. Each payoutcalldata matches the orderID committed by the corresponding signedCar sourcecall.",
      "primaryPayoutProof": "Car-4336-two-Ethereum-payouts-raw.json",
      "metadataProof": "../attacker-counterparty-overlap/car-bridge-and-deposit-exact-join.json",
      "sourceUSDCe11": {
        "hash": "0x7b7e59c0542ad1e212a4a2c277adf92f678ad545d3eaf3b848f3f869153aeb63",
        "metaNonce": 3506,
        "orderID": "0xdfd37495b45f07d03740d63360cc01840ef7ace6f2081065e8dd27d110cde059"
      },
      "payoutUSDC": {
        "hash": "0xee2b7a43976e9237c94c93a045a0fbfc7cb4f5e76f4397629d803f7deb1a57b0",
        "amount": "10.977743"
      },
      "sourceUSDCe11Second": {
        "hash": "0x566d4735e2d64a3565fd26005a0517cf8f6bc1abd5aab566acb86d987512baae",
        "metaNonce": 3507,
        "orderID": "0x19be28ba997b051b5f4260b7822f4833548a42d7d3d2d593b34358d6f16fd15b"
      },
      "payoutETH": {
        "hash": "0x127035652f75aed9cf42c5a8bb212c4e6cfef1f3919297011ac636755fc8ec0f",
        "amount": "0.004317238611125110"
      },
      "limit": "This is a real shared financial recipient in the Car network, not an attacker match or proof of one human operator."
    },
    "failedRequestsPreserved": "Two supplemental Relay v2 requests returned429; two v3 orderID lookups required an API key and were not pursued. Cached provider data and canonical receipts closed the relevant two4336 routes."
  }
}