An old position
became 20 pUSD.

What moved today.

At October 31, 13:03:13 UTC, this transaction redeemed positions for 20 holders. For secondary account 0x5a2764…730c0b, 20 outcome shares moved to AutoRedeemer and were burned. The collateral payout was wrapped into 20 pUSD minted to that same holder.

The wrapper also sent 20 USDC.e to its collateral reserve 0xc417fd…9db1 in log 567. The receipt accounts for both collateral and the pUSD mint. This converts an existing position; it supplies no additional victim loss. Event flow ↗

An operator account called the redeemer.

The decoded UserOperation sender is 0x9ac519…a4e32, calling AutoRedeemer’s redeemBinary. It is not a fresh UserOperation from the secondary account. The operator’s role gate was satisfied, and the secondary’s existing position-transfer approval was already true.

The secondary’s owner remains 0x054363…e1f74 and its deposit-wallet nonce remains 3 across the checked boundaries and snapshot. Published source sets the payout to the holder; this receipt mints to the secondary. AutoRedeemer’s checked implementation address matches the published deployment, without an independent source-to-bytecode rebuild. The person who triggered the automation remains unknown. Control and approval checks ↗

The operator’s signer remains unresolved.

At execution block 96497558, operator account 0x9ac519…a4e32 has a 61-byte delegate-proxy runtime. Its explicit implementation slot points to 0xbac849bb641841b44e965fb01a4bf5f074f84b4d. The explorer source pages were unavailable, and one exact Sourcify lookup returned no verification match or ABI. This identifies the proxy route, without establishing the account’s owner or signer. No owner getter was guessed and no authorizer-key match was recovered.

Runtime and implementation evidence ↗ · Verification-registry result ↗ · Operator-check appendix ↗

The earlier records for this asset.

On October 29, 20 shares moved from 0x442907…0fcbd to collector 0x3f9913…ffc18 at 17:31:01 UTC, then from the collector to the secondary at 17:48:47. Both receipts contain this exact token ID:

22857689191705902914703917548313316696021829594125732093031288909324812610612

The matched ID and amount do not establish uninterrupted custody between those records and today’s redemption. Two verified transfer receipts ↗

Open every step.

The fixed snapshot changed in one place.

At 14:12 UTC, 29 of 30 selected state values were unchanged. The secondary’s pUSD rose from 4,919.424699 to 4,939.424699. The 20 pUSD mint matches that delta. This was a fixed state and token-interval check, rather than a full cluster-history sweep. Snapshot scope ↗

The DNS records needed a re-audit.

Six retained October 29 DNS responses show different queried zone views at 18:28:06 UTC. These are newly reconciled records already held in the investigation. Their authoritative flags do not establish rightful control or a parent-delegation change. DNS contrast ↗

The matched certificate’s validity starts at 17:09:32; its embedded certificate-transparency timestamps are around 18:08. Those are different time fields. Neither dates the DNS takeover. Shared Cloudflare edge IPs reveal no origin server. Certificate chronology ↗

A separate business record.

The September 22 project post announces a planned Lattica collaboration for market intelligence and leveraged trading. It establishes a published business claim, with no ownership, payment or Car–attacker link.