$LEGSRUG OPERATION$2.6M
15 linked wallets took 81% of supply
$CRUMBSRUG OPERATION$2.4M
25 linked wallets took 83% of supply
$STRATTONBUNDLED$1.9M*
10 linked wallets took 65% of supply
$PINKRUG OPERATION$1.1M
19 linked wallets took 81% of supply
fable
Fable Intelligence
Report 01 · data as of October 3, 2026
On-chain investigation · Robinhood Chain

Shedding light on the dark trenches

Every launch on Pons and the other launchpads on Robinhood Chain: deployer histories, bundles, wallet clusters, liquidity flows and promotion networks, with the on-chain evidence for each claim.
664,689
launches checked112 factories, every one since the first, plus 1,217,062 Uniswap-launched tokens
115,919
proven bundles107,591 among the factory launches, 8,328 among 1,217,062 Uniswap-launched tokens
$110.6M
taken by the bundlesnet of cost, a floor. $61.1M on Pons-style launches. $49.5M on Uniswap-launched tokens.
Amounts are net of the bundle's own cost and leave creator fees out. Every total is a floor. * Quoted in SPY: flows are converted at the median price of the quote token, an assumed rate (see Scope and method).
@FableDotMarketData as of Oct 3 7:29 UTC · every claim links to its evidence
Key findings

What the chain shows

Seven numbers from the full dataset. Each one is backed by transactions listed in the sections that follow.

01
115,91916.2% of the 664,689 factory launches
proven bundles: 107,591 among the factory launches and 8,328 among 1,217,062 Uniswap-launched tokens. 48,816 are major bundles: 3 or more linked wallets together holding 20% or more of supply at launch.Read more
02
$110.6M44,305 ETH net
was taken by the bundle wallets and the wallets they passed tokens to, after their own cost, measured on 48,900 launches: $61.1M (24,532 ETH) on Pons-style launches and $49.5M (19,772 ETH) on Uniswap-launched tokens. 2,923 ETH of that is one token, WOOD: 2,753 ETH is the linked wallets' own selling, chain-checked, and the hand-off remainder is not replayed. It is a floor. On the tokens they bundled, they took 19% of the ETH sold out once wash volume is removed.Read more
03
70%2,751 launches
of that net came from bundles that sold slowly: 90% of their holdings left more than 15 minutes after launch. On Pons-style launches alone it is 49% (2,510 launches, 11,918 ETH).Read more
04
983,497 ETH, 8% of net
launches extracted money while the chart never fell more than 15% in any hour: 71 on Pons-style launches (408 ETH) and the rest on Uniswap-launched tokens. The extraction was real and the chart never showed it.Read more
05
3,708$45.4M extracted
launches rugged: the linked wallets exited 95% or more of their holdings and the price collapsed. The median first sell came 9 seconds after launch.Read more
06
137of 1,294 multi-deployer operations
operations link deployers through shared funding, signers and bundle transactions and contain a rugged launch: these are the threat actors. The other 1,157 multi-deployer operations are bundler-linked groups with no rug evidence. The largest hand-compiled case file runs 31 launches.Read more
07
99%398 of 403 posts
judged as promoting a launch later classed as rugged were published after the bundle wallets had already started selling.Read more
Scope and method

What was checked, and how a link is proven

664,689 launches, 386,627 deployers, four pillars. Every table in this report is computed from our own index of the chain, and every claim links to its evidence.

DatasetSizeCoverage
Launches664,689112 factories that emit the Pons TokenLaunched event, Jul 29, 2026 to Oct 3 7:29 UTC. Duplicate rows removed.
Uniswap-launched tokens1,217,062First-pool launches on Uniswap v2 (274,168), v3 (444,189) and v4 (498,705) examined for bundles; 8,328 carry a proven bundle. They are not among the factory launches above.
Ledger snapshotOct 3 7:29 UTCLaunch outcomes and deployers are as of this time. The bundle table is as of Oct 3 7:29 UTC. Trade data after the snapshot is not included.
Deployers386,627Every creator address, with outcome per launch.
Trades448M rowsEvery swap on bonding curves and pools of these launches. Logs are complete from genesis.
Token transfers1.63B rowsEvery ERC-20 transfer, from genesis to head.
Transaction history159M rowsSender, recipient, value and selector. Continuous from block 62,398,000 (Sep 14, 2026); the history before it is still loading. Operations older than that are marked partial.
Native ETH moves38M rowsTop-level ETH transfers including L1 deposits. Still filling toward genesis, so money trails older than the transaction floor are partial.
Wallet clusters3,297Frozen run built 2026-10-03 07:10:30 UTC, with the final history edges: 1,294 operations link 2 or more deployers (412 high, 882 medium confidence). 137 of them contain a rugged launch and are called threat actors; the other 1,157 are bundler-linked groups with no rug evidence. 2,003 are single deployers.
X posts49,67010,953 of them carry a contract address. From 5,161 accounts, collected by Fable's own crawler.
Solana68,389Separate from every figure above: launches on pump.fun, Meteora DBC, Raydium LaunchLab in a 28.8-hour window (Oct 2, 2026 07:14 UTC to Oct 3, 2026 12:00 UTC) from the Solana index Fable runs itself. It is a day of activity, not the history of Solana. Only rug_operation launches carry a money figure.
PILLAR 01
Deployer histories

Every launch by every creator address, with outcome, ETH in and out, and dates.

PILLAR 02
Wallet clusters

Deployers joined into operations only by links that carry a transaction hash.

PILLAR 03
Liquidity flows

Where extracted ETH went: bridged out, exchange-style deposits, recycled into launches, parked.

PILLAR 04
Promotion networks

Which X accounts posted a launch's contract, when, and what the bundle wallets were doing at that moment.

How a link is proven

A wallet is linked to a launch or to another wallet only by an on-chain fact that a reader can open. Links come in two strengths.

Strong links

  • The creator funded the bundle wallets (transfer hashes).
  • One transaction delivered tokens to the bundle wallets.
  • One signer sent the bundle transactions across launches.
  • A buy happened inside the launch transaction.

Weak links

  • The creator declared the wallets as snipe-tax exempt, a list that Pons publishes on chain in the launch transaction.
  • A fee recipient or bundler helper contract is shared.
  • Weak links alone never merge operations. They need a second independent kind to agree.

Hubs never join anything. Routers, factories, bonding curves, pools, bridges, exchange-style wallets, WETH, multisenders, volume bots and any wallet that touches thousands of unrelated wallets are excluded from linking, so one hub cannot glue hundreds of thousands of deployers into one false operation. The hub list holds 11,723 addresses, each with its degree count.

An operation is shown only with a confidence level. High means strong links alone connect all the deployers. Medium means at least one join between deployer groups rests on two independent weak kinds agreeing. Low is a single deployer and is reported as a deployer history, not an operation. The strong and weak link counts on each card are how many links of each strength were used inside the operation.

Definitions used throughout

Bundle
Linked wallets that hold supply from the launch. Major: 3 or more wallets together holding 20% or more of supply. Minor: a proven link, 2 or more wallets, 1% or more together. A wallet below 0.01% of supply is dropped.
Net extracted
ETH the bundle and the wallets it passed tokens to received from selling, minus the ETH they paid in, trading flows only (curve, V2, V3 and Pons V4 pools). Round trips are netted. Creator fee claims are separate and excluded. It is a floor.
Rugged
Tier A: a major bundle sold its first tokens within one hour, exited 95% or more of its holdings, and the price fell 95% or more from peak. Tier B: the detector's rug-operation verdict with the price at 50% or less of peak.
Sell style
Dump: 90% of holdings gone within 15 minutes. Drip: slower. Holding: still holds 50% or more of peak.
Quiet extraction
Net above 0.5 ETH, a measured price series, and no rolling hour with a fall of more than 15%.
Promotion
A post counts once. It is promotion only when judged as promoting a launch, or when it carries a paid disclosure. Warnings, neutral posts, unrelated posts, disputed judgements and posts not yet judged never count.
Traffic light
Green: no proven link. Amber: a partial link. Red: a bundle with 3 or more linked wallets that together hold 20% or more of supply.

Independent verification

Samples were drawn at random from our tables, then every claim was rebuilt from public Robinhood Chain RPC nodes (receipts, logs and call traces) without reading our index. 135 items were checked in two rounds: the first run, then a recheck after the bundle tables were rebuilt. An item that was not checked is counted as not checked, never as a pass. Run 2026-10-03 09:45 UTC.

34 of 40
bundles, first run40 sampled across dump, drip, minor, quiet and holding. The 6 failures all pass after the rebuild (6 of 6).
28 of 31
bundles, recheck31 bundles re-read from the rebuilt tables. The 3 that differ are off by 3 seconds on the first-sell second; sell style and exit times match.
14 of 14
Uniswap-launched ETH figuresReplayed on chain: 10 random plus the top 5 by net ETH, then 25 of 30 more in a night check. 1 not replayed in round one (WOOD, checked separately).
15 of 15
rugs confirmedLaunch, exit and price collapse rebuilt from chain events.
30 of 30
promotion posts confirmedThe contract is in the post text. The first-sell timing matches on 20 of 20 checked.
19 of 19
operation links confirmedTwo links per operation, hashes opened.
5 of 5
bundles promoted to majorThe rebuilt rule counts wallets that bought after block +50. Each promotion matches the chain.
After the rebuild, every published per-wallet share matches that wallet's chain peak: 31 bundles sampled, largest gap 0.000 percentage points. The first-run failures came from counting only the first 50 blocks of the launch window.
3 launches dropped out of the rugged class in the rebuild. The chain confirms the drop: their linked wallets did dump, but the price never fell 95% from its peak.
ETH in and out reproduce from chain events within 2.04% on all 31 checked bundles once the wallets the bundle passed tokens to are included. That is why money is described as taken by the bundle and the wallets it passed tokens to.
The Uniswap-launched ETH total is checked on chain in two rounds. Its value is concentrated: 8,236 of 18,502 ETH sit in ten rows, so the five largest rows were replayed as well as a random ten. The first round replayed 10 random rows and the top 5 by net ETH. A second, independent night check sampled 30 more rows: 25 pass, and the sampled net is 1.3% below the chain figure. The 5 that differ are explained: four v3 launches whose ETH in includes the creator's liquidity seed (net understated), and one stale ledger row. The largest row, WOOD, was checked separately: 2,753 of its 2,923 ETH is the linked wallets' own selling, and 2 of those sells were re-read on chain and equal the index to 4 decimals. Not chain-checked: rows with hand-off wallets (129 rows, 4,139 ETH, 22%) and rows quoted in another token (253 rows, 1,167 ETH, 6%).
Timing of the first insider sell was confirmed within 60 seconds on 20 of 20 checked posts (10 not checked).
Pons guard: PASS. No Pons contract or keeper is a subject of this report.
One token, COBIE, is left out of every volume and wash figure: its 14.4M ETH of swap volume is flash-accounting round trips in a pool with dust liquidity, confirmed from the call trace. Nothing was traded or spent.

Coverage gaps, stated plainly

Transaction history before block 62,398,000 (Sep 14, 2026) is still loading. Funding links need it, so operations older than that are marked partial. This page is rebuilt as the history fills toward genesis.
Money is measured for 48,900 of 115,919 proven bundles. The rest are mostly thin minor sets where no dump was computed, so every ETH total is a floor.
Launches quoted in a token such as a stock token or a stablecoin are converted to ETH at the median price of that token. The volumes were verified in the token's units; the conversion rate itself is assumed.
Trades inside a transaction routed through a router carry no end-user address, so per-wallet sells are read only for wallets in a proven set.
Fee-claim history starts at block 34.2M. Creators active before that have partial claims.
Wallet linkage is evidence of coordination, not of identity. No wallet or operation in this report is tied to a named person.
The numbers

Launches, outcomes and traffic lights

664,689 launches from 112 factories between Jul 29, 2026 and Oct 3, 2026. Pons is a legitimate launchpad. These are measurements of what gets launched on it, and Pons contracts and keepers are infrastructure, never subjects of this report.

664,689
launches112 factories
386,627
deployerscreator addresses
47,417
red launches7.1% of all
3,708
rugged$45.4M taken

Launches per day, by traffic light

Green: no proven linkAmber: partial linkRed: major bundleUnknown
010k20k30k40kJulAugSepOct

Rugged launches per day

0100200300400JulAugSepOct

Outcome of every launch

94.6%Died 628,508Live 25,003Unknown 4Bonded 7,466Rugged 3,708

Died: no trade for 72 hours and never graduated. Bonded: the curve filled and the token moved to Uniswap v4. Rugged takes precedence over the other three.

Traffic light of every launch

44.8%37.5%Green 297,789Amber 70,220Red 47,417Unknown 249,263

Red needs 3 or more proven linked wallets together holding 20% or more of supply.

By launchpad

Launchpad factoryLaunchesDeployersRedRuggedTaken in rugs
Pons v2 factory 0x7ed598…ec7e
Pons v2 (official launchpad, infrastructure). Counts are launches made on it, not actions by Pons		662,380385,62847,4133,707$45.3M
Factory 0x7e1eab…4db8
Pons-style, modified		1,04436911$72K
Factory 0xed355f…b25b
Pons-style, same code		32722000$0
Factory 0x798daa…ccf2
Pons-style, modified		29820100$0
Factory 0xb45beb…f1f1
Pons-style, modified		887100$0
Factory 0xa87884…d140
Pons-style, same code		761700$0
Factory 0xa49737…dd82
Pons-style, modified		443400$0
Factory 0x25c9cf…473d
Pons-style, same code		43300$0
104 other factories
Each emits the Pons TokenLaunched event		38920830$0

The 111 factories other than Pons v2 emit the same TokenLaunched event. Nothing proves who runs them, so they are listed unlabelled. A different owner address is not proof of a different operator.

How fast the exit comes

Among rugged launches the median first sell came 9 seconds after launch, the median bundle held 33% of supply and 8 linked wallets. 86% of the 3,537 rugs with a measured first sell showed it inside 60 seconds. Tier A rugs (2,525) took $38.6M; tier B (1,183) took $6.8M.

Bundles

Bundles: who takes supply at launch

A proven bundle is extraction whether or not the chart survived. This section counts every one of them.

115,919
proven bundles48,816 major, 67,103 minor
$110.6M
taken, net of cost44,305 ETH on 48,900 measured launches. Pons-style $61.1M, Uniswap-launched $49.5M.
19%
of ETH sold outof the tokens they bundled, wash removed
5.9%
of all trench sells58,640 of 1.00M ETH sold out, wash removed

A bundle is a set of wallets that act as one: they hold supply from the first block, they are linked by something a reader can verify, and together they take at least 1% of supply. 107,591 bundled launches are on Pons-style factories (16.2% of all their launches) and took 24,532 ETH net ($61.1M). A further 8,328 are first-pool launches on Uniswap v2, v3 and v4, which took 19,772 ETH net ($49.5M): the evidence there is weaker because the launcher splits its own supply. Chain-checked on a 30-launch sample: sell proceeds match the chain exactly on Uniswap v2 and v3 and are understated by 2% on v4; the sampled net is 1.3% below the chain figure. Not chain-checked: rows with hand-off wallets (129 rows, 4,139 ETH, 22%) and rows quoted in another token (253 rows, 1,167 ETH, 6%). 2,923 ETH of that is one token, WOOD: 2,753 ETH is the linked wallets' own selling, chain-checked, and the hand-off remainder is not replayed. 6 of the Uniswap-launched rows show 97% or more of supply in the linked wallets (-3 ETH net together), because the launcher splits its own supply. Both are counted in the totals, and only Pons-style launches are ranked in the tables below. The median major bundle runs 9 wallets and 30% of supply.

Every proven bundle is counted, whether or not the chart survived. A bundle that sells slowly is still extraction. The bundle and the wallets it passed tokens to paid in 76,558 ETH and received 120,721 ETH back across the launches where flows were measured, plus 142 ETH net from sell-and-rebuy round trips. That makes the net of 44,305 ETH.

Dump, drip or hold

Dump

15,567 ETH
45,146 launches. 90% of holdings gone within 15 minutes. Median 9 wallets, 30% of supply. Median worst price fall during the exit: 57%.
Pons-style launches only: 44,816 launches, 12,599 ETH.

Drip

31,122 ETH
2,751 launches. Sold slower than 15 minutes. Median 11 wallets, 30% of supply. Median worst price fall during the exit: 76%.
Pons-style launches only: 2,510 launches, 11,918 ETH.

Holding

1,006
launches where the bundle still holds half or more of its peak, 1,003 of them with measured flows. Those are negative against cost until they sell (-2,385 ETH net).

Net ETH taken, by sell style

33.3%66.7%Dump 15,567 ETHDrip 31,122 ETH

Bar shares are of dump plus drip. Holding bundles (-2,385 ETH) are negative against cost and left out, so drip is 70% of the net total of 44,305 ETH. All venues; Pons-style launches alone: dump 12,599 ETH, drip 11,918 ETH.

How long major bundles took to get 90% out

010k20k30k29,638under 1m4,746 ETH12,5011 - 5m5,490 ETH2,8305 - 15m5,307 ETH1,35215m - 1h14,533 ETH1,0181 - 24h13,805 ETH359over 24h2,667 ETH

Only major bundles that exited at least half. 47,698 launches. Bar labels show net ETH taken in each bucket.

The largest bundles by value taken, ETH-quoted Pons-style launches

TokenWalletsSupplyETH inETH outNet takenStyleEvidence
$LEGS
Sep 3, 2026		1581%11.31,034$2.6Mdriplaunch token
$CRUMBS
Sep 8, 2026		2583%17.6995$2.4Mdriplaunch token
$PINK
Sep 7, 2026		1981%11.3466$1.1Mdriplaunch token
$WAIFU
Sep 15, 2026		1581%11.1340$822Kdriplaunch token
$RIG
Sep 5, 2026		3279%8.94291$691Kdriplaunch token
$DEED
Sep 21, 2026		6383%15.5239$613Kdriplaunch token
$HOT
Aug 31, 2026		2179%8.94255$595Kdriplaunch token
$PRESS
Sep 1, 2026		2179%8.94240$556Kdriplaunch token
$BELL
Sep 6, 2026		1580%10.0220$526Kdriplaunch token
$OBS
Aug 21, 2026		3076%23.2204$453Kdriplaunch token
$DRAFT
Sep 10, 2026		1581%11.3189$435Kdriplaunch token
$AOBS
Sep 5, 2026		2074%18.4145$316Kdriplaunch token

Net taken is ETH received from selling minus ETH paid in, at the hourly ETH price of each trade. Each row opens the launch transaction and the token page. Launches quoted in another token (a stock token or a stablecoin) are counted in the totals, with their flows converted at the median price of the quote token, and are not ranked here.

Volume shares use real volume: each token's recorded volume minus half of its wash volume per side (see the fake-volume section). One token, COBIE, is left out: its 7,209,252 ETH of recorded sells are flash-accounting round trips in a pool with dust liquidity, not trading volume.

Quiet extraction

Bundles that never broke the chart

Some bundles are done so well that the price never shows it. The linked wallets take a large share at launch, then sell into the market for hours or days. The chart holds, so the exit looks like normal trading. It is still extraction.

98
quiet extractionsnet above 0.5 ETH, no hour with a fall over 15%
3,497 ETH
taken while the chart held$9.2M, 7.9% of all net. Pons-style launches: 71 launches, 408 ETH.
70%
of all net came from drips2,751 bundles that sold slower than 15 minutes. Pons-style launches: 49% of their net.

Only 98 launches pass the strict test of a flat chart, so quiet extraction is rare. The slow sellers matter more: 2,751 drip bundles took 31,122 ETH, 70% of everything bundles took. Examples of the strict case, written as facts:

$FLUSHQuiet extractiondripAug 22, 2026

21 linked wallets held 76% of supply at launch. The bundle and the wallets it passed tokens to paid in 6.79 ETH and received 78.1 ETH, 71.3 ETH net. 90% of it was out 22 minutes after launch. The price never fell more than 6% in any hour of that window. 71.3 ETH of what they received was paid in by wallets outside the linked set.

launch txbundle tx 1bundle tx 2first selltokendeployer
$JacobQuiet extractiondumpSep 9, 2026

16 linked wallets held 79% of supply at launch. The bundle and the wallets it passed tokens to paid in 6.64 ETH and received 41.9 ETH, 35.3 ETH net. 90% of it was out 9 minutes after launch. The price never fell more than 5% in any hour of that window. 35.3 ETH of what they received was paid in by wallets outside the linked set.

launch txbundle tx 1bundle tx 2first selltokendeployer
$STOCKTARDQuiet extractiondumpSep 11, 2026

80 linked wallets held 78% of supply at launch. The bundle and the wallets it passed tokens to paid in 4.84 ETH and received 36.4 ETH, 31.5 ETH net. 90% of it was out 5 minutes after launch. The price never fell more than 6% in any hour of that window. 31.5 ETH of what they received was paid in by wallets outside the linked set.

launch txbundle tx 1bundle tx 2first selltokendeployer
$WHATCQuiet extractiondripSep 6, 2026

17 linked wallets held 70% of supply at launch. The bundle and the wallets it passed tokens to paid in 5.34 ETH and received 25.2 ETH, 19.8 ETH net. 90% of it was out 20 minutes after launch. The price did not fall in any hour of that window. 19.8 ETH of what they received was paid in by wallets outside the linked set.

launch txbundle tx 1bundle tx 2first selltokendeployer
$VORTAQuiet extractiondumpSep 30, 2026

18 linked wallets held 74% of supply at launch. The bundle and the wallets it passed tokens to paid in 4.74 ETH and received 19.8 ETH, 15.0 ETH net. 90% of it was out 6 minutes after launch. The price never fell more than 6% in any hour of that window. 15.0 ETH of what they received was paid in by wallets outside the linked set.

launch txbundle tx 1bundle tx 2first selltokendeployer

The price series is the median trade price per 10-minute bucket across all venues of the token. The window runs from the bundle's first sell to one hour after 90% of its holdings were gone. Thresholds were derived from the data and are published in the appendix.

Search every bundled launch

All 115,919 bundled launches, searchable by ticker, token address, deployer address, or linked wallet address. The index loads when you first search.

Type to search, or press Enter to list the largest.

Paste any address: it matches as a token, a deployer, or a wallet in a launch's linked set (wallets at or above 0.01% of supply). Net ETH is blank where no sell flows were measured, which is most minor bundles.

The web edition of this report includes a searchable index of all 115,919 bundled launches, and the appendix lists the full CSV.

Deployer histories

Who launched, and what came out

386,627 deployer addresses. 2,701 have at least one rugged launch. Of the $59.8M taken on Pons-style launches, the ten largest took 20% and the hundred largest 42%.

Top deployers by net USD taken by the bundles of their launches

0x387d…83cb$2.6M0x0060…8fe4$2.4M0xb2b9…d7d5$1.9M0x0803…b1e8$1.1M0x0205…b5b1$822K0x0433…6d6f$691K0x0052…9dd9$613K0x725d…8d1c$595K0x096f…5488$556K0xb1ca…0a28$526K0x4082…42f2$453K0x02b2…b6b7$435K

Top 20 deployers

#DeployerLaunchesRuggedETH out, grossNet ETHNet USDEvidence
10x387d8614…1783cb
2026-09-03		111,2001,022$2.6Mlaunch tx fee claim
20x00607ec8…598fe4
2026-09-08		111,747977$2.4Mlaunch tx fee claim
30xb2b987e4…23d7d5
2026-09-02		11932784$1.9Mlaunch tx
40x08035038…05b1e8
2026-09-07		11761454$1.1Mlaunch tx fee claim
50x0205ca24…f6b5b1
2026-09-15		11707328$822Klaunch tx fee claim
60x04336ddf…ef6d6f
2026-09-05		11408282$691Klaunch tx fee claim
70x0052bb21…5d9dd9
2026-09-21		111,192223$613Klaunch tx fee claim
80x725db1fd…a58d1c
2026-08-31		11516246$595Klaunch tx fee claim
90x096f8b43…dc5488
2026-09-01		11356231$556Klaunch tx fee claim
100xb1caea07…fd0a28
2026-09-06		11520210$526Klaunch tx fee claim
110x4082c2f4…0942f2
2026-08-21		21235181$453Klaunch tx fee claim
120x02b208a1…edb6b7
2026-09-10		11423177$435Klaunch tx fee claim
130x4c27c9f6…8c052d 7702
2026-08-01 to 2026-10-02		1,6404159154$388Klaunch tx fee claim
140x6e1a1918…608cc5
2026-09-08		10952134$334K
150x5d93d371…1769e6
2026-09-16		10236133$320K
160x54d8ec04…e551b7
2026-09-05		11246127$316Klaunch tx fee claim
170x5a439bfe…eec70b
2026-09-17		11689129$316Klaunch tx fee claim
180xf9f0700d…b9c7f9
2026-09-05		11250120$298Klaunch tx fee claim
190xaa5ece05…885737
2026-09-05 to 2026-09-07		16150304118$294Klaunch tx fee claim
200x7c53f32d…1a82ca
2026-09-04		11401110$271Klaunch tx fee claim

ETH out is gross of sell-and-rebuy round trips; net is after them. A deployer's figures are what the bundle of its launches, and the wallets it passed tokens to, took. They are not the deployer wallet's own balance. The link rests on the deployer's own launch transaction: wallets it declared snipe-tax exempt, or buys inside the launch transaction. Mass launchers that sell a service are marked 7702 (EIP-7702 delegated accounts). Contracts and Pons infrastructure are excluded from the ranking.

Repeat rug deployers

1 rug2,580$40.4M2-4 rugs70$1.2M5-19 rugs39$1.6M20+ rugs12$4.0M

121 deployers have 2 or more rugged launches and 12 have 20 or more. Right-hand labels show USD taken.

Deployer kinds

unchecked: 385,976 addresses, 533,098 launches
eoa: 466 addresses, 63,777 launches
eoa_7702: 123 addresses, 57,246 launches
contract: 62 addresses, 10,568 launches

Account type is checked on chain for creators with 100 or more launches, 2 or more rugs, or $20K or more taken. The rest are unchecked.

Operations

Threat actor operations, one dossier each

3,297 operations in the wallet-cluster table: 1,294 link two or more deployers, and 137 of those contain a rugged launch (896 deployers, 2,928 launches). Only those are called threat actors here; the other 1,157 are bundler-linked groups with no rug evidence. 2,003 operations are single deployers, listed under deployer histories. The deep dossiers below are written from the chain, transaction by transaction. After them come the largest high and medium confidence operations in the table that contain a rugged launch. Operator W is a cohort of 14 deployers on shared tooling. Its launches share a bundle script, and only 3 pairs of them share a funder, so it is shown for its pattern and is not counted among the operations.

Wallet clusters are rebuilt as transaction history fills toward genesis. Funding links for launches before the history floor are not yet visible, so operations active earlier are marked partial and their totals only grow.
Operation dossier
Operator A: 31 bundled Pons launches, 5,047 ETH taken
Operationhigh confidenceTHREAT ACTOR

Operator A is the threat-actor operation behind 31 bundled launches on the main Pons factory between 2026-08-30 and 2026-09-21. Each launch put ETH into a bundle (315 ETH in total) that held 70-83% of supply within 6 blocks of launch; the bundle wallets passed their tokens through the wash contract into fresh wallets, those wallets sold into the resulting demand, and the deployers made claims on the creator tax. All 31 launches are rugged. The bundle and the wallets it passed tokens to took out 5,047.4 ETH ($12,749,694) net: 4,611.2 ETH of exit proceeds and 749.2 ETH of creator fees claimed (plus 3.9 ETH still in escrow), minus 315.0 ETH of bundle cost and 1.8 ETH of net dev-wallet spend (components rounded to 0.1 ETH; the exact sum is 5,047.42 ETH). The five biggest launches (LEGS, CRUMBS, PINK, WAIFU, RIG) account for 3,472 ETH. Eight cold wallets hold 1,534.64 ETH of it today; no ETH has left them since 2026-09-22 and each has sent at most one transaction.

$12.7M
taken, net of cost
5,047 ETH
ETH net
31
launches
31
rugged
1,535 ETH
ETH in cold wallets now

ETH taken = exit proceeds of the bundle and the wallets it passed tokens to + net dev-wallet result + creator fees claimed + creator fees still in escrow - bundle cost, priced at the hour of each trade. Exact: 4,611.174 -1.806 + 749.171 + 3.914 - 315.037 = 5,047.418 ETH.

How the launches are linked

  • The airdrop payers repeat across launches: 0x2b52bf63... paid for 6 launches, 0xf7348574... for 4, and 15 funder wallets paid for 30 launches in total. The deployer was paid in the same airdrop in 29 of 30 and the bundler in 30 of 30. tx 1733cftx 01f0f0tx 4db71b
  • The funding chain upstream of the funders and the deployers' fee payouts lead to shared low-activity wallets: 48 wallets sit in 7 or more of the 31 launches' wallet sets; the 15 low-activity ones are listed below.
  • DEED's funder 0xf268b1ee... was fed by a staging wallet, which was fed by 0x9d0606c9...: 50 ETH at 23:09:42 UTC and 20 ETH at 23:11:05 UTC on 2026-09-21, then the airdrop (all re-read from the RPC). Per the case file 0x9d0606c9... also funded the funders of 6 of the 31 launches; only the DEED chain is re-checked here. tx fdf0c5tx 8792a6tx a1f403
  • Fee payouts from the deployers go through the same multisender into the same wallets, and 8 cold wallets were funded only by those payout wallets. wallet 158ewallet 6161wallet 884a
  • Operator A and Operator B share no airdrop recipient (checked across 1,044 Operator A airdrop recipients), so they are two operations that use the same tooling.

How they did it

Every launch follows one script, replayed transaction by transaction on a local fork for DEED and matched exactly. The bundle took 70-83% of supply within 6 blocks of launch (20 of 31 in the very next block; 12 launches sold as a drip, 19 as a dump). The bundle wallets then passed their tokens through a wash contract so the exit wallets looked like organic buyers, sold into the demand that volume created, and the deployer claimed the 1% creator tax. All 31 bundle transactions (31 of 31 re-checked on chain) ran through the bundler helper contract 0x1e43ce...2618; about 100 other launch clusters use the same contract, so it is a method fingerprint and not what links these launches.

  1. A funder wallet calls airdropETH on the multisender 40 minutes to 4 hours before launch. It pays the deployer first and the bundler second (about 10-16 ETH), then the bundle wallets, then the wash-bot operator wallets. Verified for 30 of 31 launches.
  2. The deployer launches through the Pons router with a tiny dev buy.
  3. Within 6 blocks of launch (20 of 31 in the very next block, the rest 2 to 6 blocks later) the bundler sends one transaction through the helper contract. It makes 15-32 curve buys that buy out the whole curve (about 4.2 ETH), graduates the token to Uniswap v4, and makes the same number of v4 buys. Verified for 31 of 31 launches.
  4. The bundle wallets sign orders for the wash contract. Each hop sells into the pool and rebuys about 96.5-98% into a fresh wallet inside one Uniswap v4 unlock; the wash contract nets 0 ETH and the hook pays the deployer the creator tax on every leg. Fresh wallets only need gas.
  5. Those fresh wallets sell through the router in hundreds of small sells (median about 0.36 ETH). Half of the exit lands within about 1.5 hours and the rest over about 13 hours.
  6. The deployer claims the creator tax on the Pons fee escrow, then pays it out through the same multisender into the operation's wallets, which consolidate into cold wallets.

Timeline

2026-08-30 01:11 UTC
First Operator A launch: BLIND (0x15d8b4...1918), 21 bundle wallets, 77% of supply. Net take 88.14 ETH. tx 9f1797tx aba78a
2026-09-03
LEGS: the biggest single take, 1,135.93 ETH ($2,867,613); 15 bundle wallets, 81% of supply. tx 9b587dtx 83108c
2026-09-07
Four PINK launches in one day; the best of them netted 523.33 ETH. tx 72b3a2tx 11247dtx 445112
2026-09-08
6 CRUMBS launches in one day; the largest, 0x80baa4...9136, netted 1,121.37 ETH. tx 914609tx 26ef7etx 57b115
2026-09-08 to 2026-09-21
Eight cold wallets with at most one transaction sent are funded from the operation's payout wallets (1,534.63 ETH in total). wallet 158ewallet 6161wallet 884a
2026-09-21
Three DEED launches in one day; the main one, 0x5e55f1...8e95, netted 289.36 ETH. It is the last Operator A launch in the data. tx 037adftx 6b2fdetx 36536d
2026-09-24
Upstream wallet 0x9d0606c9 sends 43.2835 ETH and 43.2401 ETH (86.52 ETH) to the high-fan-in contract 0x4cd00e...bc31. tx 25b929tx 2dcb00
2026-10-03
The eight cold wallets hold 1,534.64 ETH (official RPC balances); no ETH has left them since 2026-09-22 and each has sent at most one transaction. wallet 158ewallet 6161wallet 884a

The ten largest of 31 launches

TokenWalletsSupplyETH inETH outETH taken (with fees)ExitEvidence
$LEGS
2026-09-03		1581%11.41,0341,136driplaunch bundle first sell
$CRUMBS
2026-09-08		15
25 in the bundle table		83%15.69911,121driplaunch bundle first sell
$PINK
2026-09-07		15
19 in the bundle table		81%11.2465523driplaunch bundle first sell
$WAIFU
2026-09-15		1581%11.2338375driplaunch bundle first sell
$RIG
2026-09-05		15
32 in the bundle table		79%8.99290317driplaunch bundle first sell
$DEED
2026-09-21		25
63 in the bundle table		83%15.5235289driplaunch bundle first sell
$PRESS
2026-09-01		2179%8.99240271driplaunch bundle first sell
$BELL
2026-09-06		1580%10.1220270driplaunch bundle first sell
$HOT
2026-08-31		2179%8.99158206driplaunch bundle first sell
$DRAFT
2026-09-10		1581%11.4188196driplaunch bundle first sell

Supply bundled % is the bundle's peak holding from the forensics engine. ETH taken = exit + dev-wallet net + creator fees - bundle cost. The deployer, bundler, funder and airdrop transaction of every launch are in the case data.

ETH taken is ETH out minus ETH in, plus the creator fees claimed, plus the deployer wallet's net spend or income. The bundle tables and the cover leave creator fees out, so the same launch shows a smaller figure there. Wallets here are those that took part in the bundle transaction; the bundle tables count every linked wallet by its peak holding.

Further launches tied to this operation (not in the numbers above)

The frozen run of the clusters pillar (built 2026-10-03 07:10:30) places this operation's deployers in 6 operation(s); those operations also contain 10 launches that are not among the 31 above. For each, the funding airdrop was re-read from the RPC and compared with the recipients of Operator A's 30 airdrops: 3 of the 10 share 10 or more airdrop recipients with Operator A (re-checked, listed first); the others come from clusters-pillar links that were not re-checked here. All of them are excluded from every number in this dossier. Operation ids change when operations merge; resolve by deployer address.

TokenDateDeployerOutcome (ledger)Net taken by the bundle and the wallets it passed tokens to, ETH (ledger)Link check
EQUITY2026-08-120xfc2d96...b09erugged143.7re-checked: airdrop 0x5288d03c...036712 from 0x2ee645...ceae pays 11 of its 31 recipients that Operator A's airdrops also pay
BIAO2026-09-010x9a78f9...fe90rugged51.5re-checked: airdrop 0x10561aca...9f8c8b from 0xb75876...a9cb pays 39 of its 50 recipients that Operator A's airdrops also pay
HATCHED2026-09-240xed272a...0243rugged19.1re-checked: airdrop 0x8d08d7f5...23fee6 from 0x413658...15c3 pays 14 of its 50 recipients that Operator A's airdrops also pay
CASTLE2026-08-160x22ba73...3f1frugged37.2not re-checked
INSIDER2026-08-210x5b737c...9e77rugged105not re-checked
INDICIS2026-09-110x2792d0...9c69rugged19.3not re-checked
LEVY2026-09-150xb53e21...d08frugged8.1not re-checked
STRM2026-09-170x4725bb...bcd2rugged16.6not re-checked
DAM2026-09-170x86b69a...a701rugged24.5not re-checked
SIGHT2026-09-230x135bda...5560died-0.1not re-checked

Where the money went

Proceeds were paid out from the deployers through the multisender to payout wallets and consolidated. Eight cold wallets hold 1,534.64 ETH (read 2026-10-03; the case file read 1,534.63 ETH on 2026-09-23); no ETH has left them since 2026-09-22 and each has sent at most one transaction. 0x4cd00e...bc31 is the largest next hop of the payout wallets (313.9 ETH by 2026-09-23, plus 86.5 ETH from the upstream wallet on 2026-09-24). It is a public contract (186,122 distinct ETH senders; 150,260 distinct WETH/USDG counterparties), so the chain trail ends there. The next hops below are case-file aggregates from the payout wallets, as of 2026-09-23. The DEED exit cluster (150 wallets, part of this operation) held 290.03 ETH on 2026-09-23 and holds 0.0001 ETH today: it swept 295.0 ETH through 209 airdropETH calls between 2026-09-23 and 2026-09-29, and 279.8 ETH of that reached two public hub contracts (0xb92fe9...ff4f 255.6 ETH, 0x4cd00e...bc31 24.2 ETH); see the deed dossier.

WalletWhat it isETHNote
0x158efa38…de1fedcold wallet (listed above)357received 356.9 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 363.68 ETH
0x4cd00e38…38bc31public contract (hub)314received 313.9 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 5.99 ETH; contract (the hub list): 186,122 distinct ETH senders; 150,260 distinct WETH/USDG
0x6161df92…17df05cold wallet (listed above)291received 291.1 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 291.10 ETH
0x884aa2d6…771a5bcold wallet (listed above)237received 237.3 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 237.35 ETH
0xfc9cfd0d…a3b965cold wallet (listed above)130received 129.8 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 129.75 ETH
0x362fef42…1ee8c0cold wallet (listed above)129received 129.4 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 129.44 ETH

Where the money went, wallet by wallet

The trace started from 1,810 seed wallets. A targeted scan read the transaction counts of 1,862 wallets from public archive nodes and filled their history from block 49,334,480 to block 62,716,999; contracts and wallets with more than 250 transactions were not scanned. The flow table itself covers native ETH transfers from Sep 14, 2026. 56% of the 5,047 ETH net is traced to a destination: 2,803 ETH in 23 parked wallets, 27 ETH recycled into later launches and 3 ETH swapped into another token. 1,642 ETH-equivalent entered two public hub contracts (0x4cd00e38…bc31 and 0xb92fe925…ff4f) and is left untraced: the trail ends in contracts that receive from thousands of unrelated wallets, and they are not called an exchange or a bridge. 445 ETH is dust. Amounts are scaled to the ledger net of 5,047 ETH; balances below are real balances read today. The eight cold wallets in the dossier hold 1,534.6 ETH and the four CRUMBS exit wallets hold 943.9 ETH: 2,478.5 ETH of cold storage, reproduced to the digit from public RPC balances. The scan found 11 more parked wallets, holding 1,114.4 ETH.

23
parked wallets0.05 ETH or more, balances read from public RPC
3,593 ETH
held nowETH-equivalent, in those wallets
56%
of the net traced1,642 ETH-eq left untraced in hubs
WalletWhat it isHolds now, ETHEvidence
0x158efa38…de1fedDossier cold wallet.363.7tx 1
0x9457e5c8…66c1afCRUMBS exit wallet named in the dossier.300.0tx 1
0x6161df92…17df05Dossier cold wallet.291.1tx 1
0x3e2c84cb…526199Received ETH from Operator A's wallets and still holds it.276.2tx 1
0xef825d3e…5c6aadCRUMBS exit wallet named in the dossier.255.0tx 1
0x884aa2d6…771a5bDossier cold wallet.237.3tx 1
0xccb9e851…701047Received ETH from Operator A's wallets and still holds it.217.4tx 1
0x5f45b3e3…44191bReceived ETH from Operator A's wallets and still holds it.201.8tx 1
0x437db5e7…f3b288CRUMBS exit wallet named in the dossier.200.0tx 1
0x94ddada2…b14551Received ETH from Operator A's wallets and still holds it.200.0tx 1
0xfa6cffad…09c0adCRUMBS exit wallet named in the dossier.188.9tx 1
0x3aa27d09…0111bfDossier cold wallet.173.5tx 1
0xfc9cfd0d…a3b965Dossier cold wallet.129.8tx 1
0x362fef42…1ee8c0Dossier cold wallet.129.4tx 1

9 smaller wallets are in the money-sinks CSV.

Fact only: a wallet listed here received ETH from Operator A's wallets and holds it; the chain does not say who owns it.

Promotion

39 X posts in the Fable archive carry the contract address of these launches (from 20 accounts; posts that only match a ticker are not counted). 39 of them are judged so far; 15 posts by 8 accounts are judged as promoting the token. The first 10 are listed below; all 15 are in promo_posts_judged.csv. 10 posts come from 5 project accounts the deployer typed into the token metadata and 5 posts from 3 third-party accounts. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

AccountTokenPostedAfter launch
@legsdotfun project account$LEGS2026-09-03 21:28 UTC25 minutes
@legsdotfun project account$LEGS2026-09-04 00:22 UTC3.3 hours
@legsdotfun project account$LEGS2026-09-04 01:49 UTC4.8 hours
@GateTrenches$LEGS2026-09-04 05:59 UTC8.9 hours
@pinksheets_fi project account$PINK2026-09-08 00:19 UTC2.4 hours
@crumbsfamily project account$CRUMBS2026-09-08 23:59 UTC2 minutes
@crumbsfamily project account$CRUMBS2026-09-09 03:10 UTC3.2 hours
@GateTrenches$CRUMBS2026-09-09 12:33 UTC12.6 hours
@crumbsfamily project account$CRUMBS2026-09-09 14:26 UTC14.5 hours
@GateTrenches$CRUMBS2026-09-10 01:30 UTC25.5 hours

A project account is the X handle the deployer typed into the token's on-chain metadata. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 105 links

BLIND 2026-08-30 launch txBLIND 2026-08-30 bundle tx (helper)BLIND 2026-08-30 funding airdrop txCASE 2026-08-30 launch txCASE 2026-08-30 bundle tx (helper)CASE 2026-08-30 funding airdrop txHOT 2026-08-31 launch txHOT 2026-08-31 bundle tx (helper)HOT 2026-08-31 funding airdrop txTAPE 2026-08-31 launch txTAPE 2026-08-31 bundle tx (helper)TAPE 2026-08-31 funding airdrop txPOCKET 2026-09-01 launch txPOCKET 2026-09-01 bundle tx (helper)POCKET 2026-09-01 funding airdrop txPRESS 2026-09-01 launch txPRESS 2026-09-01 bundle tx (helper)PRESS 2026-09-01 funding airdrop txrNOTE 2026-09-02 launch txrNOTE 2026-09-02 bundle tx (helper)rNOTE 2026-09-02 funding airdrop txLEGS 2026-09-03 launch txLEGS 2026-09-03 bundle tx (helper)LEGS 2026-09-03 funding airdrop txRIG 2026-09-05 launch txRIG 2026-09-05 bundle tx (helper)RIG 2026-09-05 funding airdrop txBELL 2026-09-06 launch txBELL 2026-09-06 bundle tx (helper)BELL 2026-09-06 funding airdrop txPINK 2026-09-07 launch txPINK 2026-09-07 bundle tx (helper)PINK 2026-09-07 funding airdrop txPINK 2026-09-07 launch txPINK 2026-09-07 bundle tx (helper)PINK 2026-09-07 funding airdrop tx

Limits

  • The link between launches rests on shared funders, shared upstream wallets and shared payout wallets documented in the case files. The transaction index does not yet reach the earlier blocks of these launches so those links were rebuilt from case-file data and re-checked by RPC only for the transactions cited.
  • The bundler helper contract and the wash contract are shared tools used by about 100 other launch clusters. Using them is not what links these 31 launches; the funders, upstream wallets and payout wallets are.
  • The headline net figure is the bundle wallets' exit plus the creator fees minus the bundle cost. Exit wallets reached through wash rebuys carry 85-90% attribution; the conservative floor (direct-funded exit + fees - bundle cost) is 2,200.7 ETH.
  • The chain data does not name a person. Eight cold wallets hold 1,534.6 ETH of the 5,047 ETH; the destination of the rest is not established in this dossier.
Case dossier
DEED (Deed Estate): one 25-wallet bundle, 289 ETH taken
Part of the operation dossier above
Casehigh confidence

DEED (Deed Estate, 0x5e55f1...8e95) is the best-documented launch of Operator A. On 2026-09-21 a funder wallet airdropped ETH to a deployer, a bundler and 48 further wallets; the deployer launched at block 69,205,683 and in the next block the bundler's single transaction bought out the curve, graduated the token and bought again, leaving the bundle with 83% of supply. The bundle put in 15.53 ETH and the bundle and the wallets it passed tokens to took out 304.87 ETH (234.73 ETH exit, 1.27 ETH dev sell, 68.87 ETH creator fees): 289.34 ETH ($798,498) net, which is 18.6x the bundle cost (15.2x on the exit proceeds alone). The 150 wallets held 290.03 ETH on 2026-09-23; by 2026-10-03 they hold 0.0001 ETH. They swept 295.0 ETH into 11 wallets in 209 transactions between 2026-09-23 and 2026-09-29, and 279.8 ETH of it has reached two public contracts so far.

$798K
taken, net of cost
289 ETH
ETH net
25
bundle wallets
83%
of supply bundled
235 ETH
ETH exit

How the launches are linked

  • The deployer, the bundler and the 24 bundle wallets were paid in the same airdropETH transaction by one funder; 42 more wallets that traded DEED through the wash contract came from a second airdrop of the same funder. tx a1f403
  • The funder was fed by a staging wallet and that wallet by 0x9d0606c9...: 50 ETH from 0x9d0606c9... to the staging wallet at 23:09:42 UTC (block 69,180,497), 20 ETH from the staging wallet to the funder at 23:11:05 UTC (block 69,181,316), then the airdrop in block 69,181,476. All three transactions were re-read from the RPC. Per the case file the same upstream wallet also funded the funders of 6 of Operator A's 31 launches; only the DEED chain is re-checked here. tx fdf0c5tx 8792a6tx a1f403
  • After each of the 13 claims the deployer sent exactly 5% through the same multisender to one partner wallet (3.44 ETH in total). tx 6cd3aa
  • The same 150 wallets swept their ETH out together between 2026-09-23 and 2026-09-29 with airdropETH calls to the same 11 recipients (209 transactions, decoded from calldata). tx 97743etx 5034b5tx 8bb575

How they did it

Atomic bundle, wash-contract hand-off, small router sells, claims on the creator tax. The operator's own launch, bundle, wash hops and first claim were replayed on a local fork and matched event for event (550 of 578 transactions identical in the replay window; the differing DEED transactions are third-party bot trades).

  1. Airdrop: one multisender transaction pays deployer, bundler, bundle wallets and wash-bot wallets about 40 minutes before launch.
  2. Launch: the deployer launches through the Pons router with a tiny dev buy.
  3. Bundle: next block, one transaction through the helper makes 25 CurveBuys that buy out the curve, graduates to Uniswap v4 and makes 25 v4 buys.
  4. Wash: 169 hops through the wash contract: each pulls a signed amount from one wallet, sells, rebuys about 96.5-98% into a fresh wallet and pays the 1% creator tax; the contract nets 0 ETH and the fresh wallets need only gas.
  5. Exit: 618 router sells from fresh wallets (+234.73 ETH). Half of the exit lands about 13 hours after launch.
  6. Fees: 13 claims on the fee escrow (first 28.48 ETH about 10 minutes after launch), 5% of each to a partner wallet.
  7. Sweep: the cluster consolidates through airdropETH calls into five collector wallets, each of which forwards its full balance in one transaction.

Timeline

2026-09-21 23:09 to 23:11 UTC
0x9d0606c9... sends 50 ETH to the staging wallet 0xfabfdf88... (23:09:42), which sends 20 ETH to the funder 0xf268b1ee... (23:11:05). tx fdf0c5tx 8792a6
2026-09-21 23:11 UTC
Funder 0xf268b1ee... calls airdropETH on the multisender: 50 recipients (deployer, bundler, 24 bundle wallets, 24 wash-bot wallets), about 40 minutes before launch. A second airdrop from the same funder funds 42 more wallets, all of which trade DEED through the wash contract. tx a1f403
2026-09-21 23:51 UTC
Block 69,205,683: the deployer launches DEED through the Pons router and buys 29.9M DEED for 0.053 ETH. tx 36536d
block 69,205,684 (next block)
The bundler sends 15.48 ETH through the helper in one transaction: 25 curve buys buy out the 4.2 ETH curve, the token graduates to Uniswap v4, 25 more v4 buys follow (0.4498 ETH each). The bundle holds 83% of supply. tx b82e82
blocks 69,205,724 to 69,236,995 (about 1 hour)
The bundle wallets pass their tokens to the wash contract: 169 hops, each selling and rebuying into a fresh wallet at net 0 ETH. The fresh wallets then make 618 router sells for +234.73 ETH. tx 6a4b7e
block 69,211,875 (about 10 minutes after launch)
First creator-fee claim: 28.48 ETH on the Pons fee escrow. After each claim exactly 5% goes through the multisender to the partner wallet (the first cut: 1.4238 ETH). tx ba86aetx 6cd3aa
2026-09-22 to 2026-09-23
13 claim() calls in total: 67.55 ETH claimed (1.31 ETH still in escrow). The cluster of 150 wallets holds 290.03 ETH on 2026-09-23. tx ba86aetx 68c639tx 3519cb
2026-09-23 to 2026-09-29
The cluster sweeps itself: 149 of the 150 wallets send 295.04 ETH in 209 airdropETH calls to 11 recipients; five of them take 291.5 ETH and forward the full amount in one transaction each. tx 97743etx 5034b5tx 8bb575
2026-09-24 to 2026-09-29
The five second-hop wallets move the ETH on: 255.6 ETH into 0xb92fe9...ff4f and 24.2 ETH into 0x4cd00e...bc31, two public contracts (the hub list: 0xb92fe9...ff4f: 12,024 distinct ETH senders; 117,845 distinct WETH/USDG counterparties; first-funded 946 different creators; 0x4cd00e...bc31: 186,122 distinct ETH senders; 150,260 distinct WETH/USDG counterparties); the chain trail ends in those contracts. tx b1d3e0tx 27f592tx 0d61d3
2026-10-03
The 150 cluster wallets hold 0.0001 ETH in total (290.03 ETH on 2026-09-23). wallet 0052

Launches

TokenWalletsSupplyETH inETH outETH taken (with fees)ExitEvidence
$DEED
2026-09-21		25
63 in the bundle table		83%15.5235289driplaunch bundle first sell

ETH taken here = exit + dev sell + creator fees - bundle cost (curve 4.29 + v4 11.25) = 289.34 ETH from the hand-worked DEED PnL; Operator A's table shows 289.36 ETH for this token because it uses the batch pipeline; the 0.02 ETH difference is rounding between the two case calculations. The ledger (the bundle ledger) computes 223.3 ETH net taken by the bundle and the wallets it passed tokens to and 69.1 ETH of fee claims for this token.

ETH taken is ETH out minus ETH in, plus the creator fees claimed, plus the deployer wallet's net spend or income. The bundle tables and the cover leave creator fees out, so the same launch shows a smaller figure there. Wallets here are those that took part in the bundle transaction; the bundle tables count every linked wallet by its peak holding.

Where the money went

On 2026-09-23 the 150 cluster wallets held 290.03 ETH (deployer 65.43 ETH). Between 2026-09-23 and 2026-09-29 295.04 ETH left them in 209 airdropETH calls (calldata decoded) to 11 recipients; five collector wallets took 291.5 ETH and each forwarded its full balance in one transaction. Of that, 255.6 ETH went to 0xb92fe9...ff4f and 24.2 ETH to 0x4cd00e...bc31, both public contracts in the hub list (0xb92fe9...ff4f: 12,024 distinct ETH senders; 117,845 distinct WETH/USDG counterparties; first-funded 946 different creators; 0x4cd00e...bc31: 186,122 distinct ETH senders; 150,260 distinct WETH/USDG counterparties); the trail ends there on chain data. Operator A's payout wallets used the same two contracts earlier.

WalletWhat it isETHNote
0xb92fe925…4fff4fpublic contract (hub)5050.00 ETH sent by 0x8925f4...dbbc (of which 50.00 ETH came from the DEED sweep via collector 0x700ad6...4705); the hub list: 12,024 distinct ETH senders; 117,845 distinct WETH/USDG counterpa
0xb92fe925…4fff4fpublic contract (hub)5049.95 ETH sent by 0x8925f4...dbbc (of which 49.95 ETH came from the DEED sweep via collector 0x700ad6...4705); the hub list: 12,024 distinct ETH senders; 117,845 distinct WETH/USDG counterpa
0xb92fe925…4fff4fpublic contract (hub)8988.91 ETH sent by 0x844132...c417 (of which 88.91 ETH came from the DEED sweep via collector 0x72ae1d...8c92); the hub list: 12,024 distinct ETH senders; 117,845 distinct WETH/USDG counterpa
0xb92fe925…4fff4fpublic contract (hub)6766.70 ETH sent by 0x82795f...c80b (of which 66.70 ETH came from the DEED sweep via collector 0xa5a233...30da); the hub list: 12,024 distinct ETH senders; 117,845 distinct WETH/USDG counterpa
0x4cd00e38…38bc31public contract (hub)2444.82 ETH sent by 0x8448e8...3ed1 (of which 24.24 ETH came from the DEED sweep via collector 0xbe6d6a...63df); the hub list: 186,122 distinct ETH senders; 150,260 distinct WETH/USDG counterp
0xda546ac1…05471dwallet33.00 ETH sent by 0xa2f0f9...3c63 (of which 3.00 ETH came from the DEED sweep via collector 0x2ac4f4...98ed)

Promotion

12 X posts in the Fable archive carry the contract address of these launches (from 10 accounts; posts that only match a ticker are not counted). 12 of them are judged so far; 3 posts by 2 accounts are judged as promoting the token. All 3 are listed below and in promo_posts_judged.csv. 2 posts come from 1 project account the deployer typed into the token metadata and 1 post from 1 third-party account. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

AccountTokenPostedAfter launch
@DeedEstate project account$DEED2026-09-21 23:53 UTC85 seconds
@ansemstealth$DEED2026-09-22 01:06 UTC75 minutes
@DeedEstate project account$DEED2026-09-22 02:27 UTC2.6 hours

A project account is the X handle the deployer typed into the token's on-chain metadata. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 37 links

launch txbundle tx (helper)funding airdrop txfirst fee claim5% cut txtokenclaim txclaim txclaim txclaim txclaim txclaim txclaim txclaim txclaim txclaim txclaim txclaim txclaim txclaim txsweep first-hop txsweep first-hop txsweep first-hop txsweep first-hop txsweep first-hop txsweep second-hop txsweep second-hop txsweep second-hop txsweep second-hop txsweep second-hop txinto hub contractinto hub contractinto hub contractinto hub contractinto hub contractinto hub contract

Limits

  • The 150-wallet cluster is the case file's wallet set (bundle, airdrop and wash-chain wallets); exit proceeds through wash rebuys carry 85-90% attribution.
  • The two hub contracts are public contracts with thousands of unrelated counterparties each (counts in the money section); what happens to ETH after it enters them is not visible in top-level transfers.
  • The chain data does not name a person.
Operation dossier
The $ROW and $CLIP operation
Operationmedium confidenceTHREAT ACTOR

This operation links 13 deployer wallets and 38 launches (38 in the ledger) between 2026-09-12 and 2026-09-23 through 74 strong links (bundle_signer,creator_funded,shared_bundle_wallet,shared_funder,shared_wallets_x2,sweep); 13 of the launches are rugged. Bundle wallets took 48-70% of supply where a bundle is proven. The ledger puts the net taken by the bundle and the wallets it passed tokens to at 212.0 ETH ($557,316), plus 65.9 ETH of creator fee claims by the 13 deployers. The operation's 190 known wallets hold 8.165 ETH on 2026-10-03.

$557K
taken, net of cost
212 ETH
ETH net
38
launches
13
deployers
13
rugged

Some launches here are quoted in a token (AAPL, NVDA): their ETH figures are converted by the engine at a rate the ledger re-checked, and the ledger treats them as floors. Net taken is the ledger's (the bundle ledger: ETH received selling by the bundle and the wallets it passed tokens to, minus ETH paid, round trips removed). Fee claims are the deployers' claims on the Pons fee escrow (the deployer ledger), shown separately and not added.

How the launches are linked

  • Strong link kind creator_funded: 1562 wallet pairs from 9 transaction(s): the deployer, or one funder of both, funded a wallet of the deployer's own launch cohort (direct transfer, shared first funder, or ONE multisender transaction that paid the deployer and a cohort wallet). tx 42a8a0tx 488464tx 4f3bbd
  • Strong link kind same_tx_bundle: 440 wallet pairs from 38 transaction(s): 3 or more distinct recipients, each holding at least 0.1% of supply, bought in ONE transaction inside the launch window.
  • Re-checked on the public RPC: airdropETH from 0x05afc1...1b32 to 50 wallets, 1 of this operation's deployers and 26 of its bundle wallets in the recipient list (2.64 ETH) (status success). tx 42a8a0
  • Re-checked on the public RPC: airdropETH from 0x5a2509...7321 to 14 wallets, 1 of this operation's deployers and 13 of its bundle wallets in the recipient list (2.82 ETH) (status success). tx 488464
  • Re-checked on the public RPC: airdropETH from 0x5a2509...7321 to 3 wallets, 1 of this operation's deployers and 1 of its bundle wallets in the recipient list (2.23 ETH) (status success). tx 4f3bbd
  • Re-checked on the public RPC: airdropETH from 0x5a2509...7321 to 14 wallets, 1 of this operation's deployers and 13 of its bundle wallets in the recipient list (2.28 ETH) (status success). tx 5e055b

How they did it

The bundle transaction landed 13 of 13 times in the very next block and within 1 blocks of launch in all cases. Bundle helpers used: multi-wallet curve buyer 0x14b9a544 x11; no bundle contract recorded x25; bundler helper contract 0x1e43ce00 x2. Sell style: 9 dump, 4 drip, 25 no flows computed.

Timeline

2026-09-12
HOLD: 13 bundle wallets, 55% of supply, net 22.13 ETH, rugged tier A, dump. tx 3c5c14tx 169a2d
2026-09-12
CLIP: 13 bundle wallets, 55% of supply, net 37.5 ETH, rugged tier A, dump. tx ed439atx f8826b
2026-09-14
FUEL: 19 bundle wallets, 59.7% of supply, net 15.58 ETH, rugged tier A, drip. tx ab2bdctx 103581
2026-09-14
CLAUDE: no bundle in the ledger, bonded. tx fecdf0
2026-09-14
ASTRA: no bundle in the ledger, died. tx 20a825
2026-09-14
ultimix: 13 bundle wallets, 59% of supply, net 11.12 ETH, rugged tier A, dump. tx 3e170ctx 4fd89f
2026-09-15
flygram: 13 bundle wallets, 59% of supply, net 14.16 ETH, rugged tier A, dump. tx 6193fdtx d9cdbf
2026-09-15
idomain: 13 bundle wallets, 59% of supply, net 9.16 ETH, rugged tier A, drip. tx f00379tx 5117d6
2026-09-22
MIRA: 20 bundle wallets, 70% of supply, net 0.2 ETH, rugged tier A, dump. tx a29aa1tx 7219f9
2026-09-22
drift: 20 bundle wallets, 70% of supply, net -1.4 ETH, rugged tier A, dump. tx 0059d0tx 889d7e

The ten largest of 38 launches

TokenWalletsSupplyETH inETH outETH takenExitEvidence
$row
2026-09-22		1654%14.975.760.9driplaunch bundle first sell
$CLIP
2026-09-12		1355%4.8142.237.5dumplaunch bundle first sell
$GIT
2026-09-22		2048%5.1333.929.0dumplaunch bundle first sell
$HOLD
2026-09-12		1355%2.3524.422.1dumplaunch bundle first sell
$FUEL
2026-09-14		1960%11.927.315.6driplaunch bundle first sell
$flygram
2026-09-15		1359%4.9219.014.2dumplaunch bundle first sell
$SKY
2026-09-22		2048%3.3815.412.2dumplaunch bundle first sell
$ultimix
2026-09-14		1359%3.7614.711.1dumplaunch bundle first sell
$idomain
2026-09-15		1359%6.6115.79.16driplaunch bundle first sell
$POLY
2026-09-22		2048%5.166.101.24driplaunch bundle first sell

ETH columns are the ledger's; blank where the engine did not compute flows (thin sets).

Where the money went

Since the first launch the operation's 190 known wallets (deployers, funders and bundle wallets; 0 hub wallet(s) excluded) sent 76.7 ETH through 179 multisender calls (calldata decoded) and 16.3 ETH by direct transfers to non-infrastructure addresses; 15.3 ETH of that reached public hub contracts (the hub list fan-in contracts), where the chain trail ends. The wallets hold 8.165 ETH. Exit wallets that received tokens through wash rebuys are not in the operation's wallet list, so this covers the known wallets only.

WalletWhat it isETHNote
0x4cd00e38…38bc31public contract (hub)15reached by direct transfer or traced hops from this operation's wallets; contract (the hub list): 186,122 distinct ETH senders; 150,260 distinct WETH/USDG counterparties
0x3f1a267c…b4b0c3wallet (direct recipient)151 transfers from 1 operation wallet(s) since the first launch
0x9b4a1a75…01d42ewallet (direct recipient)11 transfers from 1 operation wallet(s) since the first launch
0x771be5e3…c17f49multisender recipient16received 15.95 ETH from 1 operation wallet(s) through airdropETH calls (calldata decoded)
0xead16c0a…553750multisender recipient9received 8.97 ETH from 1 operation wallet(s) through airdropETH calls (calldata decoded)
0xf871cfc4…f4fddemultisender recipient7received 6.89 ETH from 1 operation wallet(s) through airdropETH calls (calldata decoded)

Promotion

0 X posts in the Fable archive carry the contract address of these launches (from 0 accounts; posts that only match a ticker are not counted). 0 of them are judged so far and none is judged as promoting the token. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 116 links

HOLD launch txCLIP launch txFUEL launch txCLAUDE launch txASTRA launch txultimix launch txflygram launch txidomain launch txMIRA launch txdrift launch txSKY launch tx0x818d27...37ca launch tx0xf1ba24...d0b5 launch tx0xbbd546...a96c launch tx0x8ac46d...3e60 launch tx0x74b57b...8ffc launch txPOLY launch txGIT launch txLINUX launch txASSIMP launch tx0x5f9e15...74c6 launch txAVENOXBEY launch tx0x48b2d6...cc1c launch tx0x0bbc6e...31eb launch tx0x97196a...7da7 launch tx0xc744c4...24e1 launch tx0x125115...3852 launch txELIZA launch tx0xa642eb...4c36 launch tx0x77a1f0...9ef1 launch tx0x4756a3...c420 launch tx0x0a3b7d...0772 launch txrow launch tx0x89f4c9...efdf launch txQRTZ launch txDRONES launch tx

Limits

  • Operation membership comes from the clusters pillar's frozen run (the operations table, built 2026-10-03 07:10:30, 3,297 operations); the live the operations table is rewritten every 5 minutes, so resolve by deployer address.
  • Net extraction is the ledger's engine figure, not hand-checked per wallet.
  • Where the history index does not yet reach a launch block, funding links are missing and the operation is at least as large as shown.
  • The money trail covers the known wallets only (deployers, funders, bundle wallets); wash-rebuy exit wallets are not in the operation wallet table.
  • The chain data does not name a person.
Operation dossier
Operator B: 5 bundled Pons launches incl. BLISS, 199 ETH taken
Operationhigh confidenceTHREAT ACTOR

Operator B is the threat-actor operation behind 5 bundled launches (Stocker twice, AERA, BLISS twice) between 2026-09-04 and 2026-09-23. One funder wallet paid the airdrop for all five; each bundle took 73-85% of supply in the very next block after launch (5 of 5 bundle transactions re-checked). All 5 are rugged. The operation put 49.8 ETH into the bundles, took 211.3 ETH out through the bundle and the wallets it passed tokens to, claimed 52.9 ETH of creator fees (plus 0.3 ETH still in escrow) and spent 15.3 ETH net in the dev wallets, for 199.4 ETH ($509,398) net. One launch, Stocker (0x1f20837d...), is 127.7 ETH of that.

$509K
taken, net of cost
199 ETH
ETH net
5
launches
5
rugged

ETH taken = exit proceeds of the bundle and the wallets it passed tokens to + net dev-wallet result (negative: the dev wallets bought their own token) + creator fees claimed + creator fees still in escrow - bundle cost, priced at the hour of each trade. Check at 0.1 ETH: 211.3 - 15.3 + 52.9 + 0.3 - 49.8 = 199.4.

How the launches are linked

  • One funder wallet 0xcd0bbe...6be1 paid the multisender airdrop for all 5 launches (5 of 5 transactions decode and match). The deployer was paid in the same airdrop in 5 of 5 and the bundler in 5 of 5. tx fe8708tx f671cftx c5dc35
  • 8 wallets sit in the funding-chain or payout wallet sets of all 5 launches (funder, its earlier funder, and 6 low-activity wallets).
  • Off-chain, source the case file: rhstocker.com (registered 2026-09-02; DNS and registrar facts come from the case file and cannot be reproduced from the chain) and bliss.fun (registered 2026-09-21) both use registrar Name.com, Inc. and the same four Name.com nameservers (ns1cny, ns2ckr, ns3jkl, ns4hny), both carry a replit-verify TXT record, and both pages are built with Replit and Vite. Both resolve to 34.111.179.208, an address shared by Replit customers, so the address alone proves nothing; the registrar, nameserver set and builder together are a fingerprint, not an on-chain link. These are case-file claims as collected on 2026-09-23; current records can be re-read at the RDAP and DNS lookups linked here. linklinklink
  • No airdrop recipient of Operator B is in Operator A's airdrops (checked across 227 Operator B recipients). Operator A and Operator B are two operations that use the same tooling.

How they did it

Operator B runs the same script as Operator A on a smaller scale: 5 launches, 73-85% of supply bundled in the very next block after launch (5 of 5 re-checked), 2 sold as a drip and 3 as dumps. All five bundle transactions go through the same bundler helper contract as Operator A, and the wash contract handled the bundle tokens.

  1. The funder 0xcd0bbe...6be1 calls airdropETH on the multisender (selector 0xc1a38006) for all 5 launches. Recipient order: deployer first, bundler second, then the bundle wallets and the wash-bot wallets.
  2. The deployer launches through the Pons router with a tiny dev buy.
  3. Next block: the bundler sends one transaction through the helper contract: 19-28 curve buys that buy out the curve, graduation to Uniswap v4, then the same number of v4 buys. Verified for 5 of 5.
  4. The bundle sends its tokens to the wash contract (BLISS: 115 hops), which sells and rebuys into fresh wallets at net 0 ETH; the creator tax pays the deployer on every leg.
  5. Fresh wallets sell through the router (2,447 sells for BLISS alone). The deployers claim the creator tax (BLISS: 234 claim() calls, 17.97 ETH) and pay it out through the multisender.

Timeline

2026-09-04 17:27 UTC
Two Stocker launches 10 minutes apart; the second (0x1f2083...ab1c) nets 127.66 ETH, the biggest Operator B take. tx cb366ftx 8b71datx b3f331
2026-09-05
AERA: smaller launch (24 wallets), net 4.34 ETH. tx ca2da7tx 4c545e
2026-09-23
Two BLISS launches 30 minutes apart; 0x0a8c39...5cc6 nets 58.83 ETH after a 14.25 ETH bundle that took 85.3% of supply. tx 2e016dtx 3dcc45tx 4f0d2a
2026-09-23
BLISS (0x0a8c39fa...) is the live case of this operation: the bundle sends 850M BLISS to the wash contract, 115 wash hops net 0 ETH, then fresh wallets dump; 234 fee claims. tx 1308e0tx c6bb03

Launches

TokenWalletsSupplyETH inETH outETH taken (with fees)ExitEvidence
$Stocker
2026-09-04		2884%12.6123128driplaunch bundle first sell
$BLISS
2026-09-23		2585%14.261.458.8driplaunch bundle first sell
$Stocker
2026-09-04		2884%11.213.98.21dumplaunch bundle first sell
$AERA
2026-09-05		2473%4.697.564.34dumplaunch bundle first sell
$BLISS
2026-09-23		1979%7.075.350.32dumplaunch bundle first sell

Supply bundled % is the bundle's peak holding from the forensics engine. ETH taken = exit + dev-wallet net + creator fees - bundle cost.

ETH taken is ETH out minus ETH in, plus the creator fees claimed, plus the deployer wallet's net spend or income. The bundle tables and the cover leave creator fees out, so the same launch shows a smaller figure there. Wallets here are those that took part in the bundle transaction; the bundle tables count every linked wallet by its peak holding.

Linked launches found by chain tracing (not in the headline)

Two more launches, Jackpot (2026-09-09) and Harvest (2026-09-10), took bundles of 29 wallets each (80% and 84.5% of supply) through the same bundler helper and were funded by one intermediary wallet, 0x892ea0...2969. The intermediary is fed by Operator B's upstream wallet 0xd5b200...a6ff: on 2026-09-10 at 17:03:31 UTC that wallet sent it 13.7 ETH, and 11 seconds later (17:03:42) the intermediary called airdropETH with 13.556 ETH for 50 wallets, the Harvest deployer and 46 of its bundle wallets among them; Harvest launched at 17:16 UTC. The intermediary also paid the Jackpot airdrop (8.487 ETH, 2026-09-09 18:03:24 UTC, 42 of its bundle wallets), funded 39 minutes earlier by a different wallet, 0x04ffcaa3....

By the ledger the two launches netted 96.7 ETH for the bundle wallets (Jackpot 15.68, Harvest 80.99) and both are rugged. They are listed here and in the case data under extra_launches, and are not added to the case-file headline above because the link runs through a wallet with 4,874 transactions (a shared funding source is established, a single operator is not) and the two launches use ledger numbers, not the case-file PnL method.

TokenDateDeployerBundle walletsSupply %ETH taken (ledger)Airdrop tx
Jackpot2026-09-090xbee541...097d298015.680x6f82409b...cbbf44
Harvest2026-09-100x944cd7...75ef2984.580.990x5d718c63...3cf7f0

Where the money went

Proceeds were paid out from the deployers through the multisender to payout wallets. The case file's next hops (as of 2026-09-23) are below: the largest, 0x4cd00e...bc31, is the same public contract Operator A's payout wallets used (186,122 distinct ETH senders; 150,260 distinct WETH/USDG counterparties), so the trail ends there on chain data. Part of the money was recycled to the funder and its upstream wallet.

WalletWhat it isETHNote
0x4cd00e38…38bc31public contract (hub)157received 157.0 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 5.989 ETH; contract (the hub list): 186,122 distinct ETH senders; 150,260 distinct WETH/USD
0xd5b20087…85a6fffunder / upstream wallet (recycled)67received 66.5 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 0.001 ETH
0x65050a9b…2c40dcpublic contract (hub)65received 64.8 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 0.000 ETH; 752-byte contract (the hub list): 63,963 distinct ETH senders; 245,336 distinct W
0xcd0bbef7…7d6be1funder / upstream wallet (recycled)49received 48.7 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 0.092 ETH
0x4a86009a…cf6f60public contract (hub)21received 20.7 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 0.000 ETH
0x892ea0b7…182969wallet14received 13.7 ETH from the operation's payout wallets (case file, as of 2026-09-23); balance then 1.358 ETH

Promotion

5 X posts in the Fable archive carry the contract address of these launches (from 5 accounts; posts that only match a ticker are not counted). 5 of them are judged so far; 2 posts by 2 accounts are judged as promoting the token. All 2 are listed below and in promo_posts_judged.csv. 1 post come from 1 project account the deployer typed into the token metadata and 1 post from 1 third-party account. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

AccountTokenPostedAfter launch
@LaunchOnBliss project account$BLISS2026-09-23 17:15 UTC9 minutes
@listingntm$BLISS2026-09-23 19:57 UTC2.9 hours

A project account is the X handle the deployer typed into the token's on-chain metadata. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 23 links

Operator B upstream wallet to intermediary, 13.7 ETH (2026-09-10 17:03:31)intermediary airdrop for the Harvest bundle, 11 s laterintermediary airdrop for the Jackpot bundleStocker 2026-09-04 launch txStocker 2026-09-04 bundle tx (helper)Stocker 2026-09-04 funding airdrop txStocker 2026-09-04 launch txStocker 2026-09-04 bundle tx (helper)Stocker 2026-09-04 funding airdrop txAERA 2026-09-05 launch txAERA 2026-09-05 bundle tx (helper)AERA 2026-09-05 funding airdrop txBLISS 2026-09-23 launch txBLISS 2026-09-23 bundle tx (helper)BLISS 2026-09-23 funding airdrop txBLISS 2026-09-23 launch txBLISS 2026-09-23 bundle tx (helper)BLISS 2026-09-23 funding airdrop txfunder chain walletfunder chain walletfunder chain walletBLISS bundle txBLISS airdrop tx

Limits

  • Operator B is a smaller operation than A: the link rests on one funder wallet paying all five airdrops plus shared funding-chain wallets.
  • The tooling is shared with Operator A and about 100 other clusters. Using it does not link B to A, and the chain data shows no shared wallet between them.
  • Exit wallets reached through wash rebuys carry 85-90% attribution; the conservative floor (direct-funded exit + fees - bundle cost) is 43.3 ETH.
  • Three more launches were examined in the case folder (XERON 2026-08-21, goldcoin 2026-09-04 and one unnamed 2026-09-23) and are not part of the headline numbers; XERON's bundle netted -1.7 ETH in the ledger.
  • Jackpot and Harvest are tied to Operator B only through the upstream wallet 0xd5b20087..., which has sent 4,874 transactions; that is evidence of a shared funding source, not proof of one operator.
Case dossier
BLISS (bliss.fun): an 85% bundle, 59 ETH taken in a day
Part of the operation dossier above
Casehigh confidence

BLISS (bliss.fun, 0x0a8c39...5cc6) launched on 2026-09-23 17:06 UTC through Pons v2 and is Operator B's live case: the same bundler helper, wash contract and multisender as Operator A, with one funder wallet paying the airdrop 24 minutes before launch (16:42:20 UTC; the case file said about four hours, the block timestamp says 24 minutes). In the next block the bundler's 14.25 ETH bought out the curve, graduated the token and bought again through the helper, taking 853M BLISS (85% of supply). The operation put in 20.69 ETH (curve 4.29, bundle v4 buys 9.97, dev wallet buys 6.43) and took out 79.48 ETH (the bundle and the wallets it passed tokens to) (61.35 ETH from 2,447 exit sells, 18.13 ETH creator fees): +58.83 ETH ($157,140) net. The 146 cluster wallets hold 0.1251 ETH on 2026-10-03; 68.5 ETH of their outflows reached public hub contracts.

$157K
taken, net of cost
59 ETH
ETH net
25
bundle wallets
85%
of supply bundled
61 ETH
ETH exit

How the launches are linked

  • Same tooling as DEED: the helper 0x1e43ce00..., the wash contract 0xb06983db..., the multisender 0xe68d0bbc... and the identical recipient order in the airdrop (deployer, bundler, 25 bundle wallets, helpers). tx c6bb03tx 1308e0
  • Funded by 0xcd0bbef7..., the funder of every Operator B launch (Stocker x2, AERA, BLISS x2). tx c6bb03
  • No wallet or upstream funder is shared with DEED (Operator A traces to 0x9d0606c9...; BLISS traces to 0xd5b20087...). The two readings, one operator with fresh funding chains or a bundle-and-wash service used by different devs, cannot be told apart on chain data.

How they did it

Atomic bundle, wash-contract hand-off, router dump, claims on the creator tax; same script as DEED at a smaller size. The deployer spent 6.43 ETH buying its own token (18 swaps) while claiming fees.

  1. One airdropETH pays deployer, bundler and 25 bundle wallets.
  2. Launch, then in the next block one helper transaction: 25 curve buys, graduation, 25 v4 buys.
  3. 850M BLISS go to the wash contract (115 hops, net 0 ETH).
  4. Fresh wallets dump (2,447 sells).
  5. 234 fee claims.

Timeline

2026-09-23 16:42 UTC
Funder 0xcd0bbef7... calls airdropETH on the multisender: 50 recipients in the order deployer, bundler (14.32 ETH), 25 bundle wallets, helpers. tx c6bb03
2026-09-23 17:06 UTC
The deployer launches BLISS and buys 2M BLISS for 0.0034 ETH (block 70,678,889). tx 3dcc45
next block
The bundler sends 14.25 ETH through the helper in one transaction: 25 curve buys (4.28 ETH), graduation to Uniswap v4, 25 v4 buys (9.97 ETH). The bundle holds 853M BLISS. tx 1308e0
after launch
The bundle sends 850M BLISS to the wash contract; 115 hops net 0 ETH; the fresh wallets holding the rebuys dump through the router (2,447 sells, +61.35 ETH). tx 37fafd
2026-09-23 onward
The deployer makes 234 claim() calls on the fee escrow (17.97 ETH), buys 6.43 ETH of its own token in 18 swaps, sends ETH out in 87 other transactions (top target 0xb151f120..., 20 times), and ends at 0 ETH.
2026-10-03
The 146 cluster wallets hold 0.1251 ETH in total; 64.1 ETH left them through the multisender since launch. wallet 5b03

Launches

TokenWalletsSupplyETH inETH outETH taken (with fees)ExitEvidence
$BLISS
2026-09-23		2585%20.761.458.8driplaunch bundle first sell

The twin launch 0x0fa680...3d77 (same day, 30 minutes earlier, 19 wallets, 79% of supply) is part of Operator B and nets -1.55 ETH in the case file.

ETH taken is ETH out minus ETH in, plus the creator fees claimed, plus the deployer wallet's net spend or income. The bundle tables and the cover leave creator fees out, so the same launch shows a smaller figure there. Wallets here are those that took part in the bundle transaction; the bundle tables count every linked wallet by its peak holding.

Where the money went

Since launch the cluster sent 64.1 ETH out through 2465 multisender calls (calldata decoded) and 10.7 ETH by direct transfers (top destinations below). 68.5 ETH reached public hub contracts (0x4cd00e...bc31: 186,122 distinct ETH senders; 150,260 distinct WETH/USDG counterparties; the hub list); the trail ends there on chain data. The cluster holds 0.1251 ETH.

WalletWhat it isETHNote
0x4cd00e38…38bc31public contract (hub)69reached by direct transfer or traced hops from the cluster; contract (the hub list): 186,122 distinct ETH senders; 150,260 distinct WETH/USDG counterparties
0xd5b20087…85a6ffwallet (direct recipient)02 transfers from 1 cluster wallet(s) since launch
0x6470a914…05ade6wallet (direct recipient)01 transfers from 1 cluster wallet(s) since launch
0x25850369…a3a277wallet (direct recipient)01 transfers from 1 cluster wallet(s) since launch
0x0067aa6d…27c5cfwallet (direct recipient)01 transfers from 1 cluster wallet(s) since launch
0x35d8c558…c4716dwallet (direct recipient)01 transfers from 1 cluster wallet(s) since launch

Promotion

5 X posts in the Fable archive carry the contract address of these launches (from 5 accounts; posts that only match a ticker are not counted). 5 of them are judged so far; 2 posts by 2 accounts are judged as promoting the token. All 2 are listed below and in promo_posts_judged.csv. 1 post come from 1 project account the deployer typed into the token metadata and 1 post from 1 third-party account. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

AccountTokenPostedAfter launch
@LaunchOnBliss project account$BLISS2026-09-23 17:15 UTC9 minutes
@listingntm$BLISS2026-09-23 19:57 UTC2.9 hours

A project account is the X handle the deployer typed into the token's on-chain metadata. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 5 links

launch txbundle txairdrop txtokensweep tx

Limits

  • Exit wallets reached through wash rebuys carry 85-90% attribution (49.20 of the 61.35 ETH exit).
  • The case was investigated while the token was still trading; later exit sells are not in the PnL.
  • The chain data does not name a person.
Operation dossier
The $PONINU and $TRADOOR operation
Operationhigh confidenceTHREAT ACTOR

This operation links 3 deployer wallets and 3 launches (3 in the ledger) between 2026-09-05 and 2026-09-08 through 25 strong links (creator_funded,shared_wallets_x2); 3 of the launches are rugged. Bundle wallets took 80-83% of supply where a bundle is proven. The ledger puts the net taken by the bundle and the wallets it passed tokens to at 153.2 ETH ($380,282), plus 31.8 ETH of creator fee claims by the 3 deployers. The operation's 54 known wallets hold 0.332 ETH on 2026-10-03.

$380K
taken, net of cost
153 ETH
ETH net
3
launches
3
deployers
3
rugged

Net taken is the ledger's (the bundle ledger: ETH received selling by the bundle and the wallets it passed tokens to, minus ETH paid, round trips removed). Fee claims are the deployers' claims on the Pons fee escrow (the deployer ledger), shown separately and not added.

How the launches are linked

  • The airdrops 0xe4d50baa...20705d (from 0xd47cf9...c093) and 0x6ca1a0a0...878dba (from 0x712f09...c2da) both pay 23 of the same wallets: 0x0ecf03...e3da, 0x16d87b...afb7, 0x362ed9...17ef, 0x450e40...da09, 0x62dcf3...0f06.... tx e4d50btx 6ca1a0
  • The airdrops 0xe4d50baa...20705d (from 0xd47cf9...c093) and 0x88836a90...8c267c (from 0x9c78a6...ecd3) both pay 24 of the same wallets: 0x0ecf03...e3da, 0x16d87b...afb7, 0x362ed9...17ef, 0x450e40...da09, 0x5bd6b0...3e89.... tx e4d50btx 88836a
  • The airdrops 0x6ca1a0a0...878dba (from 0x712f09...c2da) and 0x88836a90...8c267c (from 0x9c78a6...ecd3) both pay 28 of the same wallets: 0x0bab03...34a1, 0x0ecf03...e3da, 0x10fda9...a4ed, 0x16d87b...afb7, 0x362ed9...17ef.... tx 6ca1a0tx 88836a
  • Strong link kind same_tx_bundle: 78 wallet pairs from 3 transaction(s): 3 or more distinct recipients, each holding at least 0.1% of supply, bought in ONE transaction inside the launch window.
  • Strong link kind creator_funded: 22 wallet pairs from 5 transaction(s): the deployer, or one funder of both, funded a wallet of the deployer's own launch cohort (direct transfer, shared first funder, or ONE multisender transaction that paid the deployer and a cohort wallet). tx 484a99tx c4eb23tx e4d50b
  • Re-checked on the public RPC: airdropETH from 0x9c78a6...ecd3 to 1 wallets, 1 of this operation's deployers and 0 of its bundle wallets in the recipient list (0.06 ETH) (status success). tx 484a99

How they did it

The bundle transaction landed 3 of 3 times in the very next block and within 1 blocks of launch in all cases. Bundle helpers used: bundler helper contract 0x1e43ce00 x3. Sell style: 3 drip.

Timeline

2026-09-05
PONINU: 26 bundle wallets, 80% of supply, net 120.14 ETH, rugged tier A, drip. tx 6de7f0tx 337533
2026-09-07
HENTER: 28 bundle wallets, 83% of supply, net -2.19 ETH, rugged tier A, drip. tx 1ca3a9tx 8b06fb
2026-09-08
TRADOOR: 28 bundle wallets, 82% of supply, net 35.28 ETH, rugged tier A, drip. tx 7d8aa2tx 69fe1f

Launches

TokenWalletsSupplyETH inETH outETH takenExitEvidence
$PONINU
2026-09-05		2680%8.12128120driplaunch bundle first sell
$TRADOOR
2026-09-08		2882%10.245.435.3driplaunch bundle first sell
$HENTER
2026-09-07		2883%11.49.21-2.19driplaunch bundle first sell

ETH columns are the ledger's; blank where the engine did not compute flows (thin sets).

Where the money went

Since the first launch the operation's 54 known wallets (deployers, funders and bundle wallets; 0 hub wallet(s) excluded) sent 0.0 ETH through 0 multisender calls (calldata decoded) and 0.0 ETH by direct transfers to non-infrastructure addresses; 0.0 ETH of that reached public hub contracts (the hub list fan-in contracts), where the chain trail ends. The wallets hold 0.332 ETH. Exit wallets that received tokens through wash rebuys are not in the operation's wallet list, so this covers the known wallets only.

Promotion

0 X posts in the Fable archive carry the contract address of these launches (from 0 accounts; posts that only match a ticker are not counted). 0 of them are judged so far and none is judged as promoting the token. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 59 links

PONINU launch txHENTER launch txTRADOOR launch txPONINU bundle txHENTER bundle txTRADOOR bundle txlinking txlinking txlinking txlinking txlinking txbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle wallet

Limits

  • Operation membership comes from the clusters pillar's frozen run (the operations table, built 2026-10-03 07:10:30, 3,297 operations); the live the operations table is rewritten every 5 minutes, so resolve by deployer address.
  • Net extraction is the ledger's engine figure, not hand-checked per wallet.
  • Where the history index does not yet reach a launch block, funding links are missing and the operation is at least as large as shown.
  • The money trail covers the known wallets only (deployers, funders, bundle wallets); wash-rebuy exit wallets are not in the operation wallet table.
  • The chain data does not name a person.
Operation dossier
The $SFX and $IMPERIUM operation
Operationhigh confidenceTHREAT ACTOR

This operation links 9 deployer wallets and 9 launches (9 in the ledger) between 2026-08-29 and 2026-10-02 through 166 strong links (bundle_signer,creator_funded); 6 of the launches are rugged. Bundle wallets took 30-70% of supply where a bundle is proven. The ledger puts the net taken by the bundle and the wallets it passed tokens to at 112.1 ETH ($288,782), plus 59.0 ETH of creator fee claims by the 9 deployers. The operation's 167 known wallets hold 0.711 ETH on 2026-10-03.

$289K
taken, net of cost
112 ETH
ETH net
9
launches
9
deployers
6
rugged

Some launches here are quoted in a token (USDG): their ETH figures are converted by the engine at a rate the ledger re-checked, and the ledger treats them as floors. Net taken is the ledger's (the bundle ledger: ETH received selling by the bundle and the wallets it passed tokens to, minus ETH paid, round trips removed). Fee claims are the deployers' claims on the Pons fee escrow (the deployer ledger), shown separately and not added.

How the launches are linked

  • Strong link kind creator_funded: 816 wallet pairs from 5 transaction(s): the deployer, or one funder of both, funded a wallet of the deployer's own launch cohort (direct transfer, shared first funder, or ONE multisender transaction that paid the deployer and a cohort wallet). tx 023ee2tx 0bab94tx 0d954a
  • Strong link kind same_tx_bundle: 63 wallet pairs from 9 transaction(s): 3 or more distinct recipients, each holding at least 0.1% of supply, bought in ONE transaction inside the launch window.
  • Re-checked on the public RPC: airdropETH from 0xc27af2...30d7 to 30 wallets, 1 of this operation's deployers and 17 of its bundle wallets in the recipient list (1.55 ETH) (status success). tx 023ee2
  • Re-checked on the public RPC: airdropETH from 0xc27af2...30d7 to 29 wallets, 1 of this operation's deployers and 17 of its bundle wallets in the recipient list (1.55 ETH) (status success). tx 0bab94
  • Re-checked on the public RPC: airdropETH from 0xc27af2...30d7 to 25 wallets, 1 of this operation's deployers and 4 of its bundle wallets in the recipient list (1.39 ETH) (status success). tx 0d954a
  • Re-checked on the public RPC: airdropETH from 0xc27af2...30d7 to 24 wallets, 1 of this operation's deployers and 17 of its bundle wallets in the recipient list (1.54 ETH) (status success). tx 109d25

How they did it

The bundle transaction landed 7 of 9 times in the very next block and within 3 blocks of launch in all cases. Bundle helpers used: bundling contract 0x60cd...7a09 x1; multi-wallet curve buyer 0x14b9a544 x8. Sell style: 4 dump, 5 drip.

Timeline

2026-08-29
IMPERIUM: 23 bundle wallets, 35% of supply, net 12.25 ETH, rugged tier A, dump. tx 76c4e1tx 6d05c7
2026-08-31
AERON: 25 bundle wallets, 41.5% of supply, net 8.93 ETH, rugged tier A, drip. tx 4658a0tx 6dfe11
2026-09-15
CUDA: 4 bundle wallets, 35% of supply, net 9.45 ETH, rugged tier A, drip. tx 1cb1batx 99bebf
2026-09-19
SFX: 8 bundle wallets, 70% of supply, net 73.38 ETH, rugged tier A, drip. tx 75964etx b594c8
2026-09-22
WARE: 4 bundle wallets, 35% of supply, net -1.06 ETH, live, dump. tx 599513tx b4e62b
2026-09-22
WARE: 4 bundle wallets, 35% of supply, net 7.89 ETH, rugged tier B, drip. tx 20b5f4tx 7391fd
2026-09-28
MAKE: 4 bundle wallets, 35% of supply, net -1.06 ETH, live, dump. tx fee4a7tx bfb8f1
2026-09-28
MAKE: 4 bundle wallets, 35% of supply, net 3.05 ETH, rugged tier B, drip. tx 1fe002tx f5a99b
2026-10-02
BRIER: 17 bundle wallets, 30% of supply, net -0.73 ETH, live, dump. tx 7db56dtx e46785

Launches

TokenWalletsSupplyETH inETH outETH takenExitEvidence
$SFX
2026-09-19		870%60.413373.4driplaunch bundle first sell
$IMPERIUM
2026-08-29		2335%1.1413.412.2dumplaunch bundle first sell
$CUDA
2026-09-15		435%1.1510.69.45driplaunch bundle first sell
$AERON
2026-08-31		2542%3.4112.28.93driplaunch bundle first sell
$WARE
2026-09-22		435%1.939.787.89driplaunch bundle first sell
$MAKE
2026-09-28		435%1.374.423.05driplaunch bundle first sell
$BRIER
2026-10-02		1730%0.840.11-0.73dumplaunch bundle first sell
$WARE
2026-09-22		435%1.060.00-1.06dumplaunch bundle first sell
$MAKE
2026-09-28		435%1.060.00-1.06dumplaunch bundle first sell

ETH columns are the ledger's; blank where the engine did not compute flows (thin sets).

Where the money went

Since the first launch the operation's 167 known wallets (deployers, funders and bundle wallets; 0 hub wallet(s) excluded) sent 59.4 ETH through 174 multisender calls (calldata decoded) and 1.4 ETH by direct transfers to non-infrastructure addresses; 39.4 ETH of that reached public hub contracts (the hub list fan-in contracts), where the chain trail ends. The wallets hold 0.711 ETH. Exit wallets that received tokens through wash rebuys are not in the operation's wallet list, so this covers the known wallets only.

WalletWhat it isETHNote
0x4cd00e38…38bc31public contract (hub)39reached by direct transfer or traced hops from this operation's wallets; contract (the hub list): 186,122 distinct ETH senders; 150,260 distinct WETH/USDG counterparties
0x6bf0d3ea…0c6f5dwallet (direct recipient)11 transfers from 1 operation wallet(s) since the first launch
0xab610742…a0a0a3multisender recipient34received 33.80 ETH from 29 operation wallet(s) through airdropETH calls (calldata decoded)
0x17295b1b…d8a00bmultisender recipient6received 5.57 ETH from 1 operation wallet(s) through airdropETH calls (calldata decoded)

Promotion

8 X posts in the Fable archive carry the contract address of these launches (from 7 accounts; posts that only match a ticker are not counted). 8 of them are judged so far; 2 posts by 2 accounts are judged as promoting the token. All 2 are listed below and in promo_posts_judged.csv. Token metadata was not loaded for this dossier, so project accounts are not separated from third-party accounts. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

AccountTokenPostedAfter launch
@Cross0verX$IMPERIUM2026-08-31 08:33 UTC41.2 hours
@CyanForester$MAKE2026-09-29 13:57 UTC22.4 hours

A project account is the X handle the deployer typed into the token's on-chain metadata. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 83 links

IMPERIUM launch txAERON launch txCUDA launch txSFX launch txWARE launch txWARE launch txMAKE launch txMAKE launch txBRIER launch txIMPERIUM bundle txAERON bundle txCUDA bundle txSFX bundle txWARE bundle txWARE bundle txMAKE bundle txMAKE bundle txBRIER bundle txlinking txlinking txlinking txlinking txlinking txbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle wallet

Limits

  • Operation membership comes from the clusters pillar's frozen run (the operations table, built 2026-10-03 07:10:30, 3,297 operations); the live the operations table is rewritten every 5 minutes, so resolve by deployer address.
  • Net extraction is the ledger's engine figure, not hand-checked per wallet.
  • Where the history index does not yet reach a launch block, funding links are missing and the operation is at least as large as shown.
  • The money trail covers the known wallets only (deployers, funders, bundle wallets); wash-rebuy exit wallets are not in the operation wallet table.
  • The chain data does not name a person.
Operation dossier
The $ROBDOG and $PENPE operation
Operationhigh confidenceTHREAT ACTOR

This operation links 2 deployer wallets and 2 launches (2 in the ledger) between 2026-09-10 and 2026-09-12 through 24 strong links (creator_funded); 2 of the launches are rugged. Bundle wallets took 70-80% of supply where a bundle is proven. The ledger puts the net taken by the bundle and the wallets it passed tokens to at 101.3 ETH ($252,696), plus 0.0 ETH of creator fee claims by the 2 deployers. The operation's 50 known wallets hold 0.053 ETH on 2026-10-03.

$253K
taken, net of cost
101 ETH
ETH net
2
launches
2
deployers
2
rugged

Some launches here are quoted in a token (AAPL, GME): their ETH figures are converted by the engine at a rate the ledger re-checked, and the ledger treats them as floors. Net taken is the ledger's (the bundle ledger: ETH received selling by the bundle and the wallets it passed tokens to, minus ETH paid, round trips removed). Fee claims are the deployers' claims on the Pons fee escrow (the deployer ledger), shown separately and not added.

How the launches are linked

  • The airdrops 0xdaea93ff...f4f91d (from 0xb41d1f...1ed0) and 0xec123183...ae5486 (from 0xb41d1f...1ed0) both pay 30 of the same wallets: 0x00ec72...51cc, 0x028c15...34de, 0x0c1568...7a7a, 0x0fe5f4...2341, 0x1372e5...0172.... tx daea93tx ec1231
  • Strong link kind same_tx_bundle: 54 wallet pairs from 2 transaction(s): 3 or more distinct recipients, each holding at least 0.1% of supply, bought in ONE transaction inside the launch window.
  • Strong link kind creator_funded: 12 wallet pairs from 2 transaction(s): the deployer, or one funder of both, funded a wallet of the deployer's own launch cohort (direct transfer, shared first funder, or ONE multisender transaction that paid the deployer and a cohort wallet). tx daea93tx ec1231
  • Re-checked on the public RPC: airdropETH from 0xb41d1f...1ed0 to 50 wallets, 1 of this operation's deployers and 44 of its bundle wallets in the recipient list (7.60 ETH) (status success). tx daea93
  • Re-checked on the public RPC: airdropETH from 0xb41d1f...1ed0 to 50 wallets, 1 of this operation's deployers and 32 of its bundle wallets in the recipient list (4.02 ETH) (status success). tx ec1231

How they did it

The bundle transaction landed 2 of 2 times in the very next block and within 1 blocks of launch in all cases. Bundle helpers used: bundler helper contract 0x1e43ce00 x1; multi-wallet curve buyer 0x14b9a544 x1. Sell style: 2 drip.

Timeline

2026-09-10
PENPE: 28 bundle wallets, 80% of supply, net 47.14 ETH, rugged tier B, drip. tx 335b66tx c30caa
2026-09-12
ROBDOG: 29 bundle wallets, 70% of supply, net 54.17 ETH, rugged tier A, drip. tx 6e2981tx fc13f7

Launches

TokenWalletsSupplyETH inETH outETH takenExitEvidence
$ROBDOG
2026-09-12		2970%3.8657.754.2driplaunch bundle first sell
$PENPE
2026-09-10		2880%21.867.847.1driplaunch bundle first sell

ETH columns are the ledger's; blank where the engine did not compute flows (thin sets).

Where the money went

Since the first launch the operation's 50 known wallets (deployers, funders and bundle wallets; 0 hub wallet(s) excluded) sent 21.2 ETH through 304 multisender calls (calldata decoded) and 3.5 ETH by direct transfers to non-infrastructure addresses; 0.0 ETH of that reached public hub contracts (the hub list fan-in contracts), where the chain trail ends. The wallets hold 0.053 ETH. Exit wallets that received tokens through wash rebuys are not in the operation's wallet list, so this covers the known wallets only.

WalletWhat it isETHNote
0xf4c857d7…aa0397wallet (direct recipient)219 transfers from 2 operation wallet(s) since the first launch
0xc6a51b90…a89e90wallet (direct recipient)11 transfers from 1 operation wallet(s) since the first launch

Promotion

154 X posts in the Fable archive carry the contract address of these launches (from 53 accounts; posts that only match a ticker are not counted). 154 of them are judged so far; 136 posts by 49 accounts are judged as promoting the token. The first 10 are listed below; all 136 are in promo_posts_judged.csv. Token metadata was not loaded for this dossier, so project accounts are not separated from third-party accounts. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

AccountTokenPostedAfter launch
@penpehood$PENPE2026-09-10 14:59 UTC3 minutes
@listingntm$PENPE2026-09-10 15:02 UTC6 minutes
@SatoshiOwl$PENPE2026-09-10 15:15 UTC18 minutes
@ChinaDegen$PENPE2026-09-10 15:27 UTC30 minutes
@Trader_Jibon$PENPE2026-09-10 15:32 UTC35 minutes
@kingfrogsensei$PENPE2026-09-10 15:38 UTC42 minutes
@Trader_Jibon$PENPE2026-09-10 16:09 UTC73 minutes
@SatoshiOwl$PENPE2026-09-10 17:21 UTC2.4 hours
@FuryMetaa$PENPE2026-09-10 17:31 UTC2.6 hours
@kingfrogsensei$PENPE2026-09-11 10:48 UTC19.9 hours

A project account is the X handle the deployer typed into the token's on-chain metadata. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 53 links

PENPE launch txROBDOG launch txPENPE bundle txROBDOG bundle txlinking txlinking txbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle walletbundle wallet

Limits

  • Operation membership comes from the clusters pillar's frozen run (the operations table, built 2026-10-03 07:10:30, 3,297 operations); the live the operations table is rewritten every 5 minutes, so resolve by deployer address.
  • Net extraction is the ledger's engine figure, not hand-checked per wallet.
  • Where the history index does not yet reach a launch block, funding links are missing and the operation is at least as large as shown.
  • The money trail covers the known wallets only (deployers, funders, bundle wallets); wash-rebuy exit wallets are not in the operation wallet table.
  • The chain data does not name a person.
Cohort dossier
The W set: 14 bundled launches by 14 deployers on shared tooling, 209 ETH
Cohortlow (tooling link; 3 funder(s) each paid two launches) confidenceNOT ONE OPERATION

The W set is 14 launches by 14 deployer wallets between 2026-09-03 and 2026-09-09 that ran the same bundle script: one transaction buying out the curve (10 of 14 in the very next block and the rest up to 6 blocks after launch). 10 of the 14 are rugged, 2 graduated without being rugged (BOOMER, WORM) and 2 died with a thin 1% bundle. The bundles held 45-82% of supply in the rugged launches. The ledger puts the net taken by the bundle and the wallets it passed tokens to at 209.1 ETH-equivalent ($520,549): 4.4 ETH from 1 ETH-quoted launch(es) and 204.7 ETH from 11 launches quoted in a token (QQQ, SPY, USDG and others), converted to ETH by the engine at a rate the ledger re-checked (16,189 of 16,192 rows agree within 15%); the ledger treats all of these as floors. WORM is 134.4 ETH of it, BOOMER 34.0 ETH and KRONUS 14.2 ETH. Most deployers are unrelated to each other: the launches share tooling (the bundler helper contract 0x1e43ce...2618 carried 3 of the 14 bundle transactions; about 100 clusters use it) and a timeframe. The exception is 3 funder wallet(s) that each paid the airdrops of two of these launches (0x28fa2c...104a paid the funding airdrops of BOW and SHARO; 0x61a9cd...c417 paid the funding airdrops of DELIVERY and HABIBI; 0x67e6b2...bd96 paid the funding airdrops of SPAN and EVERY). This dossier records the tooling users, not a single threat-actor operation. BIAO, which sits in the same case folder, is not in this set: 39 of the 50 recipients of its funding airdrop are also recipients of Operator A's airdrops, so it is listed under Operator A.

$521K
taken, net of cost
209 ETH
ETH net
14
launches
14
deployers
10
rugged

Numbers are the ledger's (the bundle ledger): ETH received on selling by the bundle and the wallets it passed tokens to, minus ETH paid. Most of these launches are quoted in a stock or USD token (QQQ, SPY, USDG, ...), so the quote is shown per launch; their flows are converted to ETH by the engine (flows_basis quote_engine or quote_ledger) and gross in/out are shown only for ETH-quoted launches. The ledger calls these figures floors. The case folder's hand pipeline only priced ETH flows, so it is not used here.

How the launches are linked

  • All 14 launches ran a one-transaction bundle (10 of 14 in the very next block and the rest up to 6 blocks after launch; 14 of 14 bundle transactions re-checked on chain: status success). This is a method fingerprint shared with about 100 other clusters, not a link. tx f15a6dtx f3842atx 6a5ec3
  • One funder wallet, 0x28fa2c...104a, paid the multisender airdrops of 2 of these launches (BOW, SHARO), each to a different deployer. tx 257626tx b68ed1
  • One funder wallet, 0x61a9cd...c417, paid the multisender airdrops of 2 of these launches (DELIVERY, HABIBI), each to a different deployer. tx fe6ddbtx 742671
  • One funder wallet, 0x67e6b2...bd96, paid the multisender airdrops of 2 of these launches (SPAN, EVERY), each to a different deployer. tx 4b2007tx fe802f
  • Beyond those 3 funder(s), no shared funder, fee recipient or payout wallet is established between the 14 deployers in the data read (the funding airdrop of each launch was re-read from the RPC).
  • BIAO is excluded from this set: the funding airdrop 0x10561aca...9f8c8b from 0xb75876...a9cb pays 50 wallets and 39 of them are also paid by Operator A's TAPE, PINK and IJA airdrops. tx 10561a

How they did it

Same script as Operators A and B on a smaller scale: a bundler wallet sends one transaction that buys out the curve with 10-32 wallets, the bundle then sells as a drip or a dump; the wash contract is used in the largest launches (WORM, BOOMER).

  1. Bundle wallets are funded shortly before launch.
  2. Within 6 blocks of launch (10 of 14 in the very next block): one bundler transaction buys out the curve through the bundler helper contract.
  3. The bundle sells as a dump (sold within minutes) or a drip (over hours).
  4. Creator fee claims are zero for 8 of 10 rugged launches, so claims on the creator tax play a small part here.

Timeline

2026-09-03
ARTHUR: 18 bundle wallets, 69.9% of supply, quote ETH, net 4.41 ETH-equivalent, rugged tier A. tx 74ebc5tx f15a6d
2026-09-03
BOOMER: 10 bundle wallets, 79.0% of supply, quote SPY, net 34.02 ETH-equivalent, bonded. tx b5b934tx f3842a
2026-09-05
BOW: 23 bundle wallets, 45% of supply, quote USDG, net 10.69 ETH-equivalent, rugged tier A. tx a26790tx 6a5ec3
2026-09-05
DELIVERY: 10 bundle wallets, 68% of supply, quote UPS, net 2.58 ETH-equivalent, rugged tier A. tx 15ec0dtx 5d0bf5
2026-09-05
MDMA: 13 bundle wallets, 49% of supply, quote TSLA, net -0.13 ETH-equivalent, rugged tier A. tx 3a3488tx 892954
2026-09-07
WIN98: 13 bundle wallets, 55% of supply, quote MSFT, net 4.29 ETH-equivalent, rugged tier A. tx 7f6e64tx d920d3
2026-09-07
SPAN: 30 bundle wallets, 71.2% of supply, quote USDG, net 0.12 ETH-equivalent, rugged tier A. tx 478e11tx 112684
2026-09-07
EVERY: 32 bundle wallets, 69.2% of supply, quote USDG, net -0.42 ETH-equivalent, rugged tier A. tx 072b98tx a40c92
2026-09-08
HABIBI: 10 bundle wallets, 68% of supply, quote USO, net 2.55 ETH-equivalent, rugged tier A. tx 094364tx 0f24c8
2026-09-08
KRONUS: 17 bundle wallets, 82% of supply, quote USDG, net 14.19 ETH-equivalent, rugged tier A. tx f5841ftx 45f053

The ten largest of 14 launches

TokenWalletsSupplyETH inETH outETH taken (with fees)ExitEvidence
$WORM
2026-09-08		3575%0.000.00134dumplaunch bundle first sell
$BOOMER
2026-09-03		1079%0.000.0034.0dumplaunch bundle first sell
$KRONUS
2026-09-08		1782%0.000.0014.2driplaunch bundle first sell
$BOW
2026-09-05		2345%0.000.0010.7dumplaunch bundle first sell
$ARTHUR
2026-09-03		1870%15.620.04.41driplaunch bundle first sell
$WIN98
2026-09-07		1355%0.000.004.29driplaunch bundle first sell
$DELIVERY
2026-09-05		1068%0.000.002.58driplaunch bundle first sell
$HABIBI
2026-09-08		1068%0.000.002.55driplaunch bundle first sell
$SHARO
2026-09-08		2245%0.000.002.44driplaunch bundle first sell
$SPAN
2026-09-07		3071%0.000.000.12dumplaunch bundle first sell

ETH columns are shown only where the ledger measured gross flows in ETH; net is the ledger's net extraction. The rows with a 29-wallet bundle holding about 1% of supply died.

ETH taken is ETH out minus ETH in, plus the creator fees claimed, plus the deployer wallet's net spend or income. The bundle tables and the cover leave creator fees out, so the same launch shows a smaller figure there. Wallets here are those that took part in the bundle transaction; the bundle tables count every linked wallet by its peak holding.

Where the money went

Not traced for this set. The money trail is built per operation; this set is a cohort of mostly independent deployers, so there is no single sink to report.

Promotion

7 X posts in the Fable archive carry the contract address of these launches (from 7 accounts; posts that only match a ticker are not counted). 7 of them are judged so far; 5 posts by 5 accounts are judged as promoting the token. All 5 are listed below and in promo_posts_judged.csv. Token metadata was not loaded for this dossier, so project accounts are not separated from third-party accounts. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

AccountTokenPostedAfter launch
@Zilla_Byte$WIN982026-09-12 06:59 UTC4.9 days
@100xGemssss$WORM2026-09-22 08:22 UTC13.6 days
@signalcalls$WORM2026-09-23 14:14 UTC14.8 days
@travladd$WORM2026-09-25 14:49 UTC16.8 days
@Hydraze420$WORM2026-09-27 09:56 UTC18.6 days

A project account is the X handle the deployer typed into the token's on-chain metadata. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 34 links

ARTHUR launch txBOOMER launch txBOW launch txDELIVERY launch txMDMA launch txWIN98 launch txSPAN launch txEVERY launch txHABIBI launch txKRONUS launch txWORM launch txSHARO launch txBROOOO launch txNIGGER launch txARTHUR bundle txBOOMER bundle txBOW bundle txDELIVERY bundle txMDMA bundle txWIN98 bundle txSPAN bundle txEVERY bundle txHABIBI bundle txKRONUS bundle txWORM bundle txSHARO bundle txBROOOO bundle txNIGGER bundle txshared funder airdropshared funder airdropshared funder airdropshared funder airdropshared funder airdropshared funder airdrop

Limits

  • Only 3 funder(s) link launches inside this set; the other deployers are not linked to each other by any wallet evidence read here.
  • Most launches here are quoted in a stock or USD token; their ETH figures are the ledger's converted flows (rate re-checked by the ledger, not hand-checked on chain here); the hand pipeline in the case file only priced ETH flows and shows zero exit for them.
  • Thin sets: the launches with a minor bundle have no flows.
  • The chain data does not name a person.
Case dossier
LOATHE AI: a 23-wallet insider snipe behind a 3-hop funding chain
Casehigh for the wallet link (traced on chain); the forensics engine does not flag the launch confidence

LOATHE AI (0xe07c0b...4e4e) is the small case that shows how a linked snipe hides. Launched 2026-09-17 18:19:51 UTC on the Pons curve (it never graduated), it was sniped by 23 wallets that all bought through one contract in blocks +48 to +64 (0.5008 ETH) and sold for 1.3305 ETH. Each sniper was funded through a three-hop chain (funder, 23 hop-1 wallets, 23 hop-2 wallets), so the wallets look unrelated, but all 23 proceeds transfers (1.3388 ETH) ended in one collector wallet. With the creator-fee share (funder, 0.3364 ETH) and a volume bot's payments (0.1652 ETH) the collector received 1.8411 ETH attributable to LOATHE against 0.886 ETH of capital: +0.96 ETH (about $2,500). The forensics engine rates this launch green (no_links) and the ledger calls it live, so the forensics rule (3 or more linked wallets holding 20% or more of supply) does not flag it; the link shows only when the funding chain is followed on chain.

$2.5K
taken, net of cost
1 ETH
ETH net
23
linked snipers
1.33 ETH
ETH sold

How the launches are linked

  • All 23 sniper buys went through one contract (0xbfacc6...7b00) within 16 blocks, to 23 distinct wallets (verified in the indexed trades: 23 buys, 0.5008 ETH). tx d2a3fbtx 1c51f1
  • The snipers' proceeds (23 transfers, 1.3388 ETH) all went to one collector wallet. tx 7bb564tx 14509ftx 624116
  • The 23 snipers were each funded by a hop-2 wallet funded by a hop-1 wallet funded by the same funder (0.886 ETH to 34 wallets). tx c6facatx cf27cdtx 82731e

How they did it

Insider snipe with a layered funding chain: fund, forward, fund again, buy in the first seconds through one contract, sell, send everything to one collector.

  1. Funder pays 34 wallets (0.886 ETH): deployer, 23 hop-1, 11 gas wallets, collector.
  2. Hop-1 wallets forward their exact balance to 23 fresh hop-2 wallets.
  3. Hop-2 wallets fund the 23 snipers.
  4. Snipers buy through one contract in blocks +48 to +64.
  5. They sell and send the proceeds to the collector; the deployer's fee share and a volume bot's buys also go there.

Timeline

2026-09-17 18:18 to 18:19 UTC
The funder sends 0.886 ETH to 34 wallets; the 23 hop-1 wallets forward their exact balance to 23 fresh hop-2 wallets (0.5107 ETH in total), which fund the 23 snipers. tx c6facatx cf27cdtx 82731e
2026-09-17 18:19 UTC
The deployer launches LOATHE (block 65,576,540). tx d74a96
blocks +48 to +64 (about 5 seconds)
The 23 snipers buy through one contract, 0.5008 ETH in descending sizes. tx d2a3fbtx 1c51f1
2026-09-17 18:49 UTC
Sniper proceeds start moving to the collector: 23 transfers, 1.3388 ETH in total. tx 7bb564tx 14509ftx 624116
2026-09-18 to 2026-09-23
The collector sends 1.33 ETH to a 163-byte forwarding contract and 0.705 ETH to a second wallet (case file). wallet 442fwallet 2018
2026-10-02
The collector sends 0.22 ETH (20:05 UTC) and 0.35 ETH (21:29 UTC) to two new wallets and a last transfer to the forwarding contract at 21:32 UTC. wallet 548bwallet 1437
2026-10-03
The collector holds 0.0026 ETH; LOATHE is still trading (859 trades in the ledger). wallet f90f

Launches

TokenWalletsSupplyETH inETH outETH taken (with fees)ExitEvidence
$LOATHE
2026-09-17		230%0.501.330.96snipe, sold within about 1,000 to 15,600 blockslaunch

Scale note: this case is small (about 0.96 ETH net). It is in the set because it shows the funding-chain disguise, not because of its size.

ETH taken is ETH out minus ETH in, plus the creator fees claimed, plus the deployer wallet's net spend or income. The bundle tables and the cover leave creator fees out, so the same launch shows a smaller figure there. Wallets here are those that took part in the bundle transaction; the bundle tables count every linked wallet by its peak holding.

Where the money went

The collector took in 1.8411 ETH from LOATHE sources. By 2026-09-23 it had sent 1.33 ETH to a 163-byte forwarding contract and 0.705 ETH to another wallet; since then it kept sending to the forwarder (1.2034 ETH in 29 transfers in the index since 2026-09-21) and on 2026-10-02 moved 0.22 ETH and 0.35 ETH to two new wallets. It holds 0.0026 ETH on 2026-10-03 (1.3635 ETH on 2026-09-23).

WalletWhat it isETHNote
0x442f44ed…42833dforwarding contract (163 bytes)1received 1.33 ETH from the collector (case file)
0x201892b6…6931bfwallet1received 0.705 ETH from the collector (case file)
0x548bcfdf…d2adbdwallet0received 0.22 ETH from the collector on 2026-10-02 (the indexed ETH transfers)
0x14375df0…d6171awallet0received 0.35 ETH from the collector on 2026-10-02 (the indexed ETH transfers)

Promotion

0 X posts in the Fable archive carry the contract address of these launches (from 0 accounts; posts that only match a ticker are not counted). 0 of them are judged so far and none is judged as promoting the token. Judgment source: Llama 3.3 70B with a verbatim-quote check on the stance judgments. A post that promotes a token is not evidence that the account knew who held the bundle.

Evidence, 58 links

launch txtokencollectorfunderfunder transferfunder transferfunder transferfunder transferfunder transferfunder transferfunder transferfunder transfersniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper buysniper to collector

Limits

  • The sniper-to-collector transfers and the funder chain come from the case file's transfer history; the transaction index does not cover those blocks yet (the funder transfers were re-read from the RPC).
  • The ledger classifies the launch as live and the forensics engine as green (no_links): the wallet link is shown by tracing the funding chain, which the detector's rule does not do, and the launch is not a rug.
  • The chain data does not name a person.
Largest operations in the table

Cards show net of cost with creator fees left out. Each operation below contains at least one rugged launch.

Where the cluster table places the two hand-compiled case files

The wallet-cluster run holds the deployers of Operator A and Operator B in the operations below. A piece with two or more deployers and a rugged launch is a threat actor operation by the rule; a piece with one deployer is a single deployer. They are not given separate cards because the dossiers above cover them.

Case fileDeployersLaunchesRuggedTaken, netCase deployers insideConfidence
Operator A, piece 1222222$10.8M19 of 31medium
Operator A, piece 2131312$371K7 of 31high
Operator A, piece 3222$22K2 of 31high
Operator A, piece 4111$39K1 of 31low
Operator B, piece 1887$398K5 of 5medium
Operation 01 · 214 rugged launches of 537 launches
$932K taken
Largest launches: $FUGAZI, $Community, $LEGS
medium confidenceTHREAT ACTOR
$932K
taken, net of cost
374 ETH
net
537
launches
7
deployers
57
linked wallets

How they did it

  • Linked by: the creator funded the bundle wallets. 14 strong links and 6 weak links.
  • Several linked wallets received tokens in one transaction in 459 of 459 bundled launches.
  • A bundler helper contract bought for all wallets in one transaction in 459 of 459 bundled launches.

Where the money went

No sink was reached for this operation in the money trail, which reads native ETH history from Sep 15, 2026. The net ETH above is a floor and its destination is not established.

Promotion accounts

No X post carrying these contracts was found in the crawl.

TokenDateWalletsSupplyFirst sellNet USDEvidence
$FUGAZI
0x6abb18…0f3a		Sep 6543%29 seconds$7.8Ktx token
$Community
0xec47a8…10ee		Sep 6543%23 seconds$7.3Ktx token
$LEGS
0xcacbde…edc8		Sep 3441%12 seconds$6.3Ktx token

Evidence

$FUGAZI launch$Community launch$LEGS launchlink txlink txdeployer 0xaa5e…5737deployer 0x5d16…0764
Operation 02 · 76 rugged launches of 147 launches
$349K taken
Largest launches: $Pisscoin, $AI, $Chadnev
medium confidenceTHREAT ACTOR
$349K
taken, net of cost
140 ETH
net
147
launches
3
deployers
18
linked wallets

How they did it

  • Linked by: the creator funded the bundle wallets. 9 strong links and 2 weak links.
  • Several linked wallets received tokens in one transaction in 130 of 130 bundled launches.
  • A bundler helper contract bought for all wallets in one transaction in 130 of 130 bundled launches.

Where the money went

No sink was reached for this operation in the money trail, which reads native ETH history from Sep 15, 2026. The net ETH above is a floor and its destination is not established.

Promotion accounts

No X post carrying these contracts was found in the crawl.

TokenDateWalletsSupplyFirst sellNet USDEvidence
$Pisscoin
0x9c0145…1b44		Sep 4427%62 seconds$12Ktx token
$AI
0x2c2f30…dcc7		Sep 4630%7 seconds$12Ktx token
$Chadnev
0x20aacf…03a5		Sep 4427%65 seconds$7.4Ktx token

Evidence

$Pisscoin launch$AI launch$Chadnev launchlink txlink txdeployer 0xa7aa…af34deployer 0x4c8b…ee81
Operation 03 · 13 rugged launches of 22 launches
$313K taken
Largest launches: $sponsor, $tree, $OMNI
medium confidencepartialTHREAT ACTOR
$313K
taken, net of cost
125 ETH
net
22
launches
22
deployers
158
linked wallets

How they did it

  • Linked wallets bought in the launch block in 20 of 20 bundled launches.
  • The creator registered the buying wallets to skip the snipe tax in 20 of 20 bundled launches.
  • Linked wallets sold out within minutes in 19 of 20 bundled launches.

Where the money went

  • 100% Swapped to other tokens: 11 ETH ($28K).

Promotion accounts

No X post carrying these contracts was found in the crawl.

TokenDateWalletsSupplyFirst sellNet USDEvidence
$sponsor
0xe3dfb8…f63f		Sep 61239%1 second$130Ktx token
$tree
0xfa3eb0…578a		Sep 3836%1 second$42Ktx token
$OMNI
0x88cf1a…5a95		Sep 1926%2 minutes$40Ktx token

Evidence

$sponsor launch$tree launch$OMNI launchlink txlink txdeployer 0x0abf…84efdeployer 0x13ab…a161
Operation 04 · 2 rugged launches of 4 launches
$238K taken
Largest launches: $Harvest, $Jackpot, $NIGGER
medium confidenceTHREAT ACTOR
$238K
taken, net of cost
97 ETH
net
4
launches
4
deployers
97
linked wallets

How they did it

  • Linked by: one signer sent the bundle transactions across launches; the creator funded the bundle wallets. 90 strong links and 2 weak links.
  • Linked wallets sold out within minutes in 2 of 2 bundled launches.
  • Exit routed through the PullWash volume bot in 2 of 2 bundled launches.

Where the money went

No sink was reached for this operation in the money trail, which reads native ETH history from Sep 15, 2026. The net ETH above is a floor and its destination is not established.

Promotion accounts

1 post from 1 account carries contracts of these launches. Accounts are listed only once judged as promoting.

TokenDateWalletsSupplyFirst sellNet USDEvidence
$Harvest
0x22d141…03dc		Sep 102984%2 seconds$199Ktx token
$Jackpot
0xdcb3bc…de21		Sep 92980%2 seconds$39Ktx token
$NIGGER
0xdf89d5…15da		Sep 9291%n/a$0tx token

Evidence

$Harvest launch$Jackpot launch$NIGGER launchlink txlink txdeployer 0x944c…75efdeployer 0xbee5…097d
Operation 05 · 65 rugged launches of 160 launches
$235K taken
Largest launches: $Poblade, $CLARUS, $SOLD
medium confidenceTHREAT ACTOR
$235K
taken, net of cost
95 ETH
net
160
launches
6
deployers
42
linked wallets

How they did it

  • Linked by: the creator funded the bundle wallets. 14 strong links and 5 weak links.
  • Several linked wallets received tokens in one transaction in 125 of 125 bundled launches.
  • A bundler helper contract bought for all wallets in one transaction in 125 of 125 bundled launches.

Where the money went

No sink was reached for this operation in the money trail, which reads native ETH history from Sep 15, 2026. The net ETH above is a floor and its destination is not established.

Promotion accounts

No X post carrying these contracts was found in the crawl.

TokenDateWalletsSupplyFirst sellNet USDEvidence
$Poblade
0x251e24…dc99		Sep 6524%2 minutes$6.5Ktx token
$CLARUS
0xe3005e…80b2		Sep 5524%60 seconds$5.9Ktx token
$SOLD
0xe82b8d…f7d0		Sep 6524%74 seconds$5.5Ktx token

Evidence

$Poblade launch$CLARUS launch$SOLD launchlink txlink txdeployer 0x509a…3d19deployer 0x1b60…cfff
Operation 06 · 4 rugged launches of 4 launches
$225K taken
Largest launches: $STOCKFATHER, $GUH, $TAMC
medium confidenceTHREAT ACTOR
$225K
taken, net of cost
91 ETH
net
4
launches
4
deployers
74
linked wallets

How they did it

  • Linked by: one signer sent the bundle transactions across launches; the creator funded the bundle wallets. 68 strong links and 4 weak links.
  • Several linked wallets received tokens in one transaction in 4 of 4 bundled launches.
  • A bundler helper contract bought for all wallets in one transaction in 4 of 4 bundled launches.

Where the money went

No sink was reached for this operation in the money trail, which reads native ETH history from Sep 15, 2026. The net ETH above is a floor and its destination is not established.

Promotion accounts

No X post carrying these contracts was found in the crawl.

TokenDateWalletsSupplyFirst sellNet USDEvidence
$STOCKFATHER
0x5d1560…ae3e		Sep 42173%81 seconds$158Ktx token
$GUH
0x5f5864…6e5e		Sep 31463%2 minutes$27Ktx token
$TAMC
0xd006a2…36c0		Sep 41463%2 minutes$20Ktx token

Evidence

$STOCKFATHER launch$GUH launch$TAMC launchlink txlink txdeployer 0xfd5d…7e77deployer 0x2302…0701
Operation 07 · 4 rugged launches of 4 launches
$177K taken
Largest launches: $process, $asset, $GHU
medium confidencepartialTHREAT ACTOR
$177K
taken, net of cost
73 ETH
net
4
launches
4
deployers
32
linked wallets

How they did it

  • Linked wallets sold out within minutes in 4 of 4 bundled launches.
  • Exit routed through the PullWash volume bot in 4 of 4 bundled launches.
  • Several linked wallets received tokens in one transaction in 4 of 4 bundled launches.

Where the money went

No sink was reached for this operation in the money trail, which reads native ETH history from Sep 15, 2026. The net ETH above is a floor and its destination is not established.

Promotion accounts

No X post carrying these contracts was found in the crawl.

TokenDateWalletsSupplyFirst sellNet USDEvidence
$process
0x793ad7…d070		Sep 42462%4 seconds$74Ktx token
$asset
0x8155da…7731		Sep 51664%3 seconds$43Ktx token
$GHU
0xc2c9f0…c79a		Sep 32562%4 seconds$35Ktx token

Evidence

$process launch$asset launch$GHU launchlink txdeployer 0xd8b2…4c50deployer 0xdff2…1070
Operation 08 · 10 rugged launches of 29 launches
$167K taken
Largest launches: $Looprat, $ORVIA, $STPDM
high confidenceTHREAT ACTOR
$167K
taken, net of cost
66 ETH
net
29
launches
16
deployers
123
linked wallets

How they did it

  • Linked by: one signer sent the bundle transactions across launches; the creator funded the bundle wallets. 73 strong links and 0 weak links.
  • Creator fees claimed from the Pons fee escrow in 24 of 24 bundled launches.
  • The creator registered the buying wallets to skip the snipe tax in 24 of 24 bundled launches.

Where the money went

  • 100% Swapped to other tokens: 1 ETH ($1.6K).
  • 0% Still parked: 0 ETH ($55).

Promotion accounts

  • @Doeflowgetdoe posted a contract of 1 launch (1 post, first 1.6 hours after launch). post
  • @King_Memento posted a contract of 1 launch (1 post, first 1.6 hours after launch). post
TokenDateWalletsSupplyFirst sellNet USDEvidence
$Looprat
0x642d30…68c7		Sep 3435%3 seconds$62Ktx token
$ORVIA
0xd8a16f…67d6		Sep 101050%2 seconds$38Ktx token
$STPDM
0x33021c…53b7		Sep 21545%5 seconds$23Ktx token

Evidence

$Looprat launch$ORVIA launch$STPDM launchlink txlink txdeployer 0x89e6…8043deployer 0xa9cb…b995
Operation 09 · 4 rugged launches of 4 launches
$164K taken
Largest launches: $run, $CANDLE, $TROMERO
medium confidencepartialTHREAT ACTOR
$164K
taken, net of cost
66 ETH
net
4
launches
4
deployers
38
linked wallets

How they did it

  • Linked wallets sold out within minutes in 4 of 4 bundled launches.
  • Exit routed through the PullWash volume bot in 4 of 4 bundled launches.
  • Several linked wallets received tokens in one transaction in 4 of 4 bundled launches.

Where the money went

No sink was reached for this operation in the money trail, which reads native ETH history from Sep 15, 2026. The net ETH above is a floor and its destination is not established.

Promotion accounts

No X post carrying these contracts was found in the crawl.

TokenDateWalletsSupplyFirst sellNet USDEvidence
$run
0x941191…3798		Sep 62264%3 seconds$47Ktx token
$CANDLE
0x161825…4953		Sep 61565%2 seconds$42Ktx token
$TROMERO
0x7ae9b6…0a4b		Sep 61563%2 seconds$38Ktx token

Evidence

$run launch$CANDLE launch$TROMERO launchlink txdeployer 0x92b8…a47bdeployer 0x43ae…dff1

The largest single bundles with no operation link

Not every large bundle belongs to an operation. The largest that nothing links to any other launch is $WOOD (2,923 ETH, a Uniswap-launched token, 2,753 ETH chain-checked as the linked wallets' own selling; hand-off remainder not replayed); the largest Pons-style launch with no link is $STRATTON (784 ETH, a Pons-style launch, quoted in SPY). Their deployer is in no multi-deployer operation and neither launch is part of a dossier above, so each stands alone in the data.

TokenWalletsSupplyNet ETHNet USDEvidence
$WOOD 2,753 ETH chain-checked as the linked wallets' own selling; hand-off remainder not replayed
2026-07-13, uniswap v2		20061%2,923$5.2Mlaunch token
$VRAX
2026-10-01, uniswap v3		662%960$2.6Mlaunch token
$SI
2026-09-30, uniswap v3		1091%790$2.1Mlaunch token
$STRATTON quoted in SPY
2026-09-02, pons v2 curve		1065%784$1.9Mlaunch token
$CYBERCAT quoted in TSLA
2026-09-15, pons v2 curve		3288%254$611Klaunch token
$RPG quoted in GME
2026-09-08, pons v2 curve		3786%193$480Klaunch token
Money trail

Where the extracted ETH goes

Liquidity flows follow extracted ETH from the bundle and the wallets it passed tokens to through every hop until it reaches a sink: bridged out, an exchange-style deposit cluster, recycled into new launches, or parked.

Sink breakdown, all traced operations

10,619 ETHExtracted ETH, traced operationsStill parked319 ETH · $828KRecycled into new launches220 ETH · $576KSwapped to other tokens172 ETH · $448KExchange-style deposit clusters101 ETH · $259KNot traced yet9,808 ETH · history loading

By sink

SinkOperationsETHUSDShare of traced
Still parked119319$828K39%
Recycled into new launches285220$576K27%
Swapped to other tokens474172$448K21%
Exchange-style deposit clusters59101$259K12%

Largest single sinks

SinkKindETHUSDEvidence
0xa82dd456…e58543Recycled into new launches60$162Ktx 1
0x205501e3…1799b8Still parked43$109Ktx 1
0xc1703f9d…bb1447Still parked27$74Ktx 1
0x0aae618f…c81e92Exchange-style deposit clusters24$63Ktx 1 tx 2
0x68e9dc1c…15926eStill parked22$60Ktx 1
0x8ddcb997…f5341fStill parked18$49Ktx 1
0x208a0cdf…31d42cStill parked17$41Ktx 1
0x9caddb60…161effStill parked16$41Ktx 1

The money trail is built on the frozen cluster run (built 2026-10-03 07:10:30 UTC). 2,848 of its 3,297 operations were traced from wallets of their own; 442 more have only infrastructure wallets or belong to a bigger operation, and their money is counted there.

The trail run read native ETH history from Sep 15, 2026 on; the transaction index has since grown back to Sep 14, 2026, block 62,398,000. ETH that left before the start of the run is not observable yet; USDG transfers cover the full history. WETH, the token form of ETH, was followed in a separate check and added nothing for Operator A: its 79.3 ETH-eq of WETH sits in 3 wallets and all of it went into the hub 0xb92fe925…ff4f (across the 45 largest operations 1,914.5 of the 1,916.8 ETH-eq of WETH edges also went into hubs), so the figures here do not include WETH. The totals above count the traced operations. 7 operations that hold a deployer of the Operator A or Operator B case files are left out of them, because their money is in the worked examples below.

Worked example: Operator A

Where Operator A's net ETH went, scaled to the ledger net of 5,047 ETH

5,047 ETHNet ETH, Operator AParked, balance read from RPC2,803 ETHRecycled into new launches27 ETHSwapped to other tokens3 ETHInto public hub contracts, left untraced1,642 ETHDust445 ETHOther moves and untraced127 ETH

56% traced to a destination. Wallet by wallet in the dossier above. The flow table covers native ETH transfers from Sep 14, 2026; the wallet scan filled blocks 49,334,480 to 62,716,999.

Worked example: Operator B

Where Operator B's net ETH went, scaled to the ledger net of 199 ETH

199 ETHNet ETH, Operator BInto public hub contracts, left untraced120 ETHDust10 ETHOther moves and untraced69 ETH

Under 1% traced to a destination. Wallet by wallet in the dossier above. The flow table covers native ETH transfers from Sep 14, 2026; the wallet scan filled blocks 54,320,400 to 62,609,999.

Fake volume

How much trench volume is fake

Wash trading inflates the volume that charts, screeners and listings show. This section measures it token by token and counts only what a single transaction shows: volume created by selling and buying back the same tokens inside one transaction, through the wash contract or by one address.

1.3%
of trench volume is wash51,911 of 3,972,570 ETH
6,860
tokens with wash volume794 with 1+ ETH of volume are 50% or more wash
3,972,570
ETH of recorded volumeall launch tokens, COBIE excluded
$131.2M
wash volume, in USDpriced at each trade

Wash volume by method, ETH, the methods that are counted

96.8%Wash contract 50,225Same-address round trips 1,684Phantom price 2

Only round trips inside one transaction count: volume created by selling and buying back the same tokens inside one transaction, through the wash contract or by one address. They add up to the 51,911 ETH wash total. Not counted: wallet churn and linked-cluster volume (39,490 ETH), and round trips with different addresses on the two legs. Reported but not counted as wash: 72,864 ETH of bot churn. Excluded from every figure: flash round trips in 2 tokens, 14.4M ETH of nominal swap volume that moved no capital.

Tokens with the most wash volume

TokenVolume ETHWash ETHWash shareMain methodEvidence
$DEED
2026-09-21		3,8181,90750%wash contracttx 1 tx 2 token
$CRUMBS
2026-09-08		11,1381,50514%wash contracttx 1 tx 2 token
an unnamed token
2026-08-25		28,5471,4995%same-address round triptx 1 tx 2 token
$LEBRON
2026-09-12		1,3681,09780%wash contracttx 1 tx 2 token
$1000X
2026-09-17		1,8871,08658%wash contracttx 1 tx 2 token
$GG
2026-09-15		2,53187034%wash contracttx 1 tx 2 token
$ECHO
2026-09-15		93486192%wash contracttx 1 tx 2 token
$WAIFU
2026-09-15		3,08173524%wash contracttx 1 tx 2 token

Wallets and contracts that carry the wash volume

ActorTypeLaunchesWash ETHRound tripsEvidence
0xb06983db…de1214
2026-08-30 to 2026-10-03		wash service contract6,19750,225122,307tx 1 tx 2
0x597899f7…ae9a57
2026-09-16 to 2026-09-16		contract14404tx 1 tx 2
0x817d3373…2a6da1
2026-09-16 to 2026-09-16		wallet14401tx 1
0x21424dea…bb6091
2026-09-16 to 2026-09-16		wallet11501tx 1
0x54e95454…75c2bd
2026-09-16 to 2026-09-16		wallet11281tx 1
0xb7b685d9…5a0f5a
2026-09-16 to 2026-09-16		contract1911tx 1
0x01501c0f…cc8eb8
2026-09-16 to 2026-09-16		unchecked1881tx 1
0x4699e3db…b2040d
2026-09-16 to 2026-09-16		unchecked1701tx 1

Across the 107,541 bundled launches with trade records, 48,709 of 1,488,619 ETH of volume is wash (3%).

Rules wash-rules/2, strict round trips only. Wash volume is volume created by selling and buying back the same tokens inside one transaction: through the wash contract, or by one address. It is evidence about volume, not about who ran it. One token, COBIE, is left out of every volume and wash figure: its 14.4M ETH of swap volume is flash-accounting round trips in a pool with dust liquidity, not trading volume and not money that moved.

Snipers

Who buys the first blocks of a launch, again and again

A sniper here is a wallet that buys cleanly in the first 30 blocks, about 3 seconds, of launches by 50 or more different creators, after bundle, creator and hub buys are removed from each launch.

1,771
sniper wallets1,595 wallets, 176 contracts
697,527
early positionsacross the launches they bought
2 s
median first buyafter launch
85%
sold within a minuteshare of positions, median wallet

Together these wallets net $7.9M (3,181 ETH): 1,280 of them are net positive and $9.0M is the sum of the winners. The median wallet closes its position in a launch at a profit 33% of the time.

The eight largest by net USD

WalletLaunchesCreatorsFirst buyHit rateNet USDEvidence
0x924378f2…39492f contract
2026-09-19 to 2026-09-30		8297451 second52%$151Kbuy tx sell tx
0xe7db4e54…1be602
2026-09-10 to 2026-09-18		1,9331,8921 second23%$121Kbuy tx sell tx
0x5b8e11e3…8ff73b contract
2026-08-29 to 2026-10-02		4304151 second30%$110Kbuy tx sell tx
0xddf8cbf8…d26c14
2026-09-01 to 2026-09-11		5,9105,5252 seconds20%$110Kbuy tx sell tx
0x47a2859d…de1b32
2026-09-02 to 2026-10-03		7127111 second50%$107Kbuy tx sell tx
0xc708f0da…775264
2026-08-31 to 2026-09-08		1,1138191 second61%$85Kbuy tx sell tx
0x897ecb4e…8cda4c
2026-09-01 to 2026-09-15		17,50914,8252 seconds18%$78Kbuy tx sell tx
0xc0b3535e…e6ae6e
2026-08-16 to 2026-10-02		4403911 second47%$77Kbuy tx sell tx

Rule snipers-3: clean buys in blocks 1-30 after TokenLaunched, 50+ creators, early-skewed; bundle/creator/hub buys removed per launch. Hit rate is the share of launches closed at a profit. Evidence opens one buy and its matching sell. Early buying is a trading strategy, not a finding about a person, and snipers are reported separately from bundles.

Promotion networks

Who posted the contract, and what the wallets were doing

Posts that carry a launch's contract address, matched to the launch and to the moment its bundle wallets started selling. Facts only. A post is called promotion only after its stance is judged.

49,670
X posts crawled10,953 carry a contract
7,077
posts name a launch contractexact match, 1,009 accounts
4,659
posts judged as promoting796 accounts, 1,396 launches
99%
posted after the selling began398 of 403 promoting posts on rugged launches

When the promoting posts went up, relative to launch

01k2k3k9before launch0 on rugs333first 10 min28 on rugs41810 min to 1 h37 on rugs9121 h to 1 day97 on rugs2,987after 1 day241 on rugs

Each post counts once. "On rugs" counts posts about launches later classed as rugged.

How this is counted. A post counts once. It counts as promotion only when judged as promoting a launch, or when it carries a paid disclosure; warnings, neutral posts, unrelated posts, disputed judgements and posts not yet judged never count. On 101 rugged launches, 172 accounts posted 403 promoting posts. The median came 2.4 days after launch. In 398 of the 403 posts with a measured exit (99%), the bundle wallets had already started selling when the post went up.

Accounts judged as promoting

AccountPostsLaunchesRuggedMedian post after launchEvidence
@GateTrenches4563733.5 hourspost
@carrie98bz38263627.3 dayspost
@embrrcapsETH6765623.8 dayspost
@UAEsoltrading17863.5 hourspost
@0xCR33P3333577 minutespost
@listingntm3221510.6 hourspost
@ChinaDegen311946.5 dayspost
@madapescall paid2626450 minutespost
@King_Memento9944.2 hourspost
@LongLaunches533239.9 dayspost
@BubblegumCatNFT4040326.7 dayspost
@erykdiamond292732.7 hourspost

Fact lines

@legsdotfun posted the contract of $LEGS 25 minutes after launch. The linked wallets had started selling 25 minutes earlier. 15 linked wallets ended with 100% of their holdings sold.
post
@crumbsfamily posted the contract of $CRUMBS 2 minutes after launch. The linked wallets had started selling 2 minutes earlier. 25 linked wallets ended with 100% of their holdings sold.
post
@WaifuToken posted the contract of $WAIFU 21 minutes after launch. The linked wallets had started selling 21 minutes earlier. 15 linked wallets ended with 100% of their holdings sold.
post
@DeedEstate posted the contract of $DEED 85 seconds after launch. The linked wallets had started selling 83 seconds earlier. 63 linked wallets ended with 99% of their holdings sold.
post
@TouchGrassRWA posted the contract of $GRASS 15 seconds after launch. The linked wallets had started selling 12 seconds earlier. 5 linked wallets ended with 100% of their holdings sold.
post
@LaunchOnBliss posted the contract of $BLISS 9 minutes after launch. The linked wallets had started selling 9 minutes earlier. 25 linked wallets ended with 100% of their holdings sold.
post
@erykdiamond posted the contract of $LEARN 29 minutes after launch. The linked wallets had started selling 29 minutes earlier. 13 linked wallets ended with 100% of their holdings sold.
post
@listingntm posted the contract of $PENPE 6 minutes after launch. The linked wallets had started selling 6 minutes earlier. 28 linked wallets ended with 100% of their holdings sold.
post

Co-posting groups

Co-posting group, confirmed

4 accounts
Posted the same contract within 300 seconds of each other. 17 Robinhood launches named by contract, 4 rugged. Accounts: @jolieX20198, @Sofiia272, @kimjoona2026, @LaraYldz26. Evidence: post 1 post 2 post 3 post 4.

Co-posting group, candidate

2 accounts
Posted the same contract within 300 seconds of each other. 20 Robinhood launches named by contract, 1 rugged. Candidate: not yet judged as promoting, so no accounts are listed.

Co-posting group, candidate

2 accounts
Posted the same contract within 300 seconds of each other. 2 Robinhood launches named by contract, 0 rugged. Candidate: not yet judged as promoting, so no accounts are listed.

Posting the same contract close together is a pattern, not proof of coordination.

Stance: each contract post was read by two language models, Jev and Llama 3.3 70B, and each must quote the post's own words. They agreed on 5,726 posts and disagreed on 1,247; a disputed post never counts as promotion. Jev alone answered 104 posts. Posts without a valid quote stay pending and are left out of every list. Judging is automated, so every listed account links to the post.

Allegations: 194 public allegations about accounts were collected. They are labelled allegation, are never used as proof, and no account is called anything the chain does not show.

Solana

Solana: a day of launches on three launchpads

A separate measurement, kept apart from every Robinhood Chain figure. The window is Oct 2, 2026 07:14 UTC to Oct 3, 2026 12:00 UTC, 28.8 hours, counted from the first slot Fable's own Solana index holds. It is about a day of Solana launchpad activity, not the history of Solana, and every count in this section covers that window only. Only launches the detector labels rug_operation carry a money figure.

68,389
launches analysedof 68,395 seen; 99.99% have a detector row
5,350
rug_operation launches7.8% of analysed launches, by 2,386 deployer wallets
83,048
SOL taken, net$9.9M, gross of wallet fees; later sells add. 136,075 sold minus 53,027 spent
3 s
median first sell89% within 10 s

What was examined

Every token that launched on pump.fun, Meteora DBC and Raydium LaunchLab inside the window, as recorded by Fable's own Solana index (68,395 launches, 42,280,704 trades), and the Solana bundle detector's verdict on each launch. The detector reads the launch's create transaction and the trades after it, and links the deployer to the wallets that bought alongside it using on-chain proof only: a buy inside the create transaction, the same Jito bundle, the deployer funding the wallet, a shared funder, or a shared transaction. Timing alone never links a wallet. It then measures what that cluster, the deployer plus its linked wallets, bought, sold and took out.

A launch is rug_operation when the cluster sold at least 80% of what it bought and made at least 0.5 SOL, or pulled liquidity. 3,296 further launches are bundled: linked wallets took supply, but the launch did not meet that test. Verdicts on the 68,389 analysed launches: green 49,000, amber 10,743, red 8,646, and red splits into 5,350 rug_operation and 3,296 bundled. Both labels describe what wallets did on chain. They do not say who controls the wallets.

Coverage: 68,389 of 68,395 launches have a detector row. The 6 without one launched in the last 3 seconds before the data was pulled, and the detector's first stage runs 3 seconds after a launch; the backfill that replays every launch without a row had finished its queue. Each row is the latest stage a launch has reached, from the first seconds up to 24 hours, so newer launches are judged on fewer hours of trading and their take can still grow. These figures will be larger tomorrow. Window start slot 452,539,484, end slot 452,927,198.

By launchpad

LaunchpadAnalysedrug_operationShareBundledDeployersSOL netFirst sell
pump.fun56,6863,7456.6%2,6842,21364,6472 s
Raydium LaunchLab5,2071,57630.3%16532517,9063 s
Meteora DBC6,496290.4%4472649514 s
All68,3895,3507.8%3,2962,38683,0483 s

Analysed counts launches with a detector row (68,395 were seen, 6 have none yet). Bundled is a launch count only. Deployers are wallets with a rug_operation launch, and the total counts each wallet once, so it is smaller than the sum of the rows. First sell is the median seconds from launch to the cluster's first sell. SOL net is shown for rug_operation launches only. The index holds no other launchpad for this window.

How big the takes are, 5,350 rug_operation launches

under 1 SOL5211 to 10 SOL3,39910 to 100 SOL1,343100 to 1,000 SOL791,000 SOL or more8

Smallest take 0.50 SOL, median 5.59 SOL, largest 2,975.9 SOL. The 8 launches of 1,000 SOL or more took 16,366 SOL; the ten largest together took 18,156 SOL (22% of the total).

How fast the exit comes

Across all 5,350 rug_operation launches the median time from launch to the cluster's first sell is 3 seconds (pump.fun 2 s, Raydium LaunchLab 3 s, Meteora DBC 14 s), and the 90th percentile is 11 seconds. The first sell came within 10 seconds on 4,769 launches (89.1%) and within 60 seconds on 5,222 (97.6%). Times are whole seconds from the launch block time to the block time of the cluster's first sell.

Deployer wallets

359 of 2,386 deployer wallets launched more than one rug_operation token (174 launched 5 or more, 98 launched 10 or more, the most 73). Those 359 wallets account for 26,087 SOL, 31% of the net take. These are addresses, not people: the chain does not name who controls a wallet.

Deployer wallet with the most rug_operation launchesLaunchesSOL taken
8Wz4CQ...hYWF73359.5
DRXPaf...Fvb764730.3
E4FPgg...pZEA58959.0
37uM1r...cHvq58605.2
GpTXmk...WAc457534.8

The detector also groups launches, deployers, linked wallets and shared funders into larger sets. Group membership is the detector's and was not chain-checked for this section, so no group is presented as an operation here.

The ten largest takes

TokenLaunchpadDeployerSOL takenCluster bought / sold, SOLUSDEvidence
PUMPGO
7gbJ4S...pump		pump.fun5mvjTR...WfTs2,975.9234.5 / 3,210.4$351Klaunch tx
SUKI
Ay9V3r...pump		pump.fun5ngMxW...FeZD2,716.7204.6 / 2,921.3$324Klaunch tx
ANON
2AKrTT...pump		pump.fun4SxAN2...2Vin2,373.0214.6 / 2,587.6$285Klaunch tx
wwg
89PNM5...pump		pump.fun9xizRE...fxje2,100.1214.6 / 2,314.7$256Klaunch tx
XP
5YwP7f...pump		pump.fun5Mh2a6...Dy3q1,806.0214.6 / 2,020.6$219Klaunch tx
HOOKEDINU
9ZUwZj...pump		pump.funEv8N68...tD581,688.8181.8 / 1,870.6$199Klaunch tx
SIC
6ygHGH...pump		pump.funApuPTS...3ja41,513.5203.9 / 1,717.3$179Klaunch tx
Anthropig
G8L93Q...pump		pump.funHzVbfC...pHoL1,192.2183.8 / 1,376.0$143Klaunch tx
pumpcat
5krNQZ...pump		pump.fun3S6CNS...gdwp928.4144.8 / 1,073.2$111Klaunch tx
WWWCAT
JEgD4j...pump		pump.fun7FP25J...3epT861.3149.8 / 1,011.1$106Klaunch tx

Each launch transaction is signed by the deployer wallet, contains the token mint and calls the launchpad program. Open it on Solscan.

How the SOL is counted

Money is counted from rug_operation launches only. SOL taken is the SOL the cluster received from selling the token minus the SOL it spent buying that token, from launch to analysis time: 136,075 SOL sold minus 53,027 SOL spent is 83,048 SOL. Every rug_operation launch is positive.

The bundled launches are never netted or added into a money number. Their SOL sums to a large negative figure because of pool-seeding launches: the linked wallets' own buying is very large (over 100 SOL, bought from the pool a token migrated to) and the sells that would settle the account had mostly not happened when the launch was analysed. That negative is not a loss to anyone and it is not extraction. They are reported as counts only: 3,296 bundled launches, 453 of them with the pool-seeding pattern, and in 422 of those the cluster had sold under half of what it bought when it was analysed.

USD value. $9.9M, valued per trade at the SOL/USD price of its own second, built by the index from its own SOL/USDC and SOL/USDT pool trades of at least 50 USD (the price on trades ranged 117.25 to 123.29 USD in the window).

Fees. The take is the pool-side amount. It is gross of the wallets' network, priority and tip fees and, on pump.fun and PumpSwap, of the protocol and creator fees a wallet pays on top of a buy and loses from a sell. On the 1,813 pump.fun and PumpSwap sells re-read, the selling wallet's balance rose 0.77% to 1.44% less than the pool paid out (median 0.90%). Those fees are not subtracted.

Where the SOL went after the pool paid it out is not traced here. A transaction that sells for several wallets is credited in full to its fee payer, and where a recipient is not in the cluster list the index credits that SOL to the cluster anyway.

Ten launches re-read on public Solana nodes

Ten rug_operation launches were chosen before any chain read: the 3 largest takes, the largest on Raydium LaunchLab, the largest on Meteora DBC, and 5 random mid-size launches (a take of 10 to 200 SOL, launched more than 13 hours before the draw). They were re-read on public Solana RPC nodes (api.mainnet-beta.solana.com first, solana-rpc.publicnode.com when the first returned 429), never a key-based endpoint, at most 2 requests per second. For each launch the create transaction, the evidence transactions the detector cites and the cluster's trade transactions were fetched with getTransaction and compared with the index. A launch matches when its create transaction exists, succeeded and equals the index on slot and block time, the deployer signed it, the mint and the launchpad program are in it, and every re-read trade moves the indexed token amount and the indexed SOL.

10/10
create transactions matched9 takes fully recomputed; 5 create-buy legs differ in SOL
1,943
transactions re-readcreate, evidence and cluster trades
1,907
trade legs equal the indexof 1,912 compared, tokens and SOL
9/10
takes recomputed from chainwithin 0.0015 SOL of the index
TokenLaunchpadSOL taken, indexFrom chainTrade txs re-readEvidence
PUMPGO match
7gbJ4S...pump		pump.fun2,975.93792,975.9364645 of 645launch largest sell largest buy
SUKI match
Ay9V3r...pump		pump.fun2,716.67652,716.6751558 of 558launch largest sell largest buy
ANON match
2AKrTT...pump		pump.fun2,372.98952,372.9880524 of 524launch largest sell largest buy
STONKERS match
DRXkGX...nykU		Raydium LaunchLab159.6351not recomputed in full32 of 237launch largest sell largest buy
GRAIL match
CARDSP...5jmk		Meteora DBC80.296580.296410 of 10launch largest sell largest buy
BitBots match
26GNNv...pump		pump.fun98.767298.765981 of 81launch largest sell largest buy
YAB match
ARePxN...pump		pump.fun18.632918.631632 of 32launch largest sell largest buy
SUITINU match
8kBz39...SwaW		Raydium LaunchLab10.506910.506916 of 16launch largest sell largest buy
BITCOIN match
2qg1bd...KrfM		Raydium LaunchLab12.455312.45547 of 7launch largest sell largest buy
POISE match
BtfrTo...perp		Meteora DBC12.709412.70947 of 7launch largest sell largest buy

The 5 trade legs that do not equal the index are the deployer's own first buy inside a pump.fun create transaction. The token amount equals the index exactly, but the SOL cannot be isolated because the same transaction creates and funds the new bonding-curve account: that account moved by 0.00128 to 0.00142 SOL more than the indexed buy, against dev buys of 0.010 to 0.977 SOL.

What this does and does not show

For 9 of the 10 launches every cluster trade transaction the index lists was re-read, so the take is recomputed from chain amounts alone. For the tenth, STONKERS on Raydium LaunchLab, 32 of 237 cluster trade transactions were re-read, 48.3% of the SOL the index counts as sold.

Completeness was not checked per launch: the chain was not searched for cluster transactions the index lacks, and where the index misses a transaction its SOL is not in the take. The index's own coverage check on 332 sampled slots found 87 of 54,312 transactions missing; 30 of 30 sampled slots since 09:30 UTC, after the dust-sell fix at 09:09 UTC, were exact.

Cluster membership is the detector's. The 30 evidence transactions it cites exist, succeeded and sit in the launch slot. Jito bundle records and funding links were not re-checked.

How to check one yourself

Pick any launch above and open its launch transaction on Solscan: it is signed by the deployer wallet, contains the token's mint and calls the launchpad program (pump.fun 6EF8rr...wF6P · Meteora DBC dbcij3...MaqN · Raydium LaunchLab LanMV9...J3uj). Open the token page for its transfers and swaps. For any sell, read the SOL balance change of the pool or bonding-curve account: it equals the amount counted on pump.fun and PumpSwap. To read the raw transaction, call getTransaction on any public Solana RPC with jsonParsed encoding and compare meta.preBalances with meta.postBalances.

What Fable does about it

The same checks, live, under the post

Everything in this report is computed the way the Fable extension computes it, only slower and wider. The extension runs it in seconds.

When a post on X carries a contract address, Fable reads the address, finds the launch, and shows the verdict directly under the post: bundle wallets, share of supply, whether they have sold, and the operation behind it.

Every verdict links to the same transactions used here. Nothing in it is a rumour: it is a hash a reader can open.

Install the extension and read the verdict before you buy.
fable.market · @FableDotMarket

$LEGSRUG OPERATION$2.6M
15 linked wallets took 81% of supply within seconds of launch.
Fable verdict under the post that carried the contract
Appendix

Data, definitions and method notes

Every table behind this report as a file. Robinhood Chain addresses and hashes open on its explorer; Solana addresses and signatures open on Solscan.

CSV
Launchpad factories112 rows, 0.0 MB. All 112 factories, how each was identified.
CSV
Every rugged launch3,708 rows, 3.3 MB. Rule tier, linked wallets, supply taken, flows and evidence.
CSV
Deployers with a rug2,701 rows, 0.8 MB. Launches, outcomes, ETH in and out, dates, and the operation key that joins to operations.csv.
CSV
Operations3,297 rows, 1.0 MB. Deployers, links and top evidence for every operation, with a class column: threat actor operation (at least one rugged launch), bundler-linked group with no rug evidence, or single deployer.
GZ
Major bundled launches48,816 rows, 15.3 MB. One row per proven major bundle (3 or more linked wallets together holding 20% or more of supply) with money, sell style, chart metrics and evidence hashes.
GZ
Minor bundled launches67,103 rows, 11.8 MB. One row per proven minor bundle with money, sell style, chart metrics and evidence hashes. Together with the major file it holds every proven bundle.
CSV
Money sinks5,544 rows, 2.2 MB. Sink per operation with evidence hashes.
CSV
Judged promotion posts4,791 rows, 1.1 MB. One row per post and launch it names, judged as promoting, with timing and post links.
JSON
Deep dossiers0.6 MB. Every launch, wallet, timeline entry and evidence link behind the dossiers.
JSON
Solana numbers25 KB. Window, counts, launchpads, takes and the ten chain re-reads behind the Solana section.
JS
Search index115,919 bundled launches for the web search. 12.0 MB.

Shareable graphics

Headline numbers
Headline numbers
Slow sellers and quiet extraction
Slow sellers and quiet extraction
Money trail
Money trail
Operation spotlight
Operation spotlight
Wash volume and snipers
Wash volume and snipers
Promotion counts
Promotion counts

Reading evidence

Open any transaction link and check three things. For a launch transaction, the creator and token in the factory log. For a bundle transaction, the number of distinct recipients and what they received. For a first-sell transaction, that a linked wallet sent tokens to a pool or router. A first-sell link can also be a sell inside a wash-contract hop, where the wallet sells and rebuys through the contract in one step (RIG, the W set and CUDA are examples). These are the same checks the index ran.

Rules and thresholds

Ledger rules ledger-rules/1: rug tier A needs a red bundle, a first sell within 3,600 seconds, an insider exit of 95% or more and a price at 5% or less of peak. These cut points were chosen where recall on a hand-labelled set stops improving while the flagged population keeps growing. Died means no trade for 72 hours, the first point where more than 80% of idle episodes never resume. Dump versus drip splits at 15 minutes, the point where 96% of exits are done. Per-wallet dust floor 0.01% of supply. Quiet extraction needs net above 0.5 ETH, a measured price series and no rolling hour with a fall over 15%.

Not subjects of this report

Pons is a legitimate launchpad. Its token, keepers, router, fee escrow, V4 hook, factories and owner address are infrastructure and never flagged. Hubs are excluded from every link.

Wording

"Threat actor" means a set of wallets linked by on-chain evidence that extracted value from launches. It does not identify a person. Allegations from public lists are labelled as allegations and never used as evidence. Paid promotion is reported as promotion. Nothing here makes a claim about a person that the chain does not prove.

fable

Fable Intelligence, Report 01. @FableDotMarket
Data as of Oct 3 7:29 UTC. Generated 2026-10-03 08:55:42 UTC.

Rebuilt from our own index of Robinhood Chain: 448M trades, 1.63B token transfers. No third-party data provider.