On-chain analyst Wazz has mapped a suspected serial rug-pull network on Robinhood Chain that launched 53 token projects in roughly two months and extracted an estimated $18.43 million, tracing most of the activity through recurring wallet-funding routes, address reuse and shared signing patterns.
The investigation places DEED, the token that initially drew attention to the activity, inside a much larger operation. According to Wazz’s mapping, DEED was neither among the 10 largest projects by estimated cash-out proceeds nor by market capitalization, suggesting the apparent network relied on volume and repeated launches rather than one unusually large token collapse.
Wazz linked 45 of the 53 projects through a repeated sequence: proceeds from one token launch were routed to a wallet that deployed the next token, often shortly before that deployment wallet sent an outbound transaction. The pattern gives the cluster a financial trail across otherwise separate meme-token launches, with funds from earlier projects helping finance later ones.
The named tokens in the mapped set include HOT, WAIFU, RIG, PRESS, BELL, VAULTS, EQUITY, PINK, CRUMBS, LEGS and multiple DEED-related launches. Wazz described it as the largest connected rug-pull chain he had identified on Robinhood Chain.
Wallet flows linked launches across the cluster
The strongest links came from funding movements between project wallets. Wazz said more than 70% of each token’s circulating supply was acquired early in trading, with roughly 70 to 200 sybil wallets — addresses controlled or coordinated by the same party — associated with a typical launch.
Most of the launches used Pons V2, according to Wazz. The repeated use of the same launch mechanism, combined with similarly structured wallet groups, may have allowed the operators to create the appearance of broad early buying while retaining effective control over a substantial supply.
One example traced by Wazz followed funds from a project called DRAFT into DEED. He reported that 98 wallets pooled 179.88 ETH into a transit address. That address then routed funds through an intermediary wallet, which sent 20 ETH to DEED’s deployment wallet. Sixteen seconds later, the DEED wallet signed a batch transfer.
The short interval between the inbound funding transaction and the token-related transfer is central to the analysis. A deployment wallet can receive money for legitimate reasons, but a sequence repeated across dozens of launches — particularly when funded by proceeds tied to previous projects — offers a more specific basis for linking operations than token branding or social-media promotion alone.
CRUMBS, LEGS and PINK led traced cash-outs
CRUMBS accounted for the largest individual cash-out in Wazz’s mapping, with about $3.12 million traced to 92 associated wallets. Wazz estimated that CRUMBS reached a market-capitalization peak of roughly $8 million and had an issuance cost of about $150,000.
That disparity illustrates the economics of rapid-launch token schemes. A relatively limited outlay for token creation and early liquidity can generate much larger proceeds when insiders acquire supply early and distribute or sell into market demand. Market capitalization, based on token price multiplied by supply, also does not represent cash available to token holders; it can decline sharply when concentrated holders begin selling.
LEGS was the second-largest project by traced cash-outs in the cluster, with $2.90 million connected to 77 wallets, according to Wazz. Its estimated peak market capitalization was about $6.6 million.
PINK was linked to $1.44 million in cash-outs and 125 wallets in the mapped network. Wazz’s figures indicate that the operation did not depend on a consistent project size. Instead, it appears to have run a pipeline of launches whose proceeds varied but followed similar address and funding behavior.
Lookalike tokens added an earlier extraction stage
Wazz also identified a “fake coin before real coin” tactic used in three launches: PINK, CRUMBS and DEED. Under this approach, a lookalike token was promoted before the official contract address was published. The imitation token then became an initial vehicle for extracting funds before the primary token launch began.
The method exploits a recurring risk in fast-moving token markets: buyers may act on a ticker symbol, project name or social-media post before checking the exact smart-contract address. Since multiple tokens can use identical or near-identical names, a familiar label offers little protection against contract substitution.
In the cases identified by Wazz, the lookalike launches appear to have been integrated into the broader process rather than representing unrelated copycats. The pattern was repeated three times around projects already connected to the same funding cluster.
Signing and profit wallets offered separate links
Wazz reported additional connections that went beyond flows between deployment wallets. Four projects — VAULTS, WAIFU, a second DEED launch and CRUMBS — were linked through signing behavior. He said the same private-key signer appeared across separate project fund batches.
A private key is the credential used to authorize transactions from a blockchain address. If the same signer is used in multiple ostensibly independent projects, it can provide a direct operational link between them, although the public blockchain does not reveal the identity of the person controlling that key.
Wazz also traced four projects through shared profit-aggregation addresses. Proceeds from LEGS, PINK and two CRUMBS launches converged on the same receiving wallet, according to his analysis. That convergence makes the cluster harder to characterize as a loose collection of unrelated promoters or developers.
He said much of the extracted value was converted into ETH and held on Ethereum, extending the trail beyond Robinhood Chain. The associated addresses have been tagged and entered into an on-chain intelligence database, Wazz said.
Repeated launch funding is a practical warning sign
Wazz said he had separately detected at least two other serial-launch groups on Robinhood Chain involving dozens of projects and millions of dollars in cash-outs, though he did not connect them directly to the 53-project cluster.
The findings point to an operational risk for traders on new or low-cost networks: a token’s branding, website and initial trading activity may reveal far less than its earliest wallet movements. Concentrated purchases immediately after launch, deployment wallets funded by proceeds from earlier tokens, and multiple projects sending gains to one address can be examined through public blockchain explorers.
Locked liquidity or public safety reviews may reduce some risks, but they do not by themselves reveal whether a connected wallet network accumulated supply before a launch. In the cluster mapped by Wazz, the more revealing evidence came from the movement of ETH between launch cycles, the reuse of wallet infrastructure and the eventual aggregation of proceeds.
To protect yourself from similar schemes, learn how rug pulls work in crypto in this detailed guide.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
