Chatter

Ansem (@blknoiz06) posted on 12 Nov that pump.fun paid him "~$31k" for his callout of the coin 4Cxj…pump "because of how many ppl tailed", and "$140k" in callout rewards in his "first week actively trenching on pump". He also wrote "i sold pump because i was bearish the entire market and am net short, ill buy it back when im bullish" and "i dont get paid to tweet i get paid to use the app". The figures come from his posts and screenshots. We haven't found the wallet that received the rewards, so we can't check them.

“~$31k for the solana:4CxjZyMNoF1p6eXHXHv1TWpS2X47CuUmLwtGe18spump callout because of how many ppl tailed”

Ansem (@blknoiz06), 5:57 AM ET 12 Nov ↗

Across Protocol said a social engineering attack on its domain registrar "gave a bad actor control of the Across domain" at about 1:45 PM ET on 10 Nov. SolanaFloor reported about $294K taken by 4:37 PM ET. On-chain, ETH from a wallet an on-chain tracer linked to the thefts passed through two more wallets, and 48.8 ETH went into a Chainflip swap at 4:12 PM ET and came out as about 1,197 SOL to G47n…4uSa. At 6:50 and 6:58 PM ET it went, in two sends, through a one-use deposit address to a wallet Solscan labels Rainbet Hot Wallet. We don't know whether Rainbet had any part beyond receiving the deposit.

“a social engineering attack on @Namecheap (our domain registrar) gave a bad actor control of the Across domain.”

Across Protocol (@AcrossProtocol), 5:13 PM ET 10 Nov ↗

The account behind "Trap Map" (BwWA…pump) said on 10 Nov, in a post it has since deleted, that it bought and sold from its dev wallet after the lock, and that "26 SOL became 72." On-chain, the lock holds the dev wallet's own 4.5% launch buy; apart from a 0.5% fee claimed from it on 9 Nov, it hasn't moved. At 1:17 PM ET on 9 Nov, 21 wallets that traded at launch sent about 77.5 SOL to one wallet. By 1:41 PM it reached the dev wallet, then went on to iGdF…dwu, which had funded the dev wallet. We found no link from those wallets to any of the 17 copycat "Trap Map" coins, and nothing on-chain naming Proxima.

“But after the lock I bought and sold from the dev wallet, hoping dev buys would pull you in, and I sold into you.”

@trapmapdotfun, 10:57 AM ET 10 Nov (since deleted) ↗

Follow-up on Percolator's old pump.fun token. Its creator fees go to one wallet, DPuS…2X9P, which collected about 2,350 SOL (about $200K) from 17 January to 4 November. That fits co-founder @0xSquid_Sol's "over $200K"; the $14.5K he calls pending isn't in the fee vaults, which hold about $316. Between November 2025 and February 2026, DPuS sent about 46.5M tokens to EVcQ…A6bm, the wallet @AgentChud named, and EVcQ sold about 57.4M for about 263 SOL in that span. On 7 November DPuS burned about 6.79M, and 7JWv, which got its tokens from DPuS, burned 17.5M. We don't know who controls DPuS or EVcQ.

“We have not sold any tokens from the existing Pumpfun token, our team’s token allocation was burned.”

@0xSquid_Sol, co-founder of Percolator, 2:33 PM ET 8 Nov ↗

Percolator, a Solana perps project, is dropping its pump.fun token, $PERCOLATOR, for a new token, PERC, through a raise on Backable. The team says the raise targets $250,000 and that holders in a 7 Nov snapshot can buy into a reserved 20% ($50,000). ZachXBT said at 9:08 AM ET on 8 Nov that the team had left old holders with nothing and hadn't asked the community. The two wallets the team named or funded for its buybacks burned about 17.5M and 6.79M $PERCOLATOR on 7 Nov; neither sold any from 6 Nov on. We haven't checked other wallets. Last closed 5-min candle: about $263K at 10:25 AM ET; peak close about $3.53M on 6 Nov.

“Here's what this means for holders: $PERCOLATOR holders do not receive free PERC just for holding the old token. There is no swap, conversion or snapshot-based airdrop, and no migration or airdrop claim site.”

Percolator (@PercolatorTrade), article posted 9:18 PM ET 7 Nov ↗

Follow-up to c130: the Loopscale loan that paid 4,597 SOL was liquidated on 3 Nov, and Loopscale says its vaults have been made whole. At 8:43 AM ET that day, wallet rektb…8Kx liquidated the loan: it paid about 4,598 wrapped SOL into the vault the loan drew from and took the 1 kySOL. At 5:13 AM ET on 5 Nov, Loopscale posted that attack attempts targeted its SOL and USDC Genesis Vaults, that the protocol is paused and that it is working with federal law enforcement. It lists 247Lk…piR, the loan's wallet, among four addresses it says are connected with this activity. We don't know whose wallet rektb…8Kx is; Loopscale hasn't said how the kySOL was priced.

“Affected vaults have been made whole and no user deposits have incurred a loss.”

Loopscale (@Loopscale), 5:13 AM ET ↗

A Loopscale loan on Solana paid out 4,597 SOL against 1 kySOL of collateral. At 2:41 PM ET on 1 Nov, wallet 247Lk…piR opened the loan, deposited 1 kySOL and borrowed 4,597 wrapped SOL from a Loopscale vault account, all in one transaction. As of 8:30 AM ET on 3 Nov the loan account had no transaction since then and still held the 1 kySOL. An X thread says Loopscale priced the kySOL as bitcoin because of a decimals mix-up; we haven't checked that. Loopscale hasn't posted about it.

A wallet used by King, a Solana trading bot, sent out its stablecoins and SOL in about three minutes early Monday. From 2:32 to 2:35 AM ET on 2 Nov, wallet 7dGrd…uUu signed plain transfers of about 359,095 USDC, 69,869 USDT, 7,174 USD1, 4,265 wrapped SOL and 191 SOL to one wallet, BHRay…3jU. That wallet swapped the stablecoins to SOL and by 9:12 AM ET had sent about 9,576 SOL on. Two X accounts call it a hack and put it at about 786K to 1M dollars. The transfers were signed with the wallet's own key; we don't know whether it was stolen or the owner moved the money, and King's team hasn't said.

Solana Mobile says a fake app named "SKR Claim" was live in its dApp Store Spotlight for one hour today, after unauthorized access to its dApp Publishing Portal. The app asked for seed phrases. Solana Mobile says it is being removed from phones where it was installed. If you entered a seed phrase in it, move your funds to a new wallet now. Solana Mobile says it will never ask for your seed phrase.

“The app requested entry of user seed phrases.”

Solana Mobile (@solanamobile), 1:34 PM ET ↗

Follow-up to c126: the "client hold" on stonkfun.xyz was removed at 11:52 AM ET on 31 October, according to its registry record, and the site was loading again at 1:26 PM ET. StonkFun's account hadn't posted about the hold or its removal as of 1:37 PM ET, and we still don't know why it was placed. Until StonkFun's own account confirms the site is safe, check that account before connecting a wallet.

Follow-up to c124: StonkFun's site stopped loading again on 31 October. The stonkfun.xyz registry record shows the status "client hold", a status the registrar sets, last changed at 8:32 AM ET, and public DNS lookups returned no such domain at 9:41 AM ET. As of 9:44 AM ET, StonkFun's account hadn't posted about it, and we don't know why the hold was placed. Until StonkFun's own account says the site is back, don't connect a wallet to any address presented as StonkFun.

Inverse's on-chain vault had no transactions from 10:45 PM ET on 30 October to 12:20 AM ET on 31 October. In that window, users posted that their positions had been closed over a price-feed problem and that trading and withdrawals were paused. Payouts from the vault resumed at 12:27 AM ET; 15 had gone out by 6:42 AM ET. Whether every withdrawal request was paid can't be seen on-chain. As of 7:33 AM ET, Inverse's account hadn't addressed the pause or the closed positions. At 4:32 AM ET it listed "Only your own wallet can ever withdraw your SOL" under its "Next big update"; the vault program was last changed on 27 October.

“Only your own wallet can ever withdraw your SOL”

Inverse (@useinversexyz), 4:32 AM ET ↗

StonkFun's website was one of several crypto sites hit overnight in what StonkFun called "tonight's domain attack", flagged by Blockaid. At 1:01 AM ET on 31 October, StonkFun's account told users not to visit the site or connect a wallet. At 2:15 AM ET it said the site was restored on new infrastructure, and asked users to wait an hour before connecting. The stonkfun.xyz registry record shows a change at 2:13 AM ET. StonkFun says only the website was affected and it is "not aware of anyone affected"; as of 7:28 AM ET we hadn't seen a loss reported. If you connected a wallet or signed anything on the StonkFun site overnight, revoke any approvals and move what's left to a fresh wallet.

“StonkFun was affected by tonight's domain attack on several crypto sites, flagged by @blockaid_. Please don't visit the site or connect a wallet until we confirm it's safe.”

StonkFun (@LaunchOnSF), 1:01 AM ET ↗

Jupiter Lend's USDC vault had about 418 million USDC supplied and about 0.31 USDC available to withdraw at 7:27 AM ET on 30 October, according to Jupiter's own Lend API. At 5:01 AM ET Jupiter Earn posted that there is "a liquidity crunch impacting withdrawals" and that withdrawals would process again as users deposit or repay their loans, adding "all funds are safe." At 7:32 PM ET the evening before, it had posted that Jupiter Lend had "no exposure to Binance."

“Due to broader market conditions, there is currently a liquidity crunch impacting withdrawals.”

Jupiter Earn (@jupiter_earn), 5:01 AM ET ↗

An X account posting "$FLOAT allocation is now live" every few minutes links to launchfloat.com, a domain registered at 1:31 PM ET today, 29 October, according to its RDAP record. Float's own account, @floatdotxyz, links floatlaunch.xyz, registered 27 October, and had announced no $FLOAT allocation as of 6:53 PM ET. We couldn't see what launchfloat.com asks for because it sits behind a bot check. Don't connect a wallet or sign anything there.

Follow-up to c120: 6nYy…moe9 is now empty. Between 2:40 AM and 9:22 PM ET on 27 October it sent HqCb…P9Am about 9,373 SOL in 29 transfers, 22 of them of 400 SOL and the last of 242 SOL, and a third wallet 120.5 SOL, of which 85.5 SOL came back at 8:31 PM. HqCb, which also got about 201 SOL from 15 other wallets that morning, had sent out about 9,559 SOL by 9:27 PM, mostly in 176 transfers of about 50 SOL to 176 wallets. In a random sample of 8 of the 88 it paid after 4:42 PM, all 8 had no earlier transactions and sent it on within a minute, to wallets that split it into pieces of about 12 SOL. As of 9:30 PM ET, in the hops we checked, we hadn't seen any of it reach an exchange or a bridge.

Follow-up to c116: the 9,408 SOL that 7kY8 moved to one wallet, 6nYy…moe9, on 26 October is now moving out. On 27 October, from 2:40 AM to 4:38 PM ET, 6nYy sent out about 4,851 SOL, about 52% of it. About 4,731 SOL went to a second wallet, HqCb…P9Am, including 11 transfers of 400 SOL since 11:49 AM (about every 20 minutes since 2:08 PM), and about 120.5 SOL went to a third. HqCb passed the 400 SOL batches on within minutes, mostly in transfers of about 50 SOL to 80 other wallets. In a random sample of 8 of them, all 8 had no earlier transactions and sent it on again within about 90 seconds. As of 4:42 PM ET, in the hops we checked, we hadn't seen any of it reach an exchange or a bridge.

A fake StonkFun "points" checker is being pushed on X. An account named "Stonk SoIana" (@StonksSolana_, a capital I in place of the l; StonkFun's own account is @LaunchOnSF) posted an article at 3:14 PM ET telling STONK holders to check their points. It leads to points-stonkspad[.]com, a domain registered at 2:00 PM ET today, whose page is titled "Points · StonkFun" and asks you to connect a wallet. From 3:29 PM ET a 184K-follower account quote-posted it about 15 times in two minutes. StonkFun's real stonkfun.xyz/points page returns "not found". Don't connect a wallet or sign anything there.

Predict.fun, a prediction market on BNB Chain, said at 10:33 AM ET that a small number of users had "unauthorized transfers of funds" from their wallets, about 400,000 USDT in all, and that it will fully reimburse them. It says its preliminary investigation suggests its API documentation site, hosted by a third party, may have been compromised, and that it has taken the site offline; it plans a post-mortem. We checked three of the transfers, posted by @dethective: between 2:03 and 2:05 AM ET they moved USDT out of three accounts to one address, 0x8b00…2fBa, 9,860 USDT in all.

“we will fully reimburse all affected users for any funds lost as a direct result of this incident.”

Predict.fun (@predictdotfun), 10:33 AM ET ↗

Between 9:03 and 9:05 PM ET, 41 Solana wallets each sent their SOL to one new wallet, 7kY8…p8BQ, about 9,408 SOL in all. Every one of those transfers was signed only by the sending wallet itself, so whoever sent each one had that wallet's key. Three of them, about 865 SOL, are wallets the trader @domyxbt listed as his and says were drained. As of 9:45 PM ET nothing had left 7kY8. Posts blame different trading tools; we haven't seen how the keys were taken, or any statement from the tools named. If your wallet sent SOL to 7kY8 without you signing, treat its key as compromised and move what's left to a brand-new wallet.

Playboi Carti's X account (3.6M followers) posted a pump.fun link at 8:25 PM ET, to a coin, $carti, and its bio read "@pumpfun" at 8:33 PM ET. We don't know who created the coin or whether Carti or his team had any part in it. By 8:40 PM X showed the post as deleted by its author. The coin was created at 7:41 PM; its 5-minute closes peaked at about $831K at 7:50 PM ET, 35 minutes before the post (GeckoTerminal). Its creator wallet bought 2.0% at launch and sold all of it at 8:34 PM, nine minutes after the post, in a transaction that paid it about 26.3 SOL. It closed at about $32K at 8:35 PM. Replies to the post said the account had been compromised; we haven't seen Carti or his team say so.

$LAUNCH, the coin whose address is in the @_LaunchX launchpad's X bio, has been above $1M since 1:10 PM ET; its latest 5-minute close, at 1:40 PM, was about $2.15M, its highest so far (GeckoTerminal). @_LaunchX's post says "We're removing the developer's Block 0 advantage," and that "independent snipers can still participate." It was created on StonkFun at 7:34 AM; we couldn't tell from the chain whether it was deployed through the launchpad's own tool. In that block the creator bought 1.01%; a wallet funded at 7:30 AM bought 30.0% and sold all of it about a second later; an older wallet active since 21 October bought 16.7%. We found no transfer tie between the 30% buyer and the creator.

“We're removing the developer's Block 0 advantage.”

@_LaunchX, 7:30 AM ET ↗

One Solana wallet, 4GDq…MXgL, keeps sending about 80 SOL to a fresh wallet and getting it back minutes later. Since 25 September it has sent 75 to 90 SOL to 114 wallets, 95 of them exactly 80, and 112 sent it straight back, a median of eight minutes later. In a random sample of 12, each created one pump.fun coin and sold it in one sale. One got 85 SOL at 4:01 PM ET on 23 October, created "Trip" at 4:03 PM buying 30.4% for 12 SOL, sold it all 28 seconds later and sent 85.29 SOL back at 4:05 PM. A new coin's creator wallet showing 80 SOL may have held it for only a few minutes.

Bitquery checked 8.2 million new pump.fun coins launched from 30 October 2025 to 7 October 2026. By its rules for linking wallets to a coin's creator, the creator's wallets bought in the block with the first trade on 21% of them, taking a median 10% of the supply. On launches up to the end of June, those wallets made at least $579 million after fees on what they sold, against $31.5 million for sniper bots. Bitquery's report, with on-chain figures it says were verified 10 October, explains how it linked the wallets and which days it left out. Our same-funder page follows individual launches where one wallet sent SOL to early buyers seconds before launch.

“Pump.fun devs' bundles made $579M+, snipers just $31.5M”

Bitquery (Gaurav Agarwal), figures verified 10 October 2026 ↗

Follow-up to c103: the same fake "claim the $X airdrop" page is up on another new address, memesclaim[.]netlify[.]app, and is being posted on X with the addresses of coins including $BACKERS and $RARI. Give it any coin's address and it builds a page for that coin. Its list of recent claims is made up: the page's own code generates the wallet addresses and amounts. Its "Connect Wallet" button again loads obfuscated code from data-repo[.]cc, and that code can ask a wallet to sign several transactions at once. The page offers the same airdrop for any address it's given. Don't connect a wallet. Checked 7:17 AM ET.

Follow-up to c107: the same "$DACITY allocation is now live" thread and the same site, dacitysolana[.]com, are now being pushed for a second coin, "Dacity Coin" ($Dacity, nxPq…pump, about $11M). The account is @DacitySolOnX, an X account named "Dacity" that isn't the coin's listed account (@dacitygta, per DexScreener). Since 12:32 PM ET it has posted the thread about every seven minutes, with a different number of "eligible participants" each time. A pump.fun coin like this one has no governance vote. We couldn't load the site past its bot check. Don't connect a wallet to it.

“$DACITY allocation is now live.”

@DacitySolOnX, 12:32 PM ET ↗

Follow-up to c105: the holding wallet 7QuF…vPZd has moved its SOL. From 1:57 to 2:01 PM ET on 23 October it sent about 1,521 SOL out in three transactions, the largest 1,011 SOL, to four wallets. It held about 0.9 SOL at 9:15 AM ET on 24 October.

"Project kimchi" (B1Y2…pump) isn't the $KIMCHI we've covered. The program @dethective says its top traders used checks out on-chain. 4sU1…PJ74 was deployed at 8:44:59 AM ET on 22 October and hasn't been used since that day. Its main instruction is named reaper_swap, and on every sale it sent 10% of the proceeds to one wallet, about 276.6 SOL in all. Through it, 46 wallets made 54 buys of project kimchi, 50 of them before @kimchi1x's 4:28:36 PM post of the coin's QR code. 116 of their 196 sells (a full count) came from 4:31 to 4:37 PM, around a repost by @a1lon9 that one account puts at 4:34 PM. They came out about 1,746 SOL ahead through it. The fee wallet sent 200 SOL on at 4:50 PM.

“this program takes a 10% share of the trade, which is A LOT.”

@dethective, 8:21 AM ET ↗

$DacityCoin holders: a fake allocation thread is being pushed while the coin runs. @DacityOnSol, an X account named "Dacity" that isn't the coin's project account (@DacityCoin_GTA), has repeatedly posted "$DACITY allocation is now live" since at least 3:58 PM ET, linking dacitysolana[.]com, a domain registered on 15 October. It's the same thread used on $AGENCY in c60. A pump.fun coin like this one has no governance vote. We couldn't load the site past its bot check. Don't connect a wallet to it.

“$DACITY allocation is now live.”

@DacityOnSol, 5:46 PM ET ↗

Argentina's criminal case over $LIBRA has been dismissed. On 23 October federal judge Marcelo Martínez De Giorgi (Criminal and Correctional Federal Court No. 8) dismissed President Javier Milei, his sister Karina Milei, Hayden Davis, Mauricio Novelli and the other accused "por inexistencia de delito", for lack of a crime, after prosecutor Eduardo Taiano asked for it, Infobae reports. The complainants had been excluded from the case, and their direct appeals are still pending before the Federal Court of Cassation. It follows the 29 September dismissal of the US class action, Hurlock v. Kelsier Ventures.

“por inexistencia de delito”

Judge Marcelo Martínez De Giorgi, per Infobae, 3:17 PM ET ↗

Follow-up to c102: the holding wallet 7QuF…vPZd held about 1,512 SOL at 10:40 PM ET on 22 October. After c102 it received another 392 SOL on 20 October, 229 SOL of it in five more transfers from the sweeping wallet 8dRr…bb5L (the largest, 157 SOL at 4:42 PM ET). Nothing has moved out of it since its first deposit on 18 October.

Update 21 Oct: Parasite's admin key closed the program on 8 Oct; payouts can no longer go through it. On 2 October Parasite opened its first "colony share" payout: at 9:00 PM ET it said 543 $PARASITE holders made the first daily list, claimable by connecting a wallet at parasiteonsol[.]fun/nest. We hadn't checked the claim transaction or what it asked you to sign. Payouts to parasite holders, separate from this, resumed that day after a gap since 30 September. Our check of Parasite. This replaces our 2 Oct item, which linked the Nest claim page; we removed that link after the program closed.

The fake "claim the $X airdrop" page we flagged on $swordinu on 7 October is back on a new address, memecoin-sol[.]netlify[.]app, and is being pushed on X for any Solana coin. Since midnight UTC on 21 October about 2,500 posts link to it, per X's post counts; tickers used in the posts include $BUBBLE, $DARKCAT, $simulator and $TM. The page fills in whichever coin is in the link and shows Jito, Marinade, Orca, Pyth and Bonk logos. It loads an obfuscated outside script, from data-repo[.]cc, that contains calls asking a connected wallet to sign transactions. No coin has an airdrop on this page. Don't connect a wallet to it.

Follow-up to c101: the wallet sweeping wallets with their owners' own keys, 8dRr…bb5L, sent another 269 SOL to the same holding wallet, 7QuF…vPZd, at 6:29 AM ET on 20 October. That's 1,120 SOL in eight transfers since 18 October, and as of 3:27 PM ET none of it had moved on. 8dRr itself was still active at 2:28 PM ET and held about 116 SOL. The look-alike dust kept arriving after each deposit, so check every character of the address before you report it.

Follow-up to c98: the wallet sweeping wallets with their owners' own keys, 8dRr…bb5L, has sent 851 SOL to one other wallet, 7QuF…vPZd, in seven transfers from 11:58 PM ET on 18 October to 10:42 PM ET on 19 October. As of 10:45 PM ET, none had moved on. After most deposits, within about two minutes, transfers of 0.00001 SOL or less arrived from look-alike addresses that also start 8dRr and end b5L: address poisoning, which tries to get someone to copy the wrong address. If you report this drain to an exchange or to Phantom, check every character of the address.

A fake vote like today's Hyperliquid "Season 2" sites is now aimed at HyperLend. An X account named "HyperIend Governance", with a capital I in place of the l, posted an article at 4:45 AM ET on 19 October, "$HPL Goes to the Users. You Vote the Split." (about 38,000 views). It isn't HyperLend's account, @hyperlendx. A link in the article reads "hyperlend.finance", but it goes through a tinyurl to gov-hyperlend[.]finance (not linked here), a domain registered at 4:05 AM ET that day. Don't connect a wallet or sign anything there.

Corrected Oct 19 · 7:29 PM ET. An earlier version called this the same "kit" as the Hyperliquid sites. The two look alike, but we haven't shown they're run by the same people.

A widely read note from @WhiteWhaleLabs, "The Audit Of The Memecoin Casino" (12:06 PM ET, about 53,000 views), says it covers 384 million pump.fun and StonkFun swaps. It counts 22.8 million first buys over two weeks, says a mechanical double-or-stop rule keeps "19%, per pull", and says copying the biggest wallet swarms lost money too. The data isn't public, so we can't check these numbers. One caveat from the author's own reply: in their live trading, half the trades hit a −40% stop, and the median stop filled at −97%, because these coins gap down in a single candle.

“Following the big swarms lost 41% per coin across 93 coins.”

The White Whale (@WhiteWhaleLabs), 12:06 PM ET ↗

A Solana wallet, 8dRr…bb5L, is emptying other people's wallets with their own keys. In each sweep it pays the fee and the emptied wallet co-signs, which only works if whoever runs 8dRr holds that wallet's private key or seed phrase. It made 1,000 transactions between 4:04 and 4:28 PM ET on 19 October, taking SOL, tokens, and even pump.fun creator fees and cashback, and it was still sweeping at 5:33 PM ET. If your wallet sent assets to it without you signing, treat that wallet's private key or seed phrase as leaked and move what's left to a brand-new wallet. Replies offering to "recover" the funds are a second scam.

The fake "$HYPE Season 2" vote is back today on new domains, hidden behind tinyurl short links. Three look-alike accounts are posting it: @HyperliquidEco_, @HyperEco_ and @HyperliquidEC0, whose article had about 32,600 views. The short links now lead to governance-hypereco[.]com, governaces.hyperecosystems[.]network and hyperecosystems[.]app, all three registered today between 1:33 and 2:03 PM ET. Two were registered after the posts linking to them went up, so where a link leads can differ from when it was posted. Hyperliquid's real site is hyperfoundation.org. Don't connect a wallet or sign anything from these links.

“$HYPE Season 2 Rewards Proposal Is Now Live. Cast your vote now: ↓”

@HyperliquidEco_, 1:29 PM ET ↗

Corrected Oct 19 · 2:26 PM ET. An earlier version said the links were re-pointed after posting; what we know is that two domains were registered after the posts went up.

A look-alike Hyperliquid account is pushing a "$HYPE Season 2" vote. @HyperliquidEco_ ("HyperIiquid Ecosystem", with a capital I for the l, verified with an organization badge, 4,944 followers) posted it at 9:05 AM ET. Its link redirects to season2-hyperfoundation[.]app, a domain registered at 8:44 AM ET today, 21 minutes earlier. Its companion article had over 72,000 views within half an hour, and two accounts with over 50,000 followers each are reposting it every 7 to 8 seconds. Hyperliquid's real site is hyperfoundation.org. Don't connect a wallet or sign anything on a domain registered today.

“$HYPE Season 2 Rewards Proposal Is Now Live. Cast your vote now: ↓”

@HyperliquidEco_, 9:05 AM ET ↗

Corrected Oct 19 · 9:37 AM ET. An earlier version said the vote asks you to connect a wallet; we haven't seen the page itself, so we now say only not to connect or sign there.

A wallet lost about 843 SOL in 15 seconds on one pump.fun app buy. At 6:43:27 PM ET it spent 891.44 SOL, all but 0.0015 SOL of its balance, through the app's program on a "Charizard" coin, then sold all of it for 48.09 SOL. The route ran SOL → USDC → CARDS → a "Pokémon" coin → Charizard, because each coin trades against the one before it, and the buy graduated both coins at once. Most of the money went to early Pokémon traders who sold into the jump, spread across many wallets; Pokémon's creator netted under $1K. The wallet signed both trades; the chain doesn't show whether the app or the user set the amount.

The TradeWiz SOL PVP drain has cashed out more of its money to Tron. On 14 October the drain's collector and the attacker's holding wallet sent their remaining 2,149 SOL to one older wallet. On 15 October, between 6:34 and 7:39 AM ET, that wallet passed it on to a new wallet that swapped it all through Bridgers, a cross-chain swap service, into about 217,500 USDT on Tron. Separately, the 435,055 USDC the drain's sweeper had built up left that wallet on 9 October. Who controls these wallets is unknown.

Follow-up on $NEYMAR (NEYMAR JR TOKEN): at 2:03 PM ET the wallet that launched the coin sold its entire holding, about 72% of the supply in circulation, in one sale for 110.31 SOL. At 2:05 PM ET it sent 125.30 SOL to the wallet that funded it, the same wallet that launched the two earlier Neymar-named coins this afternoon. By 2:18 PM ET the coin's market cap was about $2,600, down from about $71,000 at 1:40 PM ET. The page has the trail.

An unverified X account, @NjrToken, is promoting a pump.fun coin called NEYMAR JR TOKEN ($NEYMAR, launched 1:17 PM ET) as "the only official contract". As of 1:51 PM ET, Neymar had posted nothing about it. The wallet that launched the coin holds about 72% of the supply in circulation, and had sold none until at least 1:58 PM ET. It was paid for by a wallet that launched two earlier Neymar-named coins this afternoon. Our page traces it. It is not the older $Neymar coin (XbXi…).

“THIS IS THE ONLY OFFICIAL CONTRACT”

@NjrToken (unverified), 1:27 PM ET ↗

StonkFun's own daily numbers: revenue for 15 October was $159,090, up about 93% from $82,489 the day before, which was the lowest of the days we've logged since 11 October. It spent $94,629 on $STONK buybacks, about 59%. Against its best day in the September run, $2,093,482 on 21 September, revenue is still down about 92% by StonkFun's own figures. The post gives no reason for the rebound.

“Revenue: $159,090 Buybacks: $94,629 Burned: 876.73K $STONK”

StonkFun (@LaunchOnSF), 8:33 PM ET, 15 October ↗

Streamoors launched STREAM at 12:04 PM ET on Oct 15; it left the launch curve 19 seconds later. We checked the creator wallet. At 1:13 PM it sent 27.9M STREAM (2.8% of supply) to 96 wallets. At 1:17 PM, four minutes before the airdrop post, it sold 3.37M (0.34%) for 12.6 SOL. As of 6:21 PM it had sold nothing else and held 65.2M, about 6.5%. The STREAM near $22M is a different coin, created Oct 14 by another wallet.

“We're airdropping dev supply!”

Streamoors (@streamoors), 1:21 PM ET ↗

StonkFun's own daily numbers: revenue for 14 October was $82,489, down about 32% from $120,996 the day before. It's the lowest of the four days we've logged since 11 October. It spent $49,625 on $STONK buybacks, about 60%. Against its best day in the September run, $2,093,482 on 21 September, revenue is down about 96% by StonkFun's own figures. The post gives no reason for the drop.

“Revenue: $82,489 Buybacks: $49,625 Burned: 431.22K $STONK”

StonkFun (@LaunchOnSF), 10:10 PM ET, 14 October ↗

On 12 October, 718,735 USDC left the wallet @rrealist linked as holding his stolen funds. It went to an address that, 35 minutes later at 10:16 PM ET, was swept with four other deposits into a wallet Solscan labels "HitBTC: Hot Wallet 1". The 346 SOL in the same wallet left Solana through the NEAR Omni bridge at 9:24 PM ET. Full trace.

Floyd Mayweather's X account posted the addresses of two Solana coins on 13 October, $FLOYD at 2:10 PM ET and Tiglets at 7:09 PM ET, and has since deleted both posts. On-chain, the wallet that created $FLOYD also sent the SOL that created Tiglets, 54 seconds before it launched. The Tiglets creator sold its whole stake 65 seconds after the post; the $FLOYD creator held through its post and sold 94 minutes later. Full trace on our page.

StonkFun's own daily numbers: revenue for 13 October was $120,996, down about 45% from $219,501 the day before and below 11 October's $146,680. It spent $73,458 of it on $STONK buybacks, about 61%. Against its best day in the September run, $2,093,482 on 21 September, revenue is down about 94% by StonkFun's own figures. The post gives no reason for the drop.

“Revenue: $120,996 Buybacks: $73,458 Burned: 611.78K $STONK”

StonkFun (@LaunchOnSF), 12:03 AM ET, 14 October ↗

StonkFun's own daily numbers: revenue for 12 October was $219,501, with $130,100 spent on $STONK buybacks. Its best day in the September run, 21 September, was $2,093,482. So by StonkFun's own figures, revenue is down about 90% from that peak. The posts don't give a reason for the drop.

“Revenue: $219,501 Buybacks: $130,100 Burned: 893.85K $STONK”

StonkFun (@LaunchOnSF), 8:19 PM ET, 12 October ↗

Corrected Oct 13 · 9:29 AM ET. An earlier version mentioned an unsourced claim by critics about the cause; we've removed it because we haven't checked it.

StonkFun now gives every coin that graduates on it a free Moby Pro upgrade, and part of that package is automatic whale-buy posts on @whalewatchalert. So when @whalewatchalert posts a whale buy in a StonkFun graduate, the buy happened, but the post comes with the coin's launch perks. It isn't an outside account choosing to flag the coin. Coin teams claim the upgrade from their StonkFun token page.

“See every whale holding the coin, and whale buys get posted to @whalewatchalert automatically.”

StonkFun (@LaunchOnSF), 3:31 PM ET, 12 October ↗

$AUTON's X account, @autonxyz, no longer exists: X shows its posts as "from an account that no longer exists" as of 9:20 AM ET. It is the account AUTON's DexScreener and Jupiter listings still link. AUTON is down about 86% in 24 hours, to roughly $470K at 9:19 AM ET, per DexScreener. Its website, autoneco.xyz, still loads. We don't know why the account is gone or whether the team will say. If an account claiming to be Auton turns up with a new handle, check it against the project's site before trusting it.

Corrected Oct 8 · 9:20 AM ET. An earlier version named the wrong website; Auton's site, as listed on Jupiter and on our page, is autoneco.xyz.

The "Holder Crates" lure is one kit across at least four coins, the biggest aimed at $SI (Super Inu, about $22M). Look-alike sites superinu .app, hookedpad .xyz, gomofamily .xyz and swordcatsolana .xyz (none linked here) load the same signing script (the Hooked one a near-copy), which requests transaction signatures and checks visitors' locations first. The $SI one is promoted by @superinuapp, an account opened in July; its 1 October crates article has about 11,900 views. It isn't the project account: DexScreener lists @SuperinuOG. Real sites: hookedpad.com (no crates page) and gomofamily.life; swordcat lists none. Don't connect a wallet to any of them.

Corrected Oct 7 · 10:39 PM ET. Clarified that the Hooked site's script is a near-copy rather than identical.

The "Holder Crates" lure from earlier tonight has a second target: $HOOKED. A page on hookedpad .xyz (not linked here) is titled "$HOOKED Holder Crates" and even names hookedpad.com in its title, but Hooked's real site, hookedpad.com, has no crates page (it returns "not found"). It is the same kit as the $swordcat one: the same script, which requests transaction signatures and checks visitors' locations first, on a domain registered on 28 September. Small accounts have pushed it since 7:36 PM ET with "referral codes". Neither project's site or X profile mentions a crates program. Don't connect a wallet.

Corrected Oct 7 · 10:08 PM ET. An earlier version said neither project runs a crates program; it now says what we checked: neither project's site or X profile mentions one.

Lure warning for $swordcat holders: a "Holder Crates" site on swordcatsolana .xyz (not linked here) says every eligible holder can have a crate, with the "allocation, revealed when you connect". The only thing it does is ask you to connect a wallet, and its script requests transaction signatures and checks visitors' locations first. The project's X profile, @catwifswordsoll, lists only the contract address and no website, and the coin's DexScreener listing doesn't link the site either. The domain was registered on 3 October. Small accounts began pushing it at 4:52 PM ET today. Don't connect a wallet to it.

Corrected Oct 7 · 7:08 PM ET. An earlier version dropped a comma from the site's own wording and said the project's account "hasn't linked it"; it now says what we checked: the profile lists no website.

$SI (Stupid Inu) is up about 560% in 24 hours to roughly $4.1M market cap (DexScreener, 6:47 PM ET); we found no single post that set off today's run. The name comes from a 2024 post by @theunipcs. On 29 September at 3:05 PM ET, @reallygoodeploy quoted it: "i think it might be time lmfao, going to just do a normal rewards pair given the ticker". The coin was created on pump.fun 2½ minutes later and graduated in under 3 minutes. The coin's own metadata links that post. The deployer wallet holds no SI now, and Jupiter counts at least 500 coins created from it. Not the same coin as Super Inu, which also uses SI.

“you could literally call your token 'Football Inu' or 'Stupid Inu' and it would run to $100m rapidly provided it had a half-decent team and a few C-rated influencers to push it”

@theunipcs, 9:50 PM ET, 8 October 2024 ↗

Corrected Oct 7 · 6:58 PM ET. An earlier version quoted only the first half of @reallygoodeploy's post; it now quotes the post in full.

New briefing: Hunter Biden said $LAPTOP's founder coins "haven't moved since launch." On Base, that holds: the founder wallet still held all 300 million at 5:30 PM ET and has never sent any. The same signers also controlled the wallets holding the rest of the supply. Three of those have sent out about 178 million, including 30 million three and a half minutes after trading opened, 5 million of which reached an exchange-style wallet within 70 minutes. Moving tokens isn't a sale, and the project's disclosures allow liquidity and treasury use. Every step links to its transaction.

“All founder coins sit in one wallet and haven’t moved since launch.”

Hunter Biden (@HunterBiden), 10:20 AM ET ↗

StonkFun added $POLLY (Pudgy Polly) as a launch pair this afternoon. Worth knowing before you launch or trade against it: POLLY is a Token-2022 coin with a 3% transfer fee, so the POLLY side of every trade in a POLLY-paired coin pays 3%. One wallet, 5KXD…K6tD, holds both the authority to change that fee and the authority to collect the fees withheld. Under Token-2022 rules a fee change takes effect two epochs (about 4 days) after it is set. Mint and freeze authority are renounced. Checked on-chain at 3:38 PM ET.

“You can now launch coins paired with $POLLY from @pudgypolly, on StonkFun.”

Pudgy Polly (@pudgypolly), 3:27 PM ET ↗

New field report: on 6 October, three pump.fun coins ($swordinu, $A1, $SNDWITCH) sold out their whole launch curve, about 79% of supply, in the second they were created, and in the same block funded wallets bought another 11 to 12% from the new pool, about 90 to 92% in all. Each time, one wallet had funded the buyers seconds earlier, and the SOL from their sells went back to it: at least 2,522, 2,465 and 387 SOL, against about 216, 192 and 190 SOL paid out. All three wallet sets were out within about two hours. How to spot it yourself: compare a coin's created and graduated times on Jupiter, then check who funded the first block's buyers, including any pool buys in that block.

Corrected Oct 21 · 7:17 AM ET. Corrected 21 Oct: an earlier version said about 79% at launch, about 88, 91 and 89 SOL paid out and at least 2,165, 2,096 and 356 SOL back. Our first read missed buys from each coin's new PumpSwap pool in the launch block.

The fake Moonshot vote kit we traced on 28 September is still taking tokens. At 11:25:56 AM ET today a wallet signed one transaction with the kit's wallet, 9KrR…drmC. That transaction sent it 36 $Clash, so a wallet preview would show tokens coming in, and in the same step gave 9KrR…drmC unlimited permission to spend its $Clash. One second later the kit moved 1.57 million $Clash out, about $14,000 at 11:54 AM ET. A third went to a wallet that sold it for 39 SOL within 30 seconds. If you signed a "vote" or "allocation" page, revoke token approvals.

Corrected Oct 7 · 11:54 AM ET. An earlier version said we traced the kit on 4 October; our report was published on 28 September.

$swordinu, a pump.fun meme coin, was at $12.6M at 8:57 AM ET. Its launch was concentrated. Just before it was created, 2:33 PM ET on 6 October, one wallet, 8CUb…WTHM, funded the creator and four other wallets, and in the launch block they bought about 91.65% of the supply. All five sold everything by 4:02 PM ET, while the coin was near $1M, and sent at least 2,522 SOL back to 8CUb…WTHM after it put in about 216 SOL. The run to $12M came after they had sold. Every transaction.

Corrected Oct 21 · 7:17 AM ET. Corrected 21 Oct: an earlier version said three wallets bought 79.3% after 8CUb…WTHM put in 88 SOL, with at least 2,165 SOL back. Our first read missed two buys from the new PumpSwap pool in the launch block.

The full trace of @frogmanhaha's reported $4M+ drain is up. The Solana and Base wallets @EmberCN named as his were emptied in the same 40 seconds on 6 October, by transfers each wallet signed itself. One wallet paid gas to the drained Base wallet and also funded the wallet that received its tokens. The Solana proceeds, 13,241 SOL, went into the Privacy Cash pool, where the public trail ends. How the wallets were compromised is still unknown. The money trail, chain by chain.

Where @frogmanhaha's drained Solana funds went (see c71). Within 25 minutes, the wallet that received them sold all 1.43 million $BP for about 13,054 SOL. Between 4:36 and 5:00 PM ET on 6 October it then deposited 13,241 SOL, roughly $1.6 million, into Privacy Cash, a Solana privacy pool, in 10 deposits, and it now holds almost nothing. A deposit there breaks the public trail. That covers the Solana side of the reported $4M+; the rest was on an EVM wallet we haven't checked. Neither he nor FOMO had posted anything new as of 7:23 AM ET.

Follow-up on @frogmanhaha's $4M drain. At 9:59 PM ET on 6 October, three hours before his own post, on-chain researcher @EmberCN named two wallets as his: one on Solana, one on an EVM chain. We checked the Solana one, 9wMS…v8zQ. Between 4:14 and 4:15 PM ET it sent 1.43 million $BP (Backpack's token), $7,860 in USDC and other tokens to a wallet with no earlier history, 69Fn…CFS. Each transfer was signed with the drained wallet's own key, so whoever moved them controlled that key. He hasn't confirmed the wallets or said how it happened, and FOMO hadn't commented as of 6:38 AM ET.

@frogmanhaha, who ranked #1 on the FOMO trading app's 24-hour board on 27 September, posted at 1:21 AM ET that he was drained of more than $4 million while asleep in Singapore during TOKEN2049. His post has been seen 543,000 times. He hasn't said how it happened or that his FOMO account was the one drained; that detail comes from posts quoting him. As of 6:23 AM ET we haven't found the wallet or the transactions, or any statement from FOMO.

“Was drained for $4m+ USD this morning at 4:30am while I was asleep”

@frogmanhaha, 7 Oct, 1:21 AM ET ↗

Corrected Oct 7 · 6:23 AM ET. An earlier version said "as of 6:30 AM ET"; the item was posted at 6:23 AM ET.

$GOMO, the token of the Gomo social trading app, nearly doubled tonight. At 10:46 PM ET @gomo_family said its first "task" was live in the app's Tasks tab, 24 minutes before the run began. At 11:44 PM ET it said Gomo hit "15k+ users in less than 48 hours", its own figure. From 12:26 AM ET, X accounts posted identical copy ("gomo is the social Solana terminal… Go or miss out") with the coin's address, and a referral post says sign-up pays $2 and a task $0.50. We couldn't see what the tasks ask, so we can't say the copy posts are tasks. $GOMO was at $1.77M at 12:38 AM ET.

“The first solana:9XKzy4KahcZaGJPJtz1PtqGPB3CiseoBrx7TcQhEpump task is now live 💙”

@gomo_family, 6 Oct, 10:46 PM ET ↗

TWEETCRAFT, a pump.fun coin named for @jaivinwylde's Tweetcraft project, more than doubled tonight around a post saying Notch had sponsored the game. The screenshot shows a $100 bid for a server-list slot under the name "Notch", linking only to x.com. Nothing in it shows that the sponsor is Minecraft's creator, and @notch had posted nothing about Tweetcraft as of 9:53 PM ET. By our tracker the run began at 9:31 PM ET, five minutes before the post, and peaked near $2.0M; the coin was at $1.19M at 9:53 PM ET.

“no way notch sponsored tweetcraft 😭✌️”

@jaivinwylde, 6 Oct, 9:36 PM ET ↗

RARI ("No Risk No Rari"), a Ferrari-paired coin on pump.fun worth $1.8M at 5:54 PM ET, was launched by 6nU2…QCy4, the wallet we followed in our report on StonkFun's pair bots. It created RARI at 3:52:34 PM ET, 33 seconds after the first RACE pool we found opened on-chain and before StonkFun, Sunrise or pump.fun announced Ferrari. In that same transaction it bought 39% of the supply, then sold part of it in seven sells over the next five seconds for a net 13.1 SOL. It held no RARI at 5:53 PM ET.

Corrected Oct 6 · 5:54 PM ET. An earlier version called RARI the biggest Ferrari coin on pump.fun; we haven't compared it with every RACE-paired coin.

Hooki, the AI agent that sets $HOOKI's transfer rules on the Hooked launchpad, changed them 13 times in its first day, by Hooked's own log. After the first evening every rule limited selling: how much, how often, at night. It also bought back and burned 0.58% of supply in six burns, all confirmed on-chain. Over the same day the market cap fell from 5,123 SOL to 1,596 SOL. Every change, with price and holders.

slopcannon, a coin launched on pump.fun through Paid (usepaid.app) that names @boneGPT's slop.cc video tool, went from under $15,000 to above $2.5 million around 3 PM ET today; it was at $1.34M at 4:35 PM ET. At 3:05 PM ET Paid told him $10K+ was waiting for him to claim. bone has said before there was no coin, and we found no post from him naming this one today; he's promoting slop.cc minutes. Four more "slopcannon" coins naming him were launched on Backers from 2:24 PM ET, with $0 delivered to him by Backers' count.

“(there is no coin if people try to mint this announcement it is not real)”

@boneGPT, 4 Sep, 8:19 PM ET ↗

A tokenized Ferrari share, $RACE, reached Solana this afternoon via Sunrise, and both launchpads raced to pair it. @LaunchOnSF announced RACE pairs on StonkFun at 3:53 PM ET, 71 seconds before @sunrise posted the listing itself. pump.fun followed at 3:56 PM ET, with holder rewards paid in RACE. By 4:12 PM ET StonkFun's API listed 93 RACE-paired coins, 3 of them graduated. On new pairs, the first minutes usually belong to a bot fleet.

“NEW: Ferrari pairs are now live on @Pumpfun”

@PumpfunEco, 3:56 PM ET ↗

Backers, a new Solana launchpad, launches pump.fun coins that each name an X user, then repays strangers who send that user money on X Money, 1.1x in SOL from the coin's fees. Its Cybertruck coin had delivered $5,450 to @danielcberk by 3:31 PM ET, by Backers' own figures. The extra $25 bonus it advertises is paid from a wallet funded by the creator of Backers' own token. Where the money comes from.

“Yeah to be clear I don’t personally endorse Try Backers and had no idea they did this, but think it’s cool and random”

Daniel Berk (@danielcberk), 12:41 PM ET ↗

$SWAP (Swaply) lost about 98% at 1:12 AM ET in roughly three seconds. We read every trade on its main pool: 119 different wallets sold in that window, taking about 216 SOL out of the pool (from 228 SOL down to 18). A single Solana block, at 1:12:29 AM ET, carried 80 trades on the pool from 80 different wallets, and at least 77 of them were sells. We haven't linked those wallets to each other or to anyone. The coin was worth about $6,900 at 2:27 AM ET.

Corrected Oct 6 · 2:27 AM ET. An earlier version mentioned a buyback-and-burn post "hours earlier"; it came 39 minutes before the drop, and we hadn't checked it ourselves, so we removed it. The value is updated to our own 2:27 AM ET read.

Corrected Nov 9 · 9:45 AM ET. An earlier version said these sells looked like a single planned exit. The chain shows when the sells landed, not who was behind them, so we removed that line. A recount puts the single-block figure at 80 trades from 80 wallets, at least 77 of them sells.

$AGENCY holders: two fake claim sites are being pushed while the coin runs. @UseAgencySol, an X account opened in 2020 whose bio copies Agency's word for word, has posted "$AGENCY allocation is now live" every 7 minutes since 11:47 PM ET, linking agencyspadfun.com, registered on the evening of 3 October (ET). It's the same thread used on $HUMAN, Super Inu and $HIGGS. Separate posts push agencypad.live as an "Airdrop claim", registered on 4 October. Agency's own account, @tryagency, lists agencypad.fun as its site. We couldn't load either fake site past its bot check. Don't connect a wallet to them.

“$AGENCY allocation is now live.”

@UseAgencySol, 11:47 PM ET ↗

A second fake site is out for $HIGGS, and it's the same "allocation" thread used on $HUMAN and Super Inu. Since 10:47 PM ET, @HiggsOfSol, an X account opened in 2009 whose bio copies Higgspad's, has posted "$HIGGS allocation is now live" every 6 to 7 minutes, linking higgspads.com. That's one letter off Higgspad's real site, higgspad.com, and it was registered at 5:40 PM ET today. @HiggsOfSol is not Higgspad's own account, @Higgspad. This comes on top of the fake rewards dashboard from c47. We couldn't load the site past its bot check. Don't connect a wallet to it.

“$HIGGS allocation is now live.”

@HiggsOfSol, 10:47 PM ET ↗

Corrected Oct 5 · 11:08 PM ET. Reworded an unclear sentence about which account is Higgspad's own; no facts changed.

The fake "Axiom Vote" page from c50 has moved to a new address. axmlist.help stopped answering by 6:08 PM ET; votelist.help, registered at 5:30 PM ET through the same registrar, now serves the same vote page at the same path, with the same "new fake vote" code and "connectAndClaim" wallet hook. Since about 8:20 PM ET it has been posted for $KNOTS and, by our count, for 16 coins in two minutes just before 10 PM ET, including $BONK. The posts read "time to vote!" for a "Snapshot on Axiom". Don't connect a wallet to it.

“The $KNOTS Snapshot on Axiom just went live — less than 100 votes to go to get it through.”

One of the posting accounts, 8:46 PM ET ↗

Corrected Oct 5 · 10:08 PM ET. An earlier version said "16 other coins"; the count of 16 may include $KNOTS.

Hooked's AI agent Hooki has now changed $HOOKI's trading rules five times since 4 PM ET, according to Hooked's own public log, mostly limits on selling. At 7:03 PM ET it left a single rule: "you can sell 0.1% at a time straight away, and that grows by 0.1% for every hour you hold, up to 1%." HOOKI then fell about 73% between 7:54 and 8:37 PM ET. At 9:05 PM ET Hooki added a wait between sells for frequent sellers, "never more than 10 minutes", and burned 853,898 $HOOKI it had bought back with 3 SOL. We confirmed the burn on-chain. Holders should know these rules can change every hour.

“a wallet that sells often has to wait between sells, 20 seconds for each sell it has already made, never more than 10 minutes. Your first sell is never delayed.”

Hooki, Hooked's AI agent, 9:05 PM ET ↗

The fake "allocation" playbook from $HUMAN has moved to Super Inu ($SI, about $28.6 million). Since at least 4:41 PM ET, @SuperInuOnSolX, an X account opened in 2013 whose bio now reads "Powered by $SI, Super Inu X Account", has posted the same two-part thread every 6 to 7 minutes. It says "$SI allocation is now live" and links superinsolana.com, a domain registered on the evening of 29 September (ET). The thread is word for word the one @TeamHumanOfSol uses for $HUMAN, and both bios follow the same template. Super Inu's DexScreener profile lists no such site. We couldn't load it past its bot check. Don't connect a wallet to it.

“$SI allocation is now live.”

@SuperInuOnSolX, 4:55 PM ET ↗

$AGENTCAT lost 96% in 14 minutes this afternoon: from about $0.030 at 2:33 PM ET (a market cap near $30 million) to about $0.0011 by 2:47 PM. Nobody pulled the liquidity. We read every one of the 3,489 trades on its main pool between 2:33 and 2:48 PM ET and found no liquidity withdrawal. It was selling: 846 wallets were net sellers (527 were net buyers), and the pool's SOL fell from about 2,295 to about 431. At 4:06 PM ET it was worth about $1.1 million, with about $107,000 of liquidity.

Who can change a Hooked token's rules? We checked four tokens launched on Hooked: $HOOKI, $HAMSTER, $FOMO and $HI. Each is a Token-2022 coin with a transfer hook, a program that runs on every transfer and can refuse it. On all four, the hook's authority is the same program-controlled address, and the three hook programs behind them share one upgrade key, wallet 8D71…wFGz, which can replace the code. Hooked's docs say this plainly: "The hook programs can still be upgraded by Hooked's deploy wallet." So the promise that "nobody else can change" Hooki's rules covers the rules, not the code under them.

“The hook programs can still be upgraded by Hooked's deploy wallet, so bugs can be fixed. That is a trust assumption, and we'll say so clearly if that ever changes.”

Hooked's docs, read 3:40 PM ET ↗

StonkFun says its "Ecosystem Flywheel" has bought back and burned more than $1 million of its top coins. Its own flywheel data, read at 3:06 PM ET, puts the total at $1,015,528 across 70,667 buybacks, about $14 each, spread over its top 10 coins by market cap. We spot-checked one burn listed in that data: at 3:05 PM ET, wallet HU3b…1MaG bought and burned 313.9 $ZCAT, valued at $14.33. For scale, our StonkFun briefing traced about $10.4M in USDC sent since 11 September to two holding wallets by the wallet StonkFun lists as STONK's creator.

“$1,000,000+ bought back and burned across StonkFun’s top 10 coins by market cap.”

@LaunchOnSF, 2:46 PM ET ↗

Another fake vote page, this one posing as Axiom: axmlist.help, registered on the evening of 2 October (ET). By our count, at least 15 X accounts have posted it for $CRAWL since 1:14 PM ET, and it has turned up on at least six coins today. It isn't really counting votes. The page's own code says "new fake vote every 6–22s" and has a function to "Generate a short fake address" for its activity feed. Its vote button carries a "connectAndClaim" wallet hook, and a comment says the wallet step "will be wired up later". We didn't see it ask for a signature yet, but it's built to. Don't connect a wallet.

“Live time labels every second; new fake vote every 6–22s”

Code comment on the axmlist.help vote page, read 1:38 PM ET ↗

Corrected Oct 5 · 1:39 PM ET. An earlier version said "Axiom has no vote here"; we haven't checked Axiom's own products, so we removed it.

A second fake "rewards" site is out, this time for $HUMAN (Team Human). Since 10:45 AM ET, @TeamHumanOfSol, an X account opened in 2009 that now calls itself the "Team Human X Account", has posted the same two-part thread about every 7 minutes. It says "$HUMAN allocation is now live" and links teamhumansol.com, a domain registered at 9:33 PM ET Sunday. Team Human lists teamhuman.org as its site, and the dev's X account hasn't posted since Sunday. It follows the same pattern as the fake $HIGGS dashboard: an old account renamed for the coin and a domain registered within hours of the first post. We couldn't load the site past its bot check. Don't connect a wallet to it.

“$HUMAN allocation is now live. The governance vote has successfully passed, and the allocation process is officially underway.”

@TeamHumanOfSol, 10:45 AM ET ↗

Corrected Oct 5 · 1:10 PM ET. An earlier version said its first post came 25 seconds before the first $HIGGS dashboard post; that post has been deleted and we couldn't confirm its time ourselves.

Corrected Oct 5 · 1:10 PM ET. An earlier version said its first post came 25 seconds before the first $HIGGS dashboard post; that post has been deleted and we couldn't confirm its time ourselves. A later wording said "the same day"; the $HUMAN domain was registered the evening before.

$JEANPHIL holders: a "claim your share" site, jeango.top, is being pushed on X while the coin runs. Three accounts posted the same line 6 times in the 80 seconds to 11:45 AM ET, each with a different opener. JEANPHIL lists no website: its DexScreener profile links only X, TikTok and Instagram. Its X account has posted nothing about a claim or allocation in its last 20 posts. The domain was registered on 25 September, six days after the coin launched. We couldn't load the site (it sits behind a bot check), so we don't know what it asks for. Don't connect a wallet to it.

“$JEANPHIL early users can claim their share while the allocation lasts.”

One of the posting accounts, 11:45 AM ET ↗

Careful with a "$HIGGS holder rewards dashboard" going around. It's posted by @Higgs_Solana_, not Higgspad's own account (@Higgspad), though its bio copies Higgspad's word for word. Until 4 October that account posted only in Japanese, last in May 2023. Its 11:07 AM ET post links rewards-higgs.com, a domain registered at 8:14 AM ET today. As of 11:10 AM ET, @Higgspad hadn't posted about any rewards dashboard. We couldn't load the site (it sits behind a bot check), so we don't know what it asks for. Don't connect a wallet to it.

“Holder rewards on $HIGGS now have a dashboard. See your holdings, what each treasury is paying out, and every payout, each linked to its on-chain transaction.”

@Higgs_Solana_, 11:07 AM ET ↗

The fake Moonshot "vote" lure from our BOB drainer piece is back, word for word, and now it's aimed at many coins at once. Since 8:49 AM ET, X accounts have posted "Attention $OWL Family! YOUR vote matters!", and between 9:51 and 9:54 AM ET at least 13 accounts reposted the same message for 13 other tickers. The tinyurl links open look-alike "Moonshot" vote pages on netlify.app that ask you to connect a wallet. We haven't yet traced where this round's money goes. Don't connect a wallet to a vote page reached from a reply link.

“Attention $OWL Family! YOUR vote matters! Less than 100 votes are needed to list $OWL on the Moonshot Top 100 Leaderboard.”

One of the posting accounts, 9:36 AM ET ↗

The TradeWiz drain money moved again, on Tron. The Tron address that received about 58,700 USDT from the drain's collector, TSDup…YdLY, sent 58,025 USDT to another address, TQZU…6HuX, at 7:42 and 7:56 AM ET, leaving it with 7 USDT. TQZU… takes USDT in from many senders and pays out slightly smaller round amounts minutes later, the pattern of a cash-out broker. At 8:10 AM ET it held 61,260 USDT. The drain's two main Solana wallets haven't moved: 1,586 SOL and 1,599 SOL.

How Backers coins actually pay out, per its own Terms (v1.3, dated 5 Oct): the X account a coin is named for never receives the fees. Each coin's pump.fun creator is a Backers fee vault, "controlled by the Backers program... not by a person." Backers takes 10%; the rest only repays people who first pay the named account in dollars through X Money. And fees "not paid out within 14 days of being credited may go back to the protocol (the Backers treasury)."

“Fees in a coin's pool that are not paid out within 14 days of being credited may go back to the protocol (the Backers treasury).”

Backers Terms of Use, v1.3 ↗

A new fee-routing launchpad, Backers (trybackers.com), says its coins' trading fees pay real people on X. Its own token, $BACKERS, launched at 2:02 AM ET and was worth about $1.7M at 5:39 AM ET. The creator bought 15.2% of the supply at launch and, 17 minutes later, locked all of it with Streamflow until 4 Oct 2027, with no way to cancel. It has also claimed about 73.5 SOL in creator fees so far. Backers says 61 coins have launched on it; we haven't verified that yet.

A third trending Agency coin started the same way as $CLAUDIA and $AIDEN. $ASH's creator bought 26.6% of the supply at launch, 11:23 AM ET Sunday, and sold all of it in 33 sells within the same minute: 32.55 SOL back for 10 in. $ASH then ran to about $1.6 million and was worth about $1 million at 11:40 PM ET, with its creator holding about 0.02%. On Agency, trading fees go to Agency, not the creator.

Corrected Oct 4 · 11:40 PM ET. Corrected 11:42 PM ET: $ASH launched Sunday 4 October, not Saturday.

$BOB's router wallet, the one that takes 90% of BOB's creator fees and funds the "bobs", emptied itself at 8:33 PM ET: 171.64 SOL (about $21,000) went to a brand-new wallet, which passed all of it the same minute to 8zHc…, an address that forwards deposits to an exchange hot wallet. At 9:25 PM ET the router held 0.003 SOL. Its earlier moves were 3 to 5 SOL at a time.

The TradeWiz SOL PVP drain's collector is cashing out to Tron. Since 2 Oct it has sent 490 SOL (140, 80 and, at 7:53 AM ET today, 270) to a hop wallet, 87GS…c8b, which swapped each batch within minutes through a cross-chain swap its program log names "bridgers", into USDT on Tron, all to one Tron address, TSDup…YdLY. The swaps' minimum returns add up to about 59,100 USDT. The collector still held 1,585 SOL and the second main wallet 1,599 SOL at 7:00 PM ET.

$PAYR, the token of the Payr launchpad, fell about 97% in an hour. It was worth about $1 million at 9:52 AM ET and about $4,958 at 2:56 PM ET. Between 12:12 and 2:31 PM ET, 176 wallets sold about $96,000 of $PAYR against $36,000 of buys. Twice, at 2:26 and 2:28 PM ET, six different wallets each sold $300 to $470 in the same block. The pool now holds about 81% of the supply.

Since 11 Sep, the wallet StonkFun's own API lists as STONK's creator has moved about $10.4M in USDC into two wallets: $9.19M to 3sFm… and $1.20M to BsWo…, a wallet it set up on 1 Oct. At 2:32 PM ET they held $9,354,897 and $1,195,779; neither has sent any USDC out. Part of the money comes straight from StonkFun's treasury, which sent the creator wallet $2.27M since 27 Sep, including $225,473 at 1:57 PM ET today. A platform moving revenue into its own wallets is normal; what these two are for isn't public.

StonkFun said at 1:49 PM ET that "over $90,000,000 in rewards have been sent to holders of StonkFun reward coins." Its own rewards disclaimer, linked under the post, says how that's counted: payouts "are valued at current prices, not at the price when each distribution landed," and when the platform holds a large share of a coin, a round "may instead pay holders in that coin itself." So the $90M is today's value of what was paid, often in the paired token or the launched coin, not the dollars holders received at the time.

“valued at current prices, not at the price when each distribution landed”

StonkFun rewards disclaimer ↗

Corrected Oct 4 · 1:55 PM ET. Wording fixed 1:58 PM ET: payouts are in the paired token or the launched coin itself, not "StonkFun's own coins".

New briefing: Saturday's hottest new coins paid their creators about 2,400 SOL in fees. Four creators ($CRAWL, $SPEC, $KNIGHTCAT, $SPLICE) collected about 2,380 SOL in trading fees in under a day, and only one of them still holds a stake in its coin. On Agency's $CLAUDIA and $AIDEN, the creators bought big at launch and sold within the minute, and both coins hit the trending lists minutes later. Why they might do it, what holders got, and how to check a coin yourself.

The US class action over the $LIBRA and $M3M3 memecoins is over. On 29 Sep, Judge Jennifer Rochon (S.D.N.Y.) granted every motion to dismiss in Hurlock v. Kelsier Ventures: from Kelsier, Hayden, Gideon and Charles Thomas Davis, Meteora co-founder Benjamin Chow, and Dynamic Labs on Meteora's behalf. She refused the investors a second amended complaint and closed the case. The claims against Kelsier and the Davises failed on legal grounds or jurisdiction; no court ruled on what happened in the $LIBRA collapse.

“the Amended Complaint is dismissed with prejudice”

Judge Jennifer L. Rochon, S.D.N.Y., Doc 274 ↗

A wallet tied to the TradeWiz SOL PVP drain just moved. Between 2:49 and 2:53 AM ET, 2J9x…, the address our briefing flagged for pulling SOL out of more than 300 drained wallets since 1 Oct, swapped 3,359 SOL into about 406,000 USDC in four large fills, after a 1 SOL test. At 2:55 AM ET it held 429,494 USDC, a token Circle can freeze. The drain's two main wallets haven't moved: 1,846 SOL and 1,599 SOL.

Corrected Oct 4 · 3:06 AM ET. Corrected 3:05 AM ET: 2J9x… is not the drain's main wallet. Our briefing lists it as a separate address of unknown owner sweeping drained wallets; the two main wallets haven't moved.

A second Agency coin on tonight's trending lists started the same way as $CLAUDIA. $AIDEN's creator bought 12.5% of supply at launch (1:17 PM ET Saturday) and sold all of it within the same minute, about 12.1 SOL back for 4 in. 51 minutes later the same wallet launched another coin with a 16 SOL buy, 37% of its supply, and sold that within the minute too, for about 42.1 SOL. $AIDEN ran to about $1.7M afterwards without its creator, who held none of it at 12:30 AM ET.

Another fee-routing launchpad: Payr (usepayr.online) launches a pump.fun coin for any X account and says 90% of its creator fees go to a vault for that account, claimed by tweet; 10% buys back $PAYR. Each vault's key sits on Payr's server. Its token $PAYR launched at 4:23 PM ET and is trading, but at 10:25 PM ET the site showed 0 coins launched, 0 payouts and 0 $PAYR burned. Same model as UsePaid, whose page we checked on 2 Oct.

“The vault's key is held by PAYR's server and the only thing it ever signs is a payout the account asked for.”

Payr site ↗

Tonight's trending new coins pay their creators through fees, not holdings. At 10:10 PM ET: the $CRAWL creator, who bought none at launch, held 460.4 SOL, up from 362.8 at 8:59 PM. The $SPLICE creator held 236.5 SOL; its 0.36% launch buy is gone. The $KNIGHTCAT creator held 163 SOL; its 2% buy is gone. The $SPEC creator claimed about 668 SOL in pool fees from 3:45 to 6:33 PM ET and moved 662 on. That's about 1,530 SOL, roughly $180K, in four anonymous wallets, all launched within the last day.

Three new coins on tonight's trending lists, checked on chain. $CLAUDIA, an Agency coin: its creator bought 24.5% of supply at launch (11:33 AM ET) and sold all of it in the same minute, 25.3 SOL back for 9 in. $SPEC, from spec.fun: its creator locked its 2.3% buy until Oct 2027, then claimed about 668 SOL in pool fees between 3:45 and 6:33 PM ET. $CRAWL, from crawlnet.network: no creator buy; the creator held 362.75 SOL of fees at 8:59 PM ET, after paying 77.7 SOL to 10 wallets at 8:41 PM.

Agency (agencypad.fun) gives every coin launched there an AI "mind" that trades its own treasury. On chain, every coin's money sits in one wallet: 6TC9… (1,948 SOL at 8:45 PM ET) collects every coin's creator fees, signs the minds' trades and burns $AGENCY. Each "treasury" is a ledger entry inside it. The docs say limits are "enforced by code", which means the operator's own servers; we found no audit or named team. What checks out: the $AGENCY buyback (2.54M bought and burned for 288.6 SOL since 11 AM ET today) and the dev's 9.6% locked until 2067.

“the coin's Pump creator fees are permanently routed to AGENCY”

Agency docs ↗

UsePaid posted its first weekly recap at 1:55 PM ET: $3,379,130 in fees claimed, $737,039 in revenue and $732,113 burned. Its own docs, checked at the same time, still say "X Money payouts are paused" and that earlier balances "remain separate". We can't check the recap's numbers on-chain: UsePaid still hasn't published the wallets it pays claims from. Our check of the claim portal.

“Fees claimed: $3,379,130”

UsePaid (@UsePaid), 3 Oct, 1:55 PM ET ↗

Corrected Oct 3 · 2:10 PM ET. Quote fixed: the docs say earlier balances "remain separate", not "remain secured".

A McLaren pit crew wallet turned out to be an exchange deposit address. 4Wxf…, which received the crew's 17.3 SOL from $JAIL on 2 Oct, was swept at 8:36 AM ET on 3 Oct into BfP2…, along with seven other deposit addresses. BfP2… is an exchange treasury over three years old; at 7:22 PM ET it sent 2,000 SOL to a withdrawal wallet it set up three years ago, one that has paid out to 379,038 accounts. What the chain shows: the crew cashed its $JAIL proceeds out to an exchange. Which exchange, we don't know.

Corrected Oct 3 · 7:27 PM ET. Corrected 3 Oct 7:40 PM ET: we first called BfP2… a collector "since 28 Sep" and 4Wxf… a crew holding wallet. BfP2… is a years-old exchange treasury and the sweep was routine exchange consolidation.

The CASH wallet tied to Ryan Trost, CW8W…, was a cash-out route for weeks, not one night. From 15 to 26 Sep it took in CASH, a dollar stablecoin, from sales by the wallet we traced to Trost (~$178K) and by the second wallet it fed, 4BFX… (~$172K), plus swap payouts. In 24 transfers it sent about $427,000 to one deposit address, which forwards to a cash-out service's collection wallet, where the trail ends. It sent ~$67,000 back to the traced wallet. Our earlier figure, $37,900, was the crash night only.

On 24 Sep Lookonchain reported that Point Farm Capital's fomo account held 39.2M STONK, about $638K of CRACKER and about $516K of GP. One wallet matches all three that day: Beqv6dz…. At 7:47 PM ET it sent 22.4M GREEN to the same wallet that the wallet we traced to Ryan Trost had sent 22M GREEN two minutes earlier, three minutes after Trost posted that he and @pointfarmcap had committed "at least a combined 4%" of GREEN; the two transfers add up to 4.4%. Beqv6dz… kept buying CRACKER through the 25-26 Sep crash, then sold 82M CRACKER and 20.7M GP at 8:21 PM ET on 26 Sep.

“STONK remains its primary holding: the account currently holds 39.2 million STONK tokens”

Lookonchain, 24 Sep, on Point Farm Capital ↗

Corrected Oct 3 · 7:42 AM ET. Wording: our standard "the wallet we traced to" instead of a possessive.

The CRACKER Ryan Trost says he sent Avi Felman went to BA3n…, the wallet we traced to Avi. The wallet we traced to Ryan sent it 33M CRACKER at 4:09 PM ET on 20 Sep; BA3n… had bought none. It sold nearly all of it on 22-23 Sep, at the top of the run. A fomo card under Avi's name, posted by StonkPosting, shows CRACKER "received from external wallet" and +$137,262. Its last sale, $12,354.28 on 23 Sep, matches to the cent the USDC BA3n… got at 4:32 PM ET that day. Avi had sold everything three days before the crash.

“You know I sent the supply to Avi so we could get alignment across the top holders”

Ryan Trost (@ryantrost), 30 Sep, 8:08 AM ET ↗

Corrected Oct 3 · 7:42 AM ET. Wording: our standard "the wallet we traced to" instead of a possessive.

Money from the party hat sales went back to the wallet we traced to Ryan Trost. On 26 Sep, CW8W…, the wallet that collected the CASH from those sales, signed two transfers to the wallet we traced to Trost: 1,358.92 CASH at 2:51 PM ET and 2,504.25 at 4:49 PM. That closes a loop of transfers the wallets signed themselves: traced wallet to 4BFX…, 4BFX… sales to CW8W…, CW8W… back to the traced wallet. Most of the rest, about $12,050, went through a deposit address to a cash-out service's collection wallet, where the trail ends.

Corrected Oct 2 · 8:49 PM ET. Reworded the first line to our standard phrasing, "the wallet we traced to".

Two days after Ryan Trost announced he'd seed all six party hats, the second wallet on his file sold into every one of them within about a minute. At 12:28-12:29 AM ET on 26 Sep, 4BFX… sold WHITE, PURPLE, BLUE, GREEN, YELLOW and RED, plus SANTA two minutes after the wallet we traced to Trost sent it 9M, and CRACKER through 1:32 AM. Every sale paid out in CASH, a dollar stablecoin, to a third wallet, CW8W…: about $37,900 that day. At 2:51 PM 4BFX sent 17.9M CRACKER back to the traced wallet.

“myself and others will seed large amounts of $CRACKER AND [GP] into all six party hats”

Ryan Trost (@ryantrost), 24 Sep, 5:57 PM ET ↗

The 85M CRACKER the wallet we traced to Ryan Trost locked on 27 Sep is locked to itself, and only a price target or a date frees it. The Streamflow contract holds 80M CRACKER (the rest went to CRACKER's 3% tax and a fee). It releases everything when CRACKER hits $0.10 a token, about a $49.5M market cap and roughly 330 times the price that day, or on 20 April 2027. Neither side can cancel it or move it. Streamflow controls the price feed, not him. As of 9 PM ET 2 Oct nothing has been withdrawn.

The night CRACKER crashed, a wallet fed by the one we traced to Ryan Trost sold into the steepest part of the fall. The slide began without him: from about $4,950 per million tokens at 10 PM ET on 25 Sep to $2,700 by 12:20 AM. At 12:28 and 12:32 AM the wallet we traced to him sent 31.4M CRACKER to a second wallet, 4BFX…, which it had been feeding since 23 Sep. Between 12:25 and 12:50 AM 4BFX sold about 10.4M, roughly 30% of all CRACKER sold then, while the price fell 63% to $970. Others kept selling; it bottomed near $360 by 3:10 AM. Prices: median per trade, Dune.

The wallet we traced to Ryan Trost, Bra5EH…5yNs, was CRACKER's largest holder when he posted on 22 September that he held "nearly a quarter of the cracker supply". At 4:08 PM ET that day it held about 145.6M of roughly 497.6M CRACKER, about 29%, more than any other wallet (the next held 75.2M). It holds about 2.1M today. Trost promoted the GP, CRACKER and party hat stack in public; CRACKER fell 91% between the daily closes of 25 and 26 September (our file).

“Now for Phase 3 and why I'm currently holding nearly a quarter of the cracker supply”

Ryan Trost (@ryantrost), 22 Sep, 4:08 PM ET ↗

Six fresh wallets launched and sold a new coin this afternoon, then sent their SOL to a wallet that a wallet from our McLaren file had funded. At 3:57 PM ET a fresh wallet created $JAIL on pump.fun; 20 seconds later five more fresh wallets bought about 2 SOL each in the same second. They sold at 4:01, and at 4:03 all six sent their SOL, 17.3 in total, to one wallet in the same second, about 11.4 SOL in, 17.3 out. That wallet had been funded at 3:39 by the MoonPay-funded wallet from our McLaren file, and passed the 17.3 on to another fresh wallet. $JAIL was worth about $3,400 at 8:01 PM ET.

Corrected Oct 21 · 7:37 AM ET. Corrected 21 Oct: the first line said wallets "tied to the McLaren pit crew launched and dumped" the coin. The chain shows that the six wallets sent their SOL to a wallet the McLaren file's MoonPay-funded wallet had funded; their own first SOL came from other wallets.

StonkFun now lets new memes pay part of their holder rewards to another coin's holders. In "Community Mode", announced at 6:21 PM ET, a meme paired with a community coin sends 33% of its holder rewards to that coin's eligible holders and 67% to its own. First up: $USELESS, $PENGU, $ZCAT, $ANSEM and $NEET (StonkFun's pair list showed Community Mode on all five at 6:40 PM ET). We haven't seen a payout on-chain yet. Background: what StonkFun is.

“Each meme launched in Community Mode shares 33% of its holder rewards among eligible community holders.”

StonkFun (@LaunchOnSF), 6:21 PM ET ↗

Corrected Oct 2 · 6:41 PM ET. Fixed the check time: 6:40 PM ET, not 6:50.

StonkFun made BlackRock stock ($BLK) a launch pair this afternoon, and once again a coin beat the announcement. The BLK/SOL pool opened at 3:55:12 PM ET; the earliest BLK-paired coin we found, Sorkincoin, had its pool at 3:55:55, 43 seconds later; @LaunchOnSF posted at 3:57:25 and Sunrise listed the token at 3:58:39. The token is issued by Backpack Securities through Sunrise; that doesn't make it a BlackRock product. Same pool-first pattern we documented on earlier pairs.

“You can now launch coins paired with $BLK from @BlackRock, on StonkFun.”

StonkFun (@LaunchOnSF), 3:57 PM ET ↗

Corrected Oct 2 · 4:10 PM ET. Softened 'the first coin' to 'the earliest BLK-paired coin we found': we can't rule out an earlier one.

Parasite cut its host burn from 50% to 30% of each trading fee. Its admin key upgraded the program at 11:40 AM ET today, and a minute later Parasite announced "the Nest update": 30% burns the host, 30% to the coin's creator, 13% buys back $PARASITE, 5-20% to the coin's holders, the rest to a new pool for $PARASITE holders and stakers. Night Mode, which the docs called fixed in the program, is gone. Feeds since then burn exactly 30%. Our check of the burn, updated.

“30% burns the host”

Parasite (@parasitedotfun), 11:41 AM ET ↗

UsePaid still hasn't said when X Money payouts resume. It paused them on 27 September; its last word on it, on 30 September, was a promise of an update. Since then it has posted about $PAID buybacks and its top coin, not X Money. Its claim portal for Solana payouts stays open. Our check of the portal.

“Once we have more information regarding X Money we will update you guys!”

UsePaid (@UsePaid), 30 Sep, 8:47 PM ET ↗

pump.fun took the "Verified coin" badge off $WIRED. The badge was showing at about 9:50 PM ET on 1 October and was gone by 12:22 AM ET on 2 October; pump.fun hasn't said when or why. It only ever meant the coin's social links checked out at launch. The creator's wallet had sold all its tokens 32 minutes after launch and kept about 390 SOL in fees. The full file.

A fake Jupiter claim page, jupag.pro, is still up as of 1:45 PM ET today, four months after PCRisk reported it as a wallet drainer. It tells visitors their JUP is "frozen" and asks them to sign a transaction. JUP has no freeze authority, so it can't be frozen. X now blocks posts that contain the address. Jupiter's only checker is on jup.ag; late April-June ASR claims go by support ticket before 7 October. Details.

“ASR claims via the Rewards Hub have ended. To claim your ASR before October 7th, please open a support ticket at support.jup.ag.”

Jupiter, ASR Apr-Jun 2026 page ↗

Parasite's keeper is back. The wallet that feeds Parasite's host-coin burns sent nothing for 31 hours, from 2:36 AM ET on 1 October until 10:03 AM ET today; Parasite's treasury restarted its $PARASITE buy-and-burn at 11:29 AM. The fees from trades in between weren't lost, only delayed. Still open: whether holders get the share owed since their last payout on 30 September. Our check of the burn.

cNFTs, a pump.fun launchpad that went live Tuesday, sells a coin's creator fees as an NFT: hold the "claim" and the fees are yours. We checked three of its coins on-chain on day one, and it does what it says. The fee split is 90% to the claim's own wallet and 10% to cNFTs, and it's locked: the admin rights to change it on pump.fun have been given up. The claim's wallet is derived from the NFT itself, so under Metaplex's rules only its holder can spend from it. And cNFTs kept no power to move, freeze or burn a claim. What it can still change: the 1% resale royalty and the NFT's descriptions, including the "vault value" shown on it. Check the fees on-chain before buying a claim.

StonkFun made Rocket Lab stock ($RKLB) a launch pair at 10:56 AM ET Tuesday. Bots were there first. The RKLB/SOL pool opened at 10:54:30; 13 seconds later, four wallets created four RKLB-paired coins (SPCX, ROCKETCAT, ROCKETINU and RI) within one second of each other, about 80 seconds before @LaunchOnSF's post. Of StonkFun's last three new pairs, bots beat the announcement on two (CBADA and RKLB, not NOK). They're reacting to the pool opening; nothing ties them to StonkFun. But by the time the post lands, the obvious names are taken.

A second lure is after BOB holders: an "OKX Hold & Earn" points checker that asks you to connect a wallet to see your "allocation." It isn't on an OKX domain; it's another throwaway netlify.app page (okxholdercommunitypoints-j23w), loading a scrambled script from a third domain, asset-base.cc. It's a different kit from the fake Moonshot vote, and we can't read what it does without running it, so we can't call it a drainer yet. Either way, OKX doesn't run it. Don't connect.

Warning: a "Moonshot listing vote" for BOB is a wallet drainer. Since 20:49 UTC at least five X accounts have posted the same text, "Attention $BOB Family! YOUR vote matters!", each with a tinyurl to one of four look-alike pages (moonshot-listing-qwt, -tfk, -sdc, -rbs on netlify.app). Opening one reports your visit and browser to the operator's server before you click anything. Connecting asks you to sign a batch of transactions that server built, and transactions can move your tokens. The vote tally is invented for any coin. Nothing ties it to BOB's team. Don't open it. The investigation: its payout wallet has drained nine wallets.

Corrected Sep 28 · 8:52 PM ET. An earlier version said a vote needs no signature. Some real votes do ask for one, either a message that proves you own the wallet or an on-chain transaction. What marks this page is that it only asks you to sign transactions an outside server built.

Corrected Sep 28 · 8:55 PM ET. Added: the page reports every visit to the operator on load, before any click. Trimmed wording to fit.

Corrected Sep 28 · 9:05 PM ET. Added a link to our investigation of the payout wallet.

Governor Newsom signed AB 2409 on 27 September. It bars California public officers and employees from issuing a meme coin. It also bars platforms from listing, for California residents, any meme coin offered by or with a federal, state or local official, but only coins issued on or after 1 January 2027, so it doesn't reach a coin launched before then. The governor's announcement says the ban covers coins using an official's "likeness or image"; the bill text doesn't say that. It covers coins "offered by, or in partnership with" an official. The Attorney General can sue to stop either and claw back profits; local prosecutors can sue an official who issues one.

“A public officer or public employee shall not issue a meme coin.”

AB 2409, as enrolled (Gov. Code §7599.211) ↗

Quebec's securities regulator, the AMF, has put pump.fun on its list of investor warnings, filed under crypto assets and high-risk platforms. The notice is dated 25 September and names Baton Corporation LTD as another business name pump.fun uses. It is a registration warning, not a fraud allegation or an asset freeze; three other firms were added to the list the same day.

“Pump.fun is not registered with the Autorité des marchés financiers (AMF) and is not authorized to solicit investors in Québec.”

AMF investor warning, 25 Sep 2026 ↗

The trader Rasmr says traders are the new athletes and should trash-talk each other like NBA rivals instead of acting like one team. At 2:42 PM, Ansem, who has 1.4 million followers, quoted the clip with one word: "agree." By 5 PM his post had about 100,000 views, more than the clip itself.

“If we're all on the same team, who are we taking the money from?”

Rasmr, in a clip posted by @umar_xbt at 11:56 AM ET ↗