# The fake Moonshot vote names its payout wallet

Source: trenchbook.app · filed Sep 28, 2026, updated Oct 7, 2026 · https://trenchbook.app/dispatch/moonshot-vote-drainer

> There is no official trenchbook token or contract address (CA). Anyone selling one is not us.

**In short:** A fake Moonshot listing vote for BOB, spread on X on 28 September 2026, is a wallet-drainer kit. Its code hard-codes a payout wallet that drained tokens from nine wallets between 20 and 23 September and holds 21.16 SOL.
Update, 7 October 2026, 11:54 AM ET: the kit is still taking tokens. At 11:25:56 AM ET today a wallet signed [one transaction](https://solscan.io/tx/gYvL1rvjvKqVKx7LD7UXT4KkYNXT5Ysh5no2kPoU3P8VQhn37f7P2qR5ZLWx3nX9rEdjMf5skvAjg4fmgjLFxXY) together with the kit wallet 9KrR…drmC. It sent the signer 36 $Clash, so a wallet's preview would show tokens arriving, and in the same transaction gave 9KrR…drmC unlimited permission to spend the signer's $Clash. One second later 9KrR…drmC used that permission to [move 1,568,948 $Clash out](https://solscan.io/tx/3hsNseugJE3Eg4snYHiMZkqi5ya3VPErg84wBfC21L5Hfdno9QTWAzPWGxQQcXi6gChVQL389b5QGaK6n1YUcSVa), about $14,000 at 11:54 AM ET: a third to the split wallet 34x8…Xodd, which [sold it for 39.16 SOL](https://solscan.io/tx/4KxwZ52hfA7WAkwKEUXdoJTtqebU3y1PswuX3CkqyutmVa992h1QZoYyT2UEozNtTiQBQ1P7pX4537zPK5G1dvjH) 28 seconds later, and two-thirds to 9hBp…QJEN. 9KrR…drmC has signed 82 transactions since midnight ET.
On Monday evening, at least five X accounts posted the same message: "Attention $BOB Family! YOUR vote matters!" It linked, through tinyurl, to one of four look-alike pages on netlify.app offering a "community vote" to list BOB on Moonshot. [We flagged it that night](https://trenchbook.app/chatter#c4) as a wallet drainer. Its code has since told us more: where the money goes.
Update, 5 October, 10:25 AM ET: the same lure is running again, far bigger than the BOB round. Since 8:53 AM ET on 4 October, 182 X accounts have posted "YOUR vote matters!" (or a "New Listing Around the Corner" variant) more than 1,600 times, naming about 890 different tickers, by our count from X search ([one of today's posts](https://x.com/ZelithETH/status/2107090861217788135); [our chatter](https://trenchbook.app/chatter#c46)). The links we checked go through one of five tinyurl addresses that forward to look-alike "Moonshot" pages on netlify.app. At 10:39 AM ET, 30 of those pages were live and more than 40 had been taken down. Each page fetches a hidden script from outside the page and hands the vote button to a wallet-connect step; it also reports every visit and click back to its operator. We haven't yet traced where this round's money goes, and we found no victim posts from the last day. Moonshot itself [said in June](https://x.com/moonshot/status/2061898490498646230) that "anyone telling you to vote, click a link, or send money to get verified is a scam." A second set of posts pushes "vote on fomo" pages on pages.dev, which also ask visitors to connect a wallet.
Update, 5 October, 9:40 AM ET: one of the split wallets, 4qRw…FNAD, keeps passing its SOL on to a wallet we hadn't named, 64Rr…ERQp. This morning it sent [0.339 SOL](https://solscan.io/tx/5NCtUsToTBBPH2sMiKW8jf4j8VjqcbEjLdBam8JETry2eAqkSmWq67yW2mSg7UWxdp7N8mX7xwHoyVmHYYsmPMxF) at 8:23 AM ET and [1.543 SOL](https://solscan.io/tx/2fu38T4qyFmgCqumD3ydshF8v8cxwvxG2yr5Kh6oY6Tbjifmka8Sfn8U74DiUKP3rkCuZBMyyVnxsybiWodf1mNr) at 8:36 AM ET. 64Rr…ERQp has been active since 17 September and held 17.54 SOL at 9:39 AM ET. Who controls it is unknown. Look-alike addresses starting "4qRw" that send it tiny amounts are address-poisoning dust, not the split wallet.
The page's script is a kit, written for whoever bought it. A section headed "Hitter Config" sets targetWallet to 9kRW…iNpv, with the comment "your split wallet." Other settings "bypass estimated changes," which hides the preview a wallet shows before you sign, and set the "amount of tokens victim should see on prompt" to 25 of a fake XP token. All four copies of the page carry the same payout wallet. Opening the page reports your visit to the operator's server before you click anything.
That payout wallet has a record. Between 20 and 23 September it took part in 22 transactions, and nine different wallets lost tokens in them. Each drain was split: roughly two-thirds to three-quarters to the payout wallet, the rest to one or two of five other wallets. The payout wallet then sold what it got for SOL. It holds 21.16 SOL, and every bit is accounted for: 19.32 from selling drained tokens, 1.84 taken from victims directly.
The drains came two ways. Twice, the victim signed a transaction that emptied their own wallet. The other eight times, the victim signed nothing: one of two kit wallets, 9KrR…drmC or FPjX…cjkF, moved their tokens because the victim had earlier approved it to spend them. [One of those approvals](https://solscan.io/account/51JKzMNEsXaVEegfhEebu5kqJKeAyiYT6MWXNSUWLhwY) is still in place today, for an effectively unlimited amount.
The fake XP is real too. At 23:43 UTC on 20 September, one victim's tokens were drained, and [in the same minute](https://solscan.io/tx/2AZ4eZjLqZoo8EosWpxLeQofFEF6NdebVkW5Gg6AJUQUemsyGaAs1bJYTe5hPeHDeTK3hzpyrPaufjFPaqfk4Hnq) the same kit wallet sent that victim exactly 25 of the XP token the config names, the amount it tells the page to show.
The payout wallet's last transaction was on 23 September, five days before BOB launched, so none of this money came from BOB holders. We found no link between it and BOB's team; the drainer rides whatever coin is trending. As of 01:00 UTC on 29 September, the BOB campaign hadn't paid into this wallet. The pages have been reported to Netlify and tinyurl.
If you connected a wallet to one of these pages: move what's left to a new wallet, and revoke any token approvals you don't recognise. An approval keeps working after you close the page.

## What we don't know

- Who runs the kit, and who bought this copy. The code reports each visit to a Telegram group chat; we don't know whose.
- How much the five wallets that took the smaller cut received in total. We traced only the payout wallet's side of each drain.
- Whether the BOB campaign has drained anyone yet. As of 01:00 UTC on 29 September nothing had reached the payout wallet, but the other wallets may have been paid first.
- What the page's transactions do in full. That code is scrambled, and reading it means running it; we haven't. The drains above come from the payout wallet's own record.

## The evidence

- **The payout wallet is written into the page** (severe): All four copies of the fake vote page set targetWallet to 9kRW…iNpv under a "Hitter Config" heading, commented "your split wallet." The same config hides the wallet's balance-change preview ("bypass estimated changes") and sets what the "victim should see on prompt." We read the code as text and never ran it. [the payout wallet](https://solscan.io/account/9kRW3fP2t3cXemK8Vhro81sE2eJvNihFENEFvCBWiNpv) [our first warning (c4)](https://trenchbook.app/chatter#c4)
- **Nine wallets drained into it, 20–23 September** (severe): 22 transactions. Nine wallets lost tokens, each drain split between the payout wallet and one or two of five other wallets. The payout wallet then sold the tokens for SOL. Its 21.16 SOL balance is fully explained: 19.32 from those sales, 1.84 taken directly. [a drain the victim signed (20 Sep)](https://solscan.io/tx/4MB5hiVVqhLaFtdSsJeFJDEkWYMmuBYEt5sYcWLtzpPYtcf3bk2LzjwJyzqS7S4juaAG9suGkf8zUzMiPjXUT2Ds) [sale of drained tokens (22 Sep)](https://solscan.io/tx/4sv7sCPba1RPgv39yuXxToLe4PQnYsPmbKLWFtowxcibhYrfBvNmmfiDbSEj8zYCkRt2Wgn7RCY5mbyFFa2VcXHJ)
- **Tokens taken without the owner's signature** (severe): In eight of the ten drains the victim didn't sign. Two kit wallets moved the tokens as approved spenders: 9KrR…drmC five times, FPjX…cjkF three times. One victim's token account still lists 9KrR…drmC as its approved spender, for an effectively unlimited amount, as of 29 September. [a drain with no victim signature (22 Sep)](https://solscan.io/tx/4tkmbShoxw8xobiSNHmtq2B1TBtPGi57JDWZxafYqRsfQ2hXg1aZyb2U37b2tKB2C8Q1Ppa4DWnwG2eLKGsSdQGx) [a drain spent by FPjX…cjkF (21 Sep)](https://solscan.io/tx/2HFs2erf6LjdKJPqCA5qvuY198Cnawn8wje9ppknM1VMEyE7N9f2wzXyQLybxot9TYFykcBBfnNSXTsC13GPFHBD) [the approval still in place](https://solscan.io/account/51JKzMNEsXaVEegfhEebu5kqJKeAyiYT6MWXNSUWLhwY)
- **The 25 fake XP, delivered** (warning): The config shows victims 25 of a spoof XP token. At 23:43 UTC on 20 September one victim was drained, and in the same minute the kit wallet sent them exactly 25 of that token. [25 XP sent](https://solscan.io/tx/2AZ4eZjLqZoo8EosWpxLeQofFEF6NdebVkW5Gg6AJUQUemsyGaAs1bJYTe5hPeHDeTK3hzpyrPaufjFPaqfk4Hnq) [the same victim drained](https://solscan.io/tx/HrePHgz3nXNADvxJTgRTBavbG1GsracjXft3DnBSgoooYmeSM3P1ed5N6hUqmhTfSHm234iUSEjqzxMXx57GHfn)
- **No tie to BOB's team** (clean): The payout wallet's last transaction was on 23 September, five days before BOB launched. None of its 22 transactions involve BOB or BOB's creator, router or project wallets. [the payout wallet's history](https://solscan.io/account/9kRW3fP2t3cXemK8Vhro81sE2eJvNihFENEFvCBWiNpv)

## The wallets

- **payout:** `9kRW3fP2t3cXemK8Vhro81sE2eJvNihFENEFvCBWiNpv`: hard-coded as targetWallet ("your split wallet"); received the larger share of every drain; holds 21.16 SOL
- **drainer:** `9KrRRRLd99PnA67duMUjrWhUyoGUNrBaQ33bziALdrmC`: approved spender on victims' token accounts; moved five victims' tokens without their signature; sent the 25 fake XP
- **other:** `9KrRNz5jKLXc6YS9gXYVskN6HpwaKJoG23jCPpj9KpmC`: sends dust to the payout wallet after drains
- **other:** `FPjXY1CXRVhg276vSKYpS1Pz4EFXvZvHGUrj3MtCcjkF`: pays the fees on drains; also an approved spender that moved two victims' tokens
- **split:** `34x8U7cLGfG5MZRpGLNHVyj9onqNYgE91bXSMos9Xodd`: took the smaller share of four drains
- **split:** `BPR6Rq4y4Fh24hqgy5hMnaBmzhhrNvvZVGYZudmNWN2r`: took the smaller share of two drains
- **split:** `2s9JRAWjw4g5TF4JfW3CuqHfmNfXVXfaAm3qenfCRYZo`: took the smaller share of one drain
- **split:** `Bwh9yXyYsJgqpRL1aRGCZ9aMBmKqGuBGzVaQ2y4CGcaR`: took part of the smaller share of one victim's two drains
- **split:** `4qRwX2nQrJMn5hwNvTx2KoNsqcvxpdKP389TyPNfFNAD`: took part of the smaller share of one victim's two drains
- **other:** `sighWH8KaiT7QhtV4w29ReVF8kG6D5yG3EQP1KYyGVF`: co-signs the payout wallet's sales of drained tokens
- **onward:** `64Rr4mHM4nviGZgZzmRFjEYZgvbA59gYGWzMe7mjERQp`: Receives SOL from the split wallet 4qRw…FNAD (0.339 and 1.543 SOL on 5 Oct); held 17.54 SOL at 9:39 AM ET, 5 Oct. Owner unknown.

## The coins

- $BOB: `E4vwseNWpkBxzNxyv3msVLCzYHU5SXrj1QWXEycypump` (the lure: the fake vote was for BOB)

## Sources

- post: [The earliest post spreading the fake vote, 20:49 UTC 28 Sep (don't open its link)](https://x.com/tidebreakersnft/status/2104674858919739532)
- onchain: [The payout wallet: all 22 transactions](https://solscan.io/account/9kRW3fP2t3cXemK8Vhro81sE2eJvNihFENEFvCBWiNpv)
- trenchbook: [Our warning when the pages appeared (chatter c4)](https://trenchbook.app/chatter#c4)