TL;DR: A serial rug puller on Solana executed 64 exit scams in under 24 hours, but lost money on more than 95% of them.

But how could this happen? Isn’t rug pulling a pretty straightforward process? Are bots sniping the liquidity or front-running transactions? What’s going on?

We identified the following address on Solana: 9ZmcRsXnoqE47NfGxBrWKSXtpy8zzKR847BWz6EswEaU. Since memorizing a bunch of 44-character strings is a bit much to manage for the sake of an article, let’s call this address Homer.

In under 24 hours, Homer lost 272 SOL, worth approximately $45,900.

To better understand what’s going on, let's break down an exit scam involving the $TWS token.

• May 13, 2024, 4:05 UTC: Homer minted 99,999,999 TWS.
• 13:18 UTC: Homer set up a TWS/SOL liquidity pool on Raydium, adding 98,999,999.99 TWS and 1 SOL.
• Homer immediately swapped 4 SOL for TWS, artificially inflating the price.
• 13:22 UTC: Homer exchanged 80,160,319.64 TWS for 0.018 SOL and exited the pool.

So Homer swapped a total of 5 SOL for a final return of just 0.018 SOL.

He repeated this “trick” every few minutes, dumping 5 to 10 SOL into a liquidity pool and only getting a tiny fraction back. Roughly half of his transactions resulted in losses of more than 90%.

Tracking The Donut

Homer’s loss must be someone else’s gain.

But whose?

We tracked Homer’s funds and found three main addresses to consider:

• 6kt6xT6nZGGmPzJPrQtKPqNrdj5CoiVCuD2xuGQvxJ5Q (Bart)
• A1bQt2v8NUi3DghZRu8cC6LcpdXHPURDKkrV6v9mCtVC (Lisa)
• 5eHgh9QnFTnRQYnCHoc3fzfW6rztkq5GjsuLYpDvDBSa (Maggie)

Bart received most of Homer’s funds (~272 SOL).

Interestingly, as we’ll see, this account is controlled by Homer.

Here’s how it worked in the $TWS example:

• Homer added liquidity to the TWS pool via Bart.
• LP (liquidity provider) tokens were minted to a third address: Maggie.

Maggie is also controlled by Homer. This address was used to temporarily hold LP tokens and was abandoned after the rug pull.

Lisa the Heir

Lisa was the second-largest recipient and played a unique role. She acted as Homer’s inheritor, receiving his final transaction. Lisa not only inherited 6.4 SOL from Homer but also took over his operational activities. From May 13 to 15, Lisa then initiated 83 rug pulls.

By analyzing the flow of transactions, we also identified Lisa’s corresponding sub-account, its successor, followed by another, and so on...

Mapping the Connections

According to our tracking, the sequence of the rug pullers is as follows:

A total of 70 addresses engaged in transactions with multiple rug puller addresses simultaneously. But two addresses in particular stood out:

• EZBbaxg7YqWo3XMAsTThZJEmTC9Dv78F5aB9srvsCtJg (Krusty the Klown)
• D3s8Zf1zh8R98JBU9Fw4K8fViv1DDzCmoPbNTmJwXKbD (Chief Wiggum)

Krusty is the second-largest player by transaction volume, swapping 110.88 SOL with the rug pullers. Onchain data shows that Krusty has been actively involved in many rugs, though not always to his great profit. The latest scam Krusty dipped into was PepeTrump ($PTRUMP), which netted him a cool $48. Krusty has conducted nearly 5,000 such transactions for a grand total of about $10,000.

Still, these are consistent profits. Each time a rug puller deploys a new meme, a portion of the initial tokens is minted to Krusty, who distributes them. All recipients and Krusty engage in frequent trading with the meme to quickly inflate its volume and price, eventually leading to a coordinated sell-off.

There is a supporting cast of at least 70 other addresses similar to Krusty out there, playing the same game with newly-launched meme tokens that are never intended as anything more than rug pull pumps and dumps.

But with such a high volume of tokens launching, there are many opportunities for things to go better than in the case of PepeTrump.

Chief Wiggum’s address has collected a total of over 140 SOL from the key players mentioned above.

Chief Wiggum serves as a central fund collection hub for the rug pullers.

Chief Wiggum distributes the proceeds, sending them to centralized exchanges and onchain investment and staking contracts:

• GGMcDYzUKFDsXGba6K6S2NoKdD8S4a6QDoEY47DSx65X (OKX)
• HCR8ZrgDCVFQhoaFXR7PKpn9tPABa4rKscpMwoJTF9be (Bybit)
• J97QXy94SfwzgWfi8Y625wkAANVqSwxyD7dzw9bd8X5Z (Investment and Staking)

Who Pays?

The degens who trade newly-launched memecoins on Solana and their bots, that’s who (with all respect due to you innovators).

For example, Barney and Moe were the third and fourth largest holders of PepeTrump. But they're outside of Homer's gang.

They purchased 1.3 SOL and 0.5 SOL worth of $PTRUMP, respectively. Just 10 seconds later, Homer dumped on them, driving the price down to nearly zero.

Both Barney and Moe are frequent participants in the meme markets, with some success.

While Homer caught him out with $PTRUMP this time, Barney has earned approximately 86 SOL from new meme listings over the past three months.

With ongoing tracking, we continue to uncover new addresses tied to Homer's group. As of May 31, 2024, they have moved a total of ~863 SOL through Chief Wiggum’s address, worth about $145,000.

While the fertile fields of Springfield Solana are rich with market activity, there are many scams and scammers to watch out for.

We hope you enjoyed this Simpsonization of onchain drama. Keep an eye out for a forthcoming more technical investigation of similar schemes.