Author: CertiK
On the evening of May 13, 2024, the CertiK team detected a suspicious address on the Solana chain: 9ZmcRsXnoqE47NfGxBrWKSXtpy8zzKR847BWz6EswEaU (hereinafter referred to as "Little Nine").
From May 12th to 13th, Little Nine initiated a total of about 64 rug pulls on the chain, with one happening every few minutes. In less than 24 hours, Little Nine lost a total of 272 SOL, worth about $45,900.
01 High Investment Low Return: Revealing Little Nine's Modus Operandi
So how did Little Nine operate? Let's take the last meme TWS deployed by Little Nine as an example. At 4:05 UTC on May 13, Little Nine minted 99,999,999 TWS. At 13:18, Little Nine deployed a TWS/SOL liquidity pool on Raydium, injecting 98,999,999.99 TWS and 1 SOL; then immediately pulled 4 SOL.
At 13:22, just 4 minutes later, Little Nine exchanged 80,160,319.64 TWS for 0.018 SOL and left. Such transactions occurred every few minutes, and Little Nine consistently "invested high and returned low," investing 5 to 10 SOL in each pool and ultimately receiving far less SOL than the cost, with nearly half of the trades incurring a loss rate of over 90%.
From the transaction records, it is clear that Little Nine acted intentionally, with the token quantities and operations being identical each time.
02 Funding Puzzle: Who is Profiting from It?
If Little Nine is losing money, then who is making money?
Tracking Little Nine's "Transaction Flow"
To find the answer, we first compiled and analyzed all of Little Nine's transfers, resulting in a "transaction flow." In this flow, we found the addresses where Little Nine's funds mainly flowed:
6kt6xT6nZGGmPzJPrQtKPqNrdj5CoiVCuD2xuGQvxJ5Q (Little Six)
A1bQt2v8NUi3DghZRu8cC6LcpdXHPURDKkrV6v9mCtVC (A1)
Operating Account: Little Six
Little Six is the main recipient of funds from Little Nine, accumulating approximately 272 SOL from Little Nine. However, Little Six is a sub-account of Little Nine (SOL Token Account). Little Nine used Little Six to provide liquidity for meme pools and to speculate on trading volume.
The following is a related transaction between Little Six and Little Nine. Little Nine initiated the transaction (adding liquidity to the pool), paid through Little Six, and minted LP tokens to another address (5eHgh9QnFTnRQYnCHoc3fzfW6rztkq5GjsuLYpDvDBSa). According to on-chain analysis, this 5eHgh address was also created by Little Nine and was only used to temporarily hold LP tokens. After the corresponding meme was rug pulled, 5eHgh was also destroyed.
Successor: A1
A1 is the second largest recipient of funds, and it is also quite special. A1 is Little Nine's successor, with Little Nine's last transaction on the chain being sent to A1. A1 not only inherited 6.4 SOL from Little Nine, but also inherited Little Nine's business. From May 13th to 15th, A1 continuously orchestrated rug pulls on the chain (a total of 83).
Similarly, through repeated flow analysis, we identified A1's sub-accounts, as well as its next successor, and its next next… successor.
03 Relay Game: All in Cahoots
According to CertiK's tracking, the order of rug pullers' relay is as follows:
By comparing the trading partners and fund flows of the above addresses horizontally, we discovered more interesting things. There are 70 addresses that have funds flowing to and from multiple rug puller addresses. Among them, we identified two major addresses:
EZBbaxg7YqWo3XMAsTThZJEmTC9Dv78F5aB9srvsCtJg (E)
D3s8Zf1zh8R98JBU9Fw4K8fViv1DDzCmoPbNTmJwXKbD (D3)
Behind-the-Scenes Winner: E
E is the second largest trading volume address, with funds flowing to and from the aforementioned rug pullers totaling 110.88 SOL. According to on-chain data analysis, E heavily participated in rug pullers' meme scams and profited from the transactions. E's recent involvement in a meme called Pepe Trump resulted in a profit of $48 (source: dexscreener). Similarly, E has conducted approximately 50,000 meme trades recently. Based on its trading volume, E has made an estimated profit of about $10,000 from these activities.
How does E ensure its profits? Each time a rug puller deploys a new coin, a portion of the initial tokens is minted for E, which is then distributed. Through frequent trading, the addresses that receive money and E together artificially inflate the trading volume of memes in a short period of time, and then collectively dump the market.
After making money, E returns the money to the rug pullers. As of the time of writing, E has transferred a total of 41 SOL (approximately $7,000) to the aforementioned rug puller addresses.
And there are at least 70 more trading addresses like E. They are still actively trading in newly launched meme scams, even until today.
Fund Aggregation: D3
Additionally, the address with the most transactions with rug pullers is D3, with the transfer amount between it and the aforementioned rug puller addresses exceeding 140 SOL. According to on-chain data analysis, we found that D3 is the fund aggregation address for the rug pullers.
After receiving money, D3 has transferred the funds to the following three addresses:
GGMcDYzUKFDsXGba6K6S2NoKdD8S4a6QDoEY47DSx65X (OKX)
HCR8ZrgDCVFQhoaFXR7PKpn9tPABa4rKscpMwoJTF9be (Bybit)
J97QXy94SfwzgWfi8Y625wkAANVqSwxyD7dzw9bd8X5Z (Staking + Investment)
Among them, G and H are exchange addresses, and the money transferred to J is used for on-chain staking and investment.
It turns out they are all in cahoots, so Little Nine and the others continuously created liquidity, pulled the market, and then sold. In the end, they just moved the money from one pocket to the other (all taken by their own people). Finally, everyone took the money through the aggregation address. The specific fund flow is shown in the figure below:
Victims: Meme Hunters
I don't know if anyone has noticed, but in the addresses we mentioned earlier, one address has been consistently making money, and that is E. Whose money is E making? It's the meme hunters' money (especially the meme hunting bots). Taking the previously mentioned Pepe Trump as an example: the third largest holder of Pepe Trump (DaKf…9A9R) and the fourth largest holder (6Md4…AKnW) purchased tokens worth 1.3 SOL and 0.5 SOL, respectively, at 10:50 on May 29th, but before they could sell, they were rug pulled. Of course, there are definitely more victims, but these two are just more obvious in their losses.
Just about 10 seconds after their purchase, the addresses controlled by the rug pullers started selling in large quantities, almost reducing the price to zero:
Through analysis of on-chain data, we found that these two victims frequently participated in meme "hunting" trades on the Solana chain, i.e., buying memes early in the meme pool and then selling at a high price. Da has made a profit of about 86 SOL through meme hunting in the past three months, and Pepe Trump is one of the few traps it fell into. Given the rapid occurrence of rug pulls by the addresses associated with Little Nine in this article, usually not exceeding 5 minutes, we reasonably suspect that this is a scam specifically tailored for meme hunting bots.
04 Conclusion
Through the analysis of the on-chain behavior and fund flows of addresses like Little Nine, we have discovered a carefully planned and highly targeted rug puller system. It must be said that the rug pullers are also keeping up with the trend, targeting the increasingly thriving bot trading in the Solana ecosystem. From Little Nine's frequent losses, to the complex operations of associated addresses, to fund aggregation and transfers, these addresses create a false market image by constantly transferring funds to each other, attracting more investors to join in.
To this day, the Little Nines are still active. According to CertiK's continuous tracking, we continue to discover new addresses associated with Little Nine. As of May 31, 2024, this group has transferred approximately 863 SOL, about $146,000, through the D3 address.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
