Coordinated operation behind 53 token launches on Robinhood extracted at least $18.43M in suspected rug pulls.
Security & Exploits ·
A coordinated operation has been linked to 53 token launches on Robinhood over a two-month period, with investigators identifying at least $18.43 million extracted through suspected rug pulls. The scheme involved launching tokens through shared infrastructure, with proceeds from one launch funding the next in rapid succession—often within seconds of each other. Most tokens were sniped for over 70% of their supply and distributed across 70 to 200 wallet bundles, typically launched via Pons V2.
The operation employed several linking mechanisms to obscure coordination: 45 launches were connected through money flows where one launch's hub paid the next launch's funding key; four launches shared the same private keys across different funding batches; and four others routed proceeds through common collector wallets. In one documented example, wallets associated with one token swept funds into a hub that subsequently paid another token's funding key just 16 seconds before that key signed the next launch batch. Notably, the group conducted fake launches of real tokens beforehand to generate hype and extract additional value before announcing legitimate contract addresses.
The investigation identified at least two other serial deployment operations operating independently, also extracting millions across dozens of launches. Most recovered funds remain on Ethereum and therefore difficult to freeze, though the investigator reports tagging all involved wallets in an onchain database for future reference.