Coordinated wallet network tied to $18.43M in Robinhood chain rug pulls
Security & Exploits ·
An investigation has linked 53 token launches on Robinhood chain over a two-month period to a single extraction operation, with at least $18.43 million pulled out.
The figure, described as likely an undercount of what could be directly traced, comes from an analysis shared on X, which found that 45 of the 53 launches share a common financial fingerprint: proceeds from one launch are swept into a hub, passed through an intermediary wallet, and used to fund the next token's launch wallet, often within seconds of that wallet signing its funding batch. A separate 4 launches were tied together because the same private key signed funding transactions for two different tokens, and another 4 were linked through a shared wallet that collected proceeds from more than one launch.
Nearly every launch in the set was sniped for more than 70% of its supply and structured with bundles ranging from 70 to 200 wallets, with most deployed through Pons V2. The three largest individual cases identified were a token tied to the contract robinhood:0x80baa4b3bfac6f4978700df824b1b3d98e889136, which extracted $3.12 million across a 92-wallet bundle; $LEGS, at $2.9 million across 77 wallets; and $PINK, at $1.44 million across a 125-wallet bundle. The investigation also noted that some of these projects ran fake pre-launch versions to build hype before revealing the real contract address, a tactic used to maximize extracted funds; $PINK, the token behind contract 0x80baa4b3bfac6f4978700df824b1b3d98e889136, and $DEED each had 3 separate launches tied to the same operation.
The $DEED token, which reportedly first triggered the probe, does not rank among the top 10 by amount extracted, suggesting the scale of the operation extends well beyond its most visible case. One example traced 98 wallets sweeping 179.88 ETH into a hub, which funneled proceeds through a hop wallet before 20 ETH reached a funding key that signed DEED's batch just 16 seconds later — a pattern repeated in 45 of the 53 cases.
The report also flags at least 2 additional serial-deploying operations that could not be directly linked to this network but appear to have extracted millions across dozens of separate launches, indicating the practice is not isolated to one group. Most of the extracted funds remain held in ETH, which is not freezable, limiting recovery options. The episode is cited among other developments in the same cluster, including product updates from Kamino and Anoma, in a broader roundup published on GitHub.
What remains unconfirmed is the full scope of wallets and launches tied to the operation, the identity behind the alleged leadership of the group, and whether any funds can be recovered or frozen given their current denomination in ETH.