In depth: RFC
This is an on-chain in depth token analyis report.
Last updated
Was this helpful?
This is an on-chain in depth token analyis report.
Last updated
Was this helpful?
This report is based purely on on-chain data analysis and does not classify or label any token as a scam or legitimate project. We aim to present raw blockchain insights in a simplified and accessible format. Readers are encouraged to interpret the data critically and draw their conclusions. Nothing in this analysis should be considered financial or investment advice. Additionally, the information reflects the state of the blockchain as of the report's publication date. Given the rapidly evolving nature of the crypto space, we recommend always checking the date and verifying if conditions have changed since.
Many tokens can share the same or similar names — always verify the contract address referenced in this analysis to ensure you're reviewing the correct asset. This report focuses solely on the specific token contract(s) mentioned; do not assume other tokens with similar names are related.
Token under investigation: : C3DwDjT17gDvvCYC2nsdGHxDHVmQRdhKfpAdqQ29pump (Solana)
Token report date: main analysis on 19.4.2025, if not specified differently (took 1 week to write the full report)
The report is divided into multiple sections:
RFC is a meme token on Solana launched via pump.fun with a fair launch model and no taxes, but it lacks a clear long-term roadmap or structured development plans.
Key events in RFC's lifecycle include its surprise token launch in March 2025, followed by a tweet from Elon Musk that led to a 500% price surge. Despite building a large Twitter following, the community had no prior knowledge of the token, raising concerns about potential market manipulation.
RFC has solid liquidity of around $1.32 million and is available on both DEXs and CEXs. The token is deployed securely on Solana with no minting or transfer fees. The market cap is currently $24.25 million, and trading metrics show strong trading activity with over 56,000 unique buyers and sellers.
The RFC project operates two Twitter accounts: @RFindercoin (10,100 followers) created in March 2025, and @IfindRetards (724,600 followers) created in December 2024, which gained popularity through bold humor and memes. The token launch was announced on the larger @IfindRetards account, but it's unclear how many followers actually support the token.
The token creator wallet launched RFC on March 24, 2025, received 4% of the total supply, and made small transactions, with no major suspicious activity identified.
Our investigation reveals limited suspicious activity connected to the RFC token deployer, with most funds remaining untouched, but notable links to high-volume traders and potential involvement from Web3 Twitter accounts.
Early trading analysis reveals significant sniping activity, with many snipers using multiple wallets to disguise their profits, making it harder to identify aggressive hoarding by any single wallet.
Holder analysis reveals a high level of concentration among a small group of wallets, with the top 10 wallets controlling over 17% of the RFC supply, indicating significant potential for price manipulation and highlighting the influence of strategic players, including whales and algorithmic trading bots like Wintermute.
On-chain analysis reveals a highly coordinated operation, likely involving MEXC exchange, that sniped over 7% of RFC tokens pre-launch, generated $1.2 million in profits, and still controls over 3% of the supply.
Retard Finder Coin (RFC) is a meme token built on the Solana blockchain, launched directly on pump.fun, with a fixed supply of 1 billion.
Token Description from the token's whitepaper:
Retard Finder Coin (RFC) is a meme coin built on the Solana blockchain, launched directly on pump.fun, a fair-launch platform designed for transparency and community-driven tokens. Inspired by the “I Find Retards” community on X (Twitter), RFC celebrates free speech, humor, and the spirit of decentralized finance. Unlike many meme coins, RFC offers a fixed supply, zero taxes, and no airdrops, ensuring fairness and sustainability from the start.
Fair Launch Model: 96% of the supply is made publicly available through pump.fun, with 4% allocated to the developer wallet.
Mission & Values: RFC supports free speech, humor, and decentralization. It aims to be a trustworthy meme coin in a space often plagued by scams and rug pulls.
Roadmap: The current RFC roadmap is minimal and primarily focused on the initial launch phase, with most listed steps like launching on pump.fun and community promotion already completed. It lacks clear future-oriented goals, timelines, or measurable milestones, making it difficult to assess the project's long-term direction. Phrases like "partnerships" and "community-driven initiatives" are vague and not supported by specific plans or objectives. The roadmap would benefit from more detailed and forward-looking strategies to enhance transparency and community trust.
In the following sections, we will evaluate the claims made in the whitepaper. Since RFC is a meme token with no intrinsic value, its price action is primarily driven by community sentiment and early buyers. The roadmap outlines only the initial phases—such as the token launch and basic listings—but falls short in presenting a clear long-term vision, structured goals, or detailed plans.
Twitter:
We begin our token analysis with a chronological overview of key on-chain and off-chain events. This timeline highlights notable moments in the token’s lifecycle — from its initial creation and pool launch to early swaps, announcements, and unusual market activity. Understanding the sequence of events is crucial for identifying potential red flags, coordinated actions, or community momentum.
Main Events:
December 2024: The Retard Finder Twitter profile created, not mentioning any token to the date of the token launch.
10.3.2025: Webpage domain registration
24.3.2025 at 22:07:48 - Created token deployer wallet
24.3.2025 at 22:34:36 - Token launched on pump.fun
25.3.2025 at 01:07:20 - Token graduated and trading continued on PumpSwap.
25.3.2025: First post on the @RFindercoin Twitter account.
31.3.2025: Elon Musk tags the @IfindRetards Twitter account under a post, and the price surges by more than 500%
14.4.2025: Price trend change to downtrend.
Upon analyzing the announcement post, it became evident that the page had been building a community for four months without any indication of an upcoming token launch—it came as a complete surprise even to them. For a page with over 700,000 followers, such a move carries significant risk and raises serious concerns about potential market manipulation.
The top comments in the post reveal that the community's reaction to the token launch was largely negative.
An unexpected reply from @elonmusk on March 31, 2025, triggered a surge of over 500% in RFC’s price.
Data as of April 24, 2025
Liquidity & Token Pools The current liquidity for $RFC is around $1.32 million, split between 26.27 million RFC tokens and 4,353 SOL. That’s solid, especially in today’s market.
The token launched on pump.fun, and after it hit the “graduation” milestone, it was moved to PumpSwap. Since then, several RFC/SOL pools have popped up on both decentralized exchanges (DEXs) on Solana and centralized exchanges (CEXs) like Gate.io, KuCoin, and MEXC. So, if you buy RFC, there are plenty of places where you can also sell it. Conclusion: liquidity is not a problem.
Around 99% of the liquidity has been burned on the biggest pool, meaning those tokens were sent to an address no one can access. That makes it basically impossible for anyone to rug pull by removing liquidity. Still, it’s worth noting the price could drop sharply if big holders (or insiders) decide to sell.
The token is deployed on Solana using the standard token program, which means the core functionality follows a widely audited and commonly used framework.
Our analysis did not identify any honeypot behavior, and the transfer hook, minting, freezing, and account permissions are all non-upgradable, reducing the risk of malicious changes after deployment. Additionally, the token is not mintable or closable and has no transfer fees.
Market Cap
Current market cap: ~$24.25 million
All-time high: $135 million on April 14
New wallets (30 days): 95
New wallets (7 days): 8
New wallets (24 hours): 0
Trading Overview
Unique buyers: 56,740
Unique sellers: 56,071
Total buy volume: $161 million
Total sell volume: $160 million
Total holders: 14,924
Total wallets interacted: 66,826
Only 40 wallets linked to scam tokens have interacted with RFC, which is a very small number.
Overall, the token shows strong performance in terms of liquidity, security, and trading metrics, which appear solid and healthy at this stage.
Domain Registration: March 10th, 2025
The project operates two Twitter accounts; we will examine each one individually:
Followers: 10100
Posts: 404
Account Creation Date: March 2025
First Tweet Date: March 25, 2025
Followers: 724.600
Posts: 3044
Account Creation Date: December 2024
Profile review by Grok: @IfindRetards is a bold X voice who skyrocketed to 700k followers by calling out flat-earthers, vegans, and disloyal political flip-floppers as "retarded" with unapologetic humor.
The @IfindRetards X account first mentioned the "Retard Finder Coin" ($RFC) token on March 25, 2025, at 01:03 UTC, announcing its launch on Pump. A follow-up post at 17:43 CET the same day discussed a major holder exiting and promoted the token's potential.
The token has a big Twitter following with over 700,000 followers, mainly because the account was already popular for memes before the token launch. It’s hard to tell how many of those followers support the token. There are no other official communities, and a Telegram group that showed up briefly was made by a scammer not connected to the project.
Understanding the behavior and history of the token creator is critical to any on-chain investigation. This section analyzes the wallet that minted the token, including its funding source, activity patterns, and interactions with other addresses or contracts. By tracing wallet behavior before and after token creation, we aim to uncover potential signs of coordination, suspicious movement, or connections to other projects.
Everything started with funding a deployer wallet on 24.3.2025 at 22:07:48 (UTC) with 2.04 SOL from the address: 7kPq2w6tAREUbXi5ioGGxJ3desY6QWSMMvyeLYHGz4WT (We will call it Funder wallet 1)
Approximately 30 minutes later, the RFC token was officially created and launched through the Pump.fun platform, with a total supply of 1 billion tokens.
The token deployer contributed 1.16 SOL at launch and received 39,944,801 RFC tokens. This allocation represents roughly 4% of the total supply and aligns with the distribution plan detailed in the whitepaper.
Let’s take a look at some other notable actions carried out by the wallet:
On March 25, 2025, at 15:18:25, wallet Aw6UK43bwsDzVwumYSJ8GActJTnuqwL2ctcyVSGfgdfu (tag: Small funding wallet 1) transferred 0.55 SOL to the deployer’s wallet.
Very small inflows of SOL from deBridge Finance.
On 27.3.2025 134000 RFC and 0.2 SOL were transferred to the new wallet: 17XDeTonbQFNm8qEnq2qrckm25jtMwAuhBQxPHpDkaw (tag: Connected wallet 1)
The wallet engaged in several token swaps, including the sale of RFC tokens totaling approximately $4,266.00 (On March 28, 2025).
After selling the RFC token, 30.6 SOL was deposited on Binance.
On April 9, 2025, the remaining 38.43 million RFC tokens were transferred to a new wallet (E8BJzHRtV1pUgKizfMjkWeNZbSTNzYjmUtzgc1LpMsM4 - tag: RFC Holding wallet 1) along with 0.1 SOL.
We can present the described situation in the following flowplot:
To recap this section, there have been no drastic movements of RFC tokens. Only 4% of the total supply, designated for the developer, as outlined in the project’s whitepaper, has been transferred, with a small portion sold. We will continue our investigation by examining the connected wallets to identify any signs of suspicious activity.
We have now collected 4 wallets connected to the token deployer. The next step involves analyzing these wallets more thoroughly to see if any suspicious patterns are found.
On March 25, 2025, the wallet received a 2.23 SOL transfer from a Binance US hot wallet. This was followed by the previously mentioned 0.55 SOL transfer to the RFC token deployer. On the same day, the wallet also sent 1.68 SOL to another address: 5DDEFBfWAaUe6e8KtzdwzTcAgkPAN5XAokK1Pbj6yeM5 (tag: Connected wallet 2)
Connected Wallet 3 executed a few small OBC swaps, received incoming transfers from multiple addresses trading both OBC and RFC tokens, and ultimately consolidated all its proceeds by forwarding them to the final wallet: ERdt6cFAHxnVXXdjSCAPCcjm9fB9FMzktFABzfa4PAQB (tag: Very active wallet 1)
A group of smaller wallets followed a consistent pattern on March 25, 2025. Each was funded via deBridge Finance, engaged in small RFC trades (typically between $200–$500), and then proceeded to sell off their OBC token holdings. While the RFC trades mostly broke even—possibly intended to generate volume or simulate market activity—the primary profits came from selling the OBC tokens. After these sales, the proceeds were funneled into Connected Wallet 3.
At this point, the final wallet left to analyze is Very Active Wallet 1 (ERdt6cFAHxnVXXdjSCAPCcjm9fB9FMzktFABzfa4PAQB). This address shows an exceptionally high level of on-chain activity, with thousands of token trades and transfers. It has received substantial inflows from deBridge: Bridge Vault as well as numerous other wallets, indicating that it may belong to a high-volume trader or whale.
Although analyzing every transaction would be time-consuming, one notable detail stands out: this wallet is directly connected to the RFC deployer. It also actively traded RFC, buying approximately $84,584.00 worth and later selling for $52,155.00, resulting in a significant realized loss. Additionally, the wallet has engaged in trading a wide range of other tokens.
While we can't definitively determine the reason Small Funding Wallet 1 sent SOL to the RFC token deployer—thereby creating a link to the Kazee-associated wallet—this connection is certainly noteworthy.
Current full flow:
At this stage, the next step is to trace the origin of the deployer’s funds as they move through cross-chain bridges, to uncover any additional patterns or potentially significant connections.
There were two notable funding events for Funder Wallet 1:
Via the Mayan Finance bridge: A transfer of 0.093 ETH was bridged through Mayan Finance, converting into 1.39 SOL, which was deposited into Funder Wallet 1. We are continuing our investigation to trace how the originating Ethereum wallet was funded (0xBa1382978a81b2Cd4C31336F49BC25c9d6BEDFd2).
Multiple wallets send small amounts of ETH and memetokens to the ETH wallet. Let's check each wallet:
0x67BA357e090c537D1cc4108E75E598986C9FE536 sent a small amount of ETH to the wallet, routed through various proxy wallets. The origin of the funds appears to trace back to Coinbase.
0xd2fb509330a294B97EeF4437907b04663e8F70F5 sent two meme tokens to the Ethereum wallet, which were later swapped. The resulting ETH was then used to bridge funds over to the Solana wallet.
We uncovered some interesting connections, but there was no evidence of dramatic or highly suspicious behavior directly tied to the deployer. As of April 21, 2025, the majority of the 4% developer allocation remains untouched in the designated wallet.
Below is a summary of all identified wallets and their respective profits from trading the RFC token:
In this section, we’ll analyze the initial swaps that took place at the very beginning of RFC token trading. Our focus will be on the amount of tokens acquired during these early moments and identifying the wallets that secured the largest allocations immediately after launch.
We’ll start by examining the first 25 transactions on Pump.fun, the platform where the token was launched. The following table highlights these initial swaps and the corresponding wallet activity.
The first buyer, acquiring 4% of the total supply, was the token deployer, as already discussed in the previous section.
Another notable early participant was o7RY6P2vQMuGSu1TrLM81weuzgDjaCRTXYRaXJwWcvc, a well-known sniper wallet that executed its buy at the exact moment the liquidity pool went live. This address has a history of sniping thousands of token launches. In this case, it quickly sold its position just a few minutes later, making only minimal profits.
Most of the other early wallets followed a similar pattern—buying and then selling shortly after for modest gains. However, two addresses stood out due to their significant profits:
This wallet sold its entire RFC position about an hour after the token graduated to PumpSwap, realizing a profit of nearly $90,000 USD. It has remained active, performing additional trades in the days following. The official token page stated that the sniping activity was not conducted by them, distancing the project team from the early sniper transactions.
5aCWGiFMB51Ys5y42XqfqLQV9BvQoMV2vK8VQUVRkqnu (tag: Good early buyer 2)
Initially funded on March 14, 2025, this address was the 11th buyer, acquiring 3.1% of the total supply. Shortly afterward, the RFC tokens were transferred to a secondary address:
BDFvASnsiKbd6nPwisrtFtviEkjSv556wQxpGmchzpFG (Tag: Good Early Buyer 2 – Subwallet 1). This subwallet alone made over $250,000 USD in profits solely from trading RFC and currently holds 1,891 SOL, suggesting it belongs to a significant whale. This wallet warrants deeper investigation in a future analysis.
When analyzing the first 100 swaps sorted by timestamp, a clear pattern emerges: there were only a few initial trades, followed by a significant surge in activity just minutes after 01:00. This spike in volume aligns closely with the timing of a tweet promoting the token, which likely triggered the sudden wave of interest and buying.
We analyzed the sniping activity on PumpSwap right after the RFC token graduated. By reviewing the first 1000 transactions, we observed that approximately 14% of the total supply was accumulated during this short window. Several snipers acquired around 1% of the supply each, but no single wallet stood out with an oversized purchase beyond that.
The chart above visualizes these first 1000 swaps:
The left Y-axis shows the size of each trade as a percentage of the total supply.
The right Y-axis tracks the cumulative supply held by wallets over time.
Green dots indicate buy transactions.
Red dots indicate sells.
The blue line shows the cumulative token accumulation.
This activity illustrates a fairly distributed early trading phase without any extreme outlier buys, suggesting no immediate evidence of aggressive hoarding by a single wallet.
Our analysis did not reveal any wallets directly linked to the token deployer participating in early sniping activity. It's possible that different, unconnected wallets were used for this purpose.
To further investigate potential insider behavior or suspicious accumulation patterns, we'll now examine the holder distribution of the RFC token. This may help us identify any wallets that stand out due to unusually large holdings or transactional behavior suggestive of insider activity.
Let’s focus on the distribution of the RFC token and examine the total supply held by insider wallets and other major wallets. The holder's distribution chart (exchanges and DEXes excluded) shows that the top 1 wallet holds 5% of the total token supply. The concentration increases steadily, with the top 10 wallets holding 17%, and the top 100 wallets collectively holding 53%. By the time we reach the top 200 holders, they control 67% of the total supply, indicating a relatively high level of concentration among a small group of holders.
Let’s now manually review the top 10 wallets to see if any noteworthy patterns or suspicious activity can be identified. We excluded wallets belonging to exchanges, DEX pools, and addresses already being reviewed.
9ZPsRWGkukYeWg2Z7eZ8NaTBZ1DSuBUVzLcGQWZgE4Y4 As of April 24, 2025, this address held 4.9% of the RFC supply. Upon inspection, we found that it is an off-curve address, meaning it does not lie on the expected elliptic curve used by Solana to generate valid key pairs. As a result, no private key can exist for this address, making it impossible for anyone to control or sign transactions from it. Off-curve addresses are sometimes used for smart contracts or specific purposes such as token burns, where funds become permanently inaccessible. We could not determine the owner or purpose of this address, though it may be related to a decentralised exchange. Notably, most of the RFC inflow comes from wallets associated with Jupiter Aggregator Authority, suggesting this address could belong to the Jupiter DEX, possibly for limit orders. If anyone has more information, feel free to reach out.
HMoS3ManNuRbJXAo97tccxwJZj6xrZZvKFbWy1FsQMyX (0.65% of the supply)
AA2A3Y5xohjxQe2cUHEXpna1QCMRKMDrgn7nJhCu2mEL (0.1% of the supply)
cjDDvBNbmWXZjc9LEFKcjVxN2x2r8T6YBZS28AzSg9T (0.9% of the supply)
and many smaller wallets...
9LMvNkALecBLeKtCzez9Vr594qB98dQDZk2gHoWkRYLZ This appears to be a large buyer actively trading multiple tokens. The address currently holds 1% of the RFC supply, which was acquired and moved from the wallet 4g9PrnKAAvBfP5cAJysb3w1Bfgw1qqPbH556iFq3xHjd. Most of the RFC tokens were purchased within the first two days of trading, with additional buys made in the following days, totaling over $130,000 USD. The wallet has also realized $17,757 USD in RFC sales, and has transferred 3,100,000 RFC to the Gate.io exchange. Based on the volume and transaction patterns across associated wallets, this activity suggests involvement from a larger, more strategic player.
7TqPiVEhHxmzCy4FuwRQ8SVUcCHDYHWi8HxMmeMoJpwZ This appears to be another whale wallet. As of April 23, 2025, it holds 0.93% of the RFC supply and over 100,000 SOL and additional meme coin holdings. Most SOL is regularly deposited into and withdrawn from Binance, indicating active trading behavior. The wallet purchased over $200,000 worth of RFC, with the first buying phase starting on March 25. It sold approximately $57,000 worth of RFC on March 31, before resuming another buying round on April 18.
C4GbdngLh7tdHLgC3jqWaEqHCf6kPdDb9weMPTaGMFfB make over 250,000$ of profits selling RFC transferred from the pvXy2FCSeHCXGSbXK4vqSxobwTqyYrQDnqW1XMqW9ar wallet.
Here is a fast example of flows going on with the connected wallets:
We found that these wallets account for roughly 10% of the total trading volume of the RFC token and have generated hundreds of thousands of dollars in profits over time. Analyzing their trading activity shows that most of their volume occurred in the last two weeks, coinciding with the token price decline.
Analyzing the top 10 holders reveals that a few entities hold significant control over the RFC token, suggesting a high level of manipulation. These wallets have enough RFC to either dump the price or push it up, meaning the token’s future largely depends on their actions.
To make the entire operation easier to understand, let's break it down step by step.
The Top 6 Holder wallet appears to be primarily a deposit address, so we began our analysis with the wallet that initially transferred the RFC tokens. The source was FEuhRFJNWZtppyxco4pLxnoJ7KwiSTSGuTmRwT7rMoLT (tagged as Top 6 Holder RFC Funder), which sent 20 million RFC tokens—of which 5 million were later forwarded to another wallet. The flow of tokens looks as follows:
We’ll now focus on the Top 6 Holder RFC Funder wallet, as it appears to be the central hub of the entire operation.
Top 6 Holder RFC Funder wallet was initially funded via Mayan Finance on March 21, 2025, just a few days before the RFC token launch. The capital originated from Binance, was moved to the Ethereum network, then routed through two intermediary wallets before being bridged to Solana using Mayan Finance.
The wallet remained inactive until the RFC token launch, and on March 25, 2025, at 01:04:51, it initiated three rapid buys on Pump.fun—just one minute after the official announcement on Twitter. In total, the wallet acquired over 5.5% of the total RFC supply for just over $1,000 USD. Given how the wallet was pre-funded, prepared days in advance, and executed purchases with such precise timing, it strongly suggests insider knowledge or access to non-public information, as the token launch was not publicly disclosed prior to the March 25 announcement on Twitter.
In the days that followed, the wallet engaged in several key actions:
A big portion of the RFC tokens was distributed across three different wallets
Over $300,000 worth of RFC was sold
The resulting profits were transferred to new wallets
The flow of these transactions is outlined below:
It appears that MEXC exchange may have orchestrated the entire operation—sniping the tokens early to secure a large position, profiting from the price movement, and also ensuring they had the required tokens for the eventual listing.
We analyzed wallets within a tightly connected cluster and uncovered more suspicious behavior. Two of these wallets received RFC tokens directly from MEXC’s hot wallet before the token was listed on the exchange, and then multiple sales were executed, generating profits.
One of them, Top 6 Holder Subwallet 3 (GeStwmQCzt2tZJvL9dsrX9GKS4b9oGc2vWNEhvGGhvUP), received around 4 million RFC from MEXC and sold them for a profit of $318,393. A portion of that profit was later transferred to the same final deposit wallet mentioned earlier (Top 6 Holder Final Deposit), linking it to the initial sniping operation.
To summarize, the wallets tightly connected within this cluster acquired RFC for just a few thousand USD and ultimately generated over $1.2 million in net profits from selling the token. These wallets were prepared and positioned days before the launch, enabling them to snipe early. Most of the profits were later moved across various Solana wallets and bridged out via Mayan Finance. Below is the full list of wallets, including their holdings, buy/sell activity, and total RFC profits.
In the chart below, we can see the amount of supply bought by these wallets over time. They sniped over 7% of the total supply right at the start of trading, with no significant purchases made afterward.
Looking at the sell volume over time, we can see that these wallets have been consistently selling, yet they still hold a significant portion of the supply—over 3%—indicating there may be more selling ahead.
The final step in our investigation was analyzing the deposits made to the Mayan Finance Bridge. We traced the outflows and found that the funds were bridged to the Ethereum network, ultimately distributed across several addresses, including:
0x9749c7d240be7ec17aed8470b9d5f303465ecb3a
0xf2d58f1310c59d3835920b2517d6834a73a47b29
0xbf26e75891Ae3E48b69643aD4B90D06C2F9DF8AC
All of these addresses appear to be interconnected and likely controlled by a single entity. On April 24, 2025, the majority of profits were consolidated and sent to three main destinations:
0xbf26e75891Ae3E48b69643aD4B90D06C2F9DF8AC: Holding 36.8 ETH and $192,530 USDC (tagged as ETH Deposit 1)
$110,000 was deposited into a Coinbase wallet
97 ETH was transferred to the PulseChain Omnibridge
At this point, our tracking ends, as we are currently unable to follow funds beyond PulseChain. If anyone has expertise in tracing transactions on PulseChain, we welcome your input.
The following diagram summarizes the Ethereum-side flows.
To conclude, this operation appears to be highly coordinated, well-funded, and strategically executed, pointing to the involvement of an experienced and organized actor—potentially the MEXC exchange. On-chain data strongly suggests that MEXC had prior knowledge of the RFC token launch, despite the official Twitter account claiming there were no insiders—a claim that’s hard to believe given the blockchain evidence. As of April 23, the wallets tied to this operation had already generated over $1.2 million in profits and still hold more than 3% of the total RFC supply.
From a broader perspective, RFC follows the typical pattern of many Solana-based tokens — initial hype followed by a sharp decline just weeks after launch. While the associated Twitter page has a large following, it doesn't reflect actual community support for the token, as the page wasn’t originally created for a token project. Our in-depth on-chain analysis reveals that whales dominate most of the activity, with two highly suspicious clusters profiting heavily: one linked to Wintermute trading bots and another showing behavior that points toward possible involvement by the MEXC exchange. In conclusion, this case highlights how many tokens today are heavily manipulated by a small number of entities who extract significant profits at the expense of retail participants.
The main recap from the token :
Webapge:
25.3.2025 at 01:03 - First on @IfindRetards Twitter account.
you can find a comment providing additional details. There's also a disclaimer regarding possible insider information, which we will verify and address as part of our ongoing investigation (we will see later in the report that there is a great probability of insider activity and knowledge of the token launch).
Website URL:
: F7xWmZeYiNF8hi22RDYbBCM7McsaiMnMSNB8qzekE5Rv (It will be called deployer wallet from now on)
According to the :
received funds solely from Mayan Finance and Bridger: Bridge, with no other significant on‑chain activity.
: An analysis shows no on‑chain activity—its developers ' RFC tokens remain untouched, and no larger sales are detected.
sold its RFC tokens for approximately $309.00. Out of that amount, $295 USDC was used to pay for the Dextools social verification process.
: Aw6UK43bwsDzVwumYSJ8GActJTnuqwL2ctcyVSGfgdfu
Connected Wallet 2: On March 25, 2025, this address deployed the , carried out two small OBC swaps, and then forwarded its entire SOL balance to uZ5Bn8YqLJRP6szu9PHSjLNSnYkxmTqsR36QFRqeoEs (tag: Connected wallet 3)
The wallet is associated with the kazee.sol domain, which led us to identify a connection with the . Several tweets from the account further confirm the link:
Via Bridgers Bridge: A transaction originated from Coinbase, where Bitcoin was sent to a BTC wallet. From there, the funds were bridged to the Solana network , resulting in a deposit of 0.513018 SOL into Funder Wallet 1.
On March 5, 2025, at 19:22:23, the Ethereum wallet received its first transaction—0.003 ETH—from 0x6f46d90553141D464C000D76e41d0d5380Fc0B23, which is associated with the ENS name gmgmi.eth. Upon , this ENS is linked to the , which appears to belong to a Web3 developer. This connection raises the possibility that this individual may be involved in the development of the RFC token.
On March 6, 2025, at 13:19:11, the next transaction to the Ethereum wallet came from 0x93D8f129Dca48771733abf0e286b13E8BD6d9bb6, associated with the ENS name bobbyg603.eth. The wallet sent 0.00880225 ETH. to be linked to the , suggesting another possible connection to someone active in the Web3 space.
While researching the deployer wallets on Twitter, we found this :
We quickly checked to see if the mentioned wallet was connected to the token deployer. As of April 24, the D2avcJceCYE1mh5spUjoEt6vhsy1n3YtKgxC6UFrXGPq holds no RFC tokens and about 0.2 SOL. Its trading history shows $195,041 in buys and $157,299 in sells, meaning the wallet appears to be at a loss. We also checked for any major RFC transfers out of the wallet but found no significant outflows. Since the wallet was funded with SOL through Binance, we can’t confirm any direct link to the deployer.
2vbYQRSdBKkv3oNB8JJaqi7KLXvBVo5R7kaapFN8ddfy (tag: )
6cp3GGREqXJbeNTHxXDy1k9ShZqEW9fNj6CQ12gA8c34 We’ll refer to this wallet as the Top 6 Holder (holds 1.5% of the supply). Upon analysing the address, we noticed that RFC tokens were transferred from another wallet to it. As we investigated the connected wallet, we uncovered a series of intriguing activities that prompted us to dig deeper. After hours of research, we uncovered what appears to be a large-scale, coordinated operation behind this address—over $1.2 million in profits from selling RFC, an initial snipe for just a few hundred dollars, wallets prepared days before the launch, and other suspicious behaviours. Due to the complexity and scale of this activity, we’ve dedicated an to break down this operation fully. For now, here are the addresses connected to this holder that hold big amounts of RFC:
The last thing we looked into was a suspicious cluster of wallets initially thought to hold around 0.5% of the RFC supply. After digging deeper, we discovered that this group controls about 6.5% of the total supply. The wallets were linked with Wintermute Bots. is a known algorithmic trading firm and , often criticized for market manipulation. Some Twitter users even call these wallets “Death Bot” addresses.
As previously mentioned, this section is dedicated to uncovering the operation behind the Top 6 Holder (6cp3GGREqXJbeNTHxXDy1k9ShZqEW9fNj6CQ12gA8c34) . The following graphic illustrates the full scope of the activity and the network of connected wallets.
The profits were sent to two different wallets—$260,000 USDC to one, and 271 SOL to another. The USDC was later transferred to a (7z2CX7EVVvyTzMnFUBUmHUWoyymFpspgHB5gdhXaHsLB), which holds over $20 million in assets. This USDC was then moved to Binance. Based on the wallet’s behavior and transaction history, it doesn’t appear to be a classic exchange wallet, but rather one belonging to a very large whale. If anyone has more information about this address, let us know—it could be worth doing a full analysis of this wallet in the future.
Another interesting finding came when the Top 6 Holder RFC Funder moved 24 million RFC and an additional 5 million RFC from the Top 6 Holder wallet—a total of 29 million RFC—to the MEXC exchange. What stood out was the 0.6 SOL sent to the Top 6 Holder SOL Deposit 2 wallet to cover transfer fees. On Solana, having a small amount of SOL is necessary to execute any transactions. This 0.6 SOL came from a (GkfKT1cgSyaKP7zT19gzTdVaEJrcPcurABe43m52xVwK) that constantly sends exactly 0.6 SOL to multiple addresses several times per hour. The consistent timing and fixed amount make it look suspicious. It appears connected to MEXC, as most of its SOL funding also originates from there. While we can’t confirm the exact purpose, it might be part of an organized operation by the MEXC exchange. If the amounts varied, it would seem like a standard withdrawal wallet, but the identical 0.6 SOL pattern raises questions.
The RFC token was officially listed on MEXC on April 9, 2025, at 13:28, . However, the tokens were , on March 28, which strongly suggests this was the initial inflow required for the exchange to prepare the trading pair. Exchanges typically need a supply of tokens in advance before activating a new listing, and this transfer appears to have served that purpose. We currently have one theory:
The (Top 6 Holder Subwallet 13) received 20 million RFC from MEXC several days before the listing (29.3.2025). Then it distributed the tokens across multiple wallets, which later sold them alongside the tokens from the Top 6 Holder RFC Funder, suggesting coordinated activity.
