Smart money scammer
Another week, another scam report.
It is a bit old from a few months ago. This one is interesting because we came across this scam while testing our new smart money feature (which is coming out very soon).
We ran the algorithm and started to check which addresses were making the most money from trading on DEXes.
We set the algorithm to fetch us addresses that met these conditions:
at least a 70% win rate
at least 4x on investment in the last 180 days
and at least $ 15,000 in total profit.
The algorithm returned more than 20 addresses, some of which stood out.
This one specifically stood out: https://basescan.org/address/0x298928d4950607dd5691e5aeebafd8a13c9d9a8a
We will name him Mr. Smart Scammer.
The scams
Mr. Smart Scammer made:
40k USD in absolute profit
450% on his initial investment
Traded 33 tokens
He had a 100% win ratio, which means that he bought low and sold high on each of those 33 tokens.
The 100% win ratio on 33 tokens seemed very fishy.
Either he was the best trader with heavy inside information about the tokens he traded,
Or he was somehow associated with scams.
So we went and checked the tokens he traded:
All of them died a few minutes after the creation.
Price graph patterns were the same.
The timings on which he bought the tokens were the same.
Price pattern examples:
Here are the patterns we took from 3 of the 33 coins he traded. Note that this is a 1-minute scale. The green B circle shows when he bought, and the red S circle shows when he sold.
At first glance, they might look like they are all graphs for the same token. But no, they are three different tokens with the same pattern: three uptrends and three downtrends. Also, if you observe the B(buy) and S(sell) events from Mr. Smart Scammer, they are placed at the same spot for all these tokens. Something weird is happening.
So we investigated further. We checked who deployed these tokens. To our surprise, all the tokens Mr. Smart Scammer traded were deployed by the same address (0xc01a2a893c4b98c7f41903e376f5fa932e618814)
We will call this one Mrs. Deploy Scammer.
Mrs. Deploy Scammer deployed 52 tokens over the course of 5 days. All of the deployed tokens died within minutes, having the same price pattern as discussed before. The tokens were also a honeypot, as only a select few addresses could sell them (more on that later).
Money Flow
We investigated how are Mr. Smart Scammer and Mrs. Deploy Sammer connected:
From Binance, he first sent ETH to Address 1.
Address 1 sent ETH to Address 2.
Address 2 then deployed Smart Contract.
ETH Was then transferred from the Smart Contract to Mr. Smart Scammer, Mrs. Deploy Scammer, and other addresses that could later sell the token (whitelisted ones from the honeypot).
Mrs. Deploy Scammer used funds to pay fees for launching new tokens.
Mr. Smart Scammer used funds to trade on these tokens.
Then, all the “profits” Mr. Smart Scamemr made were transferred to Mrs. Deploy Scammer, who then transferred funds to Address 3. Address three then transferred tokens to Binance.
So, from the looks of it, Mr. Smart Scammer and Mrs. Deploy Scammer are collaborating. Most likely, this is the same person performing transactions from different wallets.
We described only the interaction between Mr. Smart Scammer and Mrs. Deploy Scammer. But other addresses were present with these transactions, also collaborating with Mrs. Deploy Scammer.
All the tokens were honeypots, and only the traders funded by Smart Contract could sell them; other external traders lost money on them.
We conclude that Mr. Smart Scammer creates trading volume with other traders, collaborating with them to lure in other normal traders searching for such price actions. Doing that, they trap other traders.
Last updated
