Stalking a Scammer: 21 Rugpulls in 5 Days and Counting.
5 min read
Follow up to my first post on this subject: https://www.reddit.com/r/CryptoCurrency/comments/13kiyqv/im_stalking_a_scammer_and_have_watched_them/?utm_source=share&utm_medium=web2x&context=3
First I would like to give a huge thank you to u/TerraceTower for answering my primary question from the previous post: the second “approve coin” I was asked to sign but wasn’t charged gas for was in reality a way for the scammer to blacklist any address that swapped for the scam coin – making it impossible to swap back.
Brief rundown: I use dextools to find new trading pair contracts. When I’m frisky I make a gamble on a random, new shitcoin. Extremely high scam rate. 5 days ago I bought a coin that rugged minutes later. I angrily and stupidly followed the scammers address and bought the very next coin they bought. This also rugged, turned out by the exact same person. I got genuinely curious at this point and followed them back to their origin wallet. I discovered that they had created and rugged 5 shitcoins within 24 hours. They are continuing to create and rug at this very moment.
Where things sit now: after a few days break of no new shitcoins, the scammer has gotten back to work with fresh new piles of shitcoins! Here’s the list (in order of creation)
Rihanna – 0xb49b704659b90aa793a9823a18eadb12490eae0c – created 5/16/2023 Peppa – 0x8b29aaed5dbbe0b8d211e6ea6a04255f7cf53739 Cap – 0xCe0c34e864aC22d0a1E983bFFFf37C1aeB2a8Ca1 Lime – 0xaA00308732C717728b1A9F8A44859Be4a9b7A38D Nut – 0xb14c6f1d7e46c9a36e9e0bcbb1593646594f9e2c Ley – 0xeF92565Cf4AaeecF13173979bcb5aA9bB0083Cf9 Pikachu – 0xc0FEf688bEe3d1329Ea26414DE5bC11CE84e1903 Qwerty – 0x59CfC2fEC27a378cB41E84dfff1c5262840779F6 Shrek – 0x4725184D39d10E72e461C6d64dB53bbc7012Dd4e Prince – 0x692ea4415be092fbec687ca533452fd6db02efc5 Alex – 0x3ddCc5AB7C5325729a518326760be061D3ad6Eba Julian – 0x26d22b46c2C54f84978C5cc79a0c15fdA6b68A43 Bender – 0xeb79c31e260a435483e944205f7872840dada7ac Mars – 0x343e5538e5DA0870f396502C8F5D5De91995c6f4 Pluto – 0x07a807773c5dF07B25A14392B8a8a444198d7234 Moana – 0x4e6af20c6054a42e558628e95e4d0a17375eab4d Leaf – 0x4e6af20c6054a42e558628e95e4d0a17375eab4d Riven – 0x84826a07b913b8be8570025a463697f2a8429851 Tom – 0xdeCF79793D83091fFCe6d4403615708B8ae23F0A Pepsi – 0x51e083B05617a680d57965184B19a1AA911fA7A9 SevenUp – 0xfF29087d37e689B41D3b8fD820741125dD383036 Mcqueen – 0x789b6033a3402c2b4477a6e96d03c6361f70e196 Nikita – 0x789b6033a3402c2b4477a6e96d03c6361f70e196
21 shitrugs, and it’s still happening. Mcqueen is the current shitcoin. If anyone sees any relation amongst these names, shout out your theory. I’ve noticed themes come in pairs (Pepsi/SevenUp, Mars/Pluto).
How Shitrugger operates: so far the chink in the armor is the initial withdrawal from Bybit – an exchange not allowed for USA customers. What Shitrugger did is take that initial deposit from Bybit, split off around 4 ETH to a separate address, then create and fund a shitcoin/ETH trading pair. The 4 ETH in the separate address was then split into approximately 50 -100 new addresses that were used to make fake trades. I tracked about 15 of these trading addresses, so far I haven’t found any extra suspicious activity on them. For any traders that make a trade (like me), after swapping for the shitcoin, if you attempt to swap back for ETH, you will be prompted to “approve” the shitcoin. Several moments later, you will be asked to “approve” it again – but at no gas cost. As said in the intro, that second “approval” is what locks your address from swapping. I was never able to actually click the “swap” button. I was either rugged too fast, or I got a “Your transaction is expected to fail”, so I never swapped. Each of the above coins were rugged approximately 2 hours after creation. The average is 5 scam coins per day. Shitrugger is a busy person.
At one point Shitrugger pulled about 14 ETH and sent it to Stargate Finance. I have not researched this much, yet, but it appears to be some kind of bridge. If any kind souls can enlighten me, I’d be very grateful.
I sent an initial email to Bybit, mainly to see if I even could contact someone. I stated I had a suspected scammer that had started out from their exchange. I got a response back asking for more information on that initial transaction, so I filled them in on everything earlier today. I will update once I hear more.
Included at the bottom of this post is an excel sheet of how I tried to make sense of all the transactions. I need a new method of organization. The numerous trading wallets clogged up my sheet immediately. I gave up tracking each and every trading wallet – there were too many instances of transferring money between wallets.
Thanks to all who helped out a few days ago. I intend to follow Shitrugger until the end.
EDIT: Mcqueen has rugged. I also see I missed a shitcoin in my list. LEAF was created shortly after MOANA, with the same wallet. Edited the list to include LEAF. That makes 22 Shitcoins.
EDIT: I see I missed ANOTHER shitcoin. Nikita was created shortly after Mcqueen, using the same wallet. I thought Mcqueen had just rugged, but it was actually Nikita. One transaction was a rug, the very next one was creating a shitcoin. Shitrugger has some balls. Saves on gas, I suppose.
EDIT: The Stargate Finance transfer I saw appears to indeed be a bridge to Arbitrum. I am seriously struggling finding Shitruggers’ address on Arb. Arbscanner brings up nothing. Using Stargate’s Omnichain has led me to what I believe is the transaction (amount of eth bridged and the date matches, but that site sucks holy balls and is impossible to navigate). It’s late so I will work more on this tomorrow.
submitted by /u/KBtrae
[link] [comments]
