Two suspected memecoin rug factories linked to Robinhood Chain

Two separate investigations found coordinated memecoin operations on Robinhood Chain that routed roughly $9.5 million and $18.4 million through networks of related wallets as the chain surpassed $1.5 billion in total value locked. The findings come from blockchain security firm GoPlus and an on-chain investigator known as Wazz.

GoPlus identified a high-risk operation that used batches of newly created wallets to accumulate and sell tokens, then swept Ether proceeds into a consolidation cluster. The firm’s analysis, dated Sept. 28, shows a main consolidation wallet with about 3,589 ETH in two-way flows across its latest 400 transactions, a flow the firm described as gross movement rather than net profit or investor losses. The activity included sales routed through contracts such as PonsV2Helper and UniversalRouter and the use of intermediate sweep wallets to move funds onward.

Wazz’s on-chain research pointed to a separate serial operation that allegedly extracted about $18.43 million from at least 53 memecoin launches over roughly two months. That pattern relied on larger clusters of 70 to 200 wallets that acquired large portions of token supply soon after launch, in some cases leaving the cluster holding more than 70% of a project’s tokens. Wazz found links between successive launches, with proceeds from one project moving into wallets used to seed later projects, indicating funds were recycled through multiple launches.

Both investigations describe a similar playbook: tokens tied to popular narratives, supply distributed among many low-history addresses, staged sell-offs that mimic independent market activity, and eventual consolidation of proceeds into common funds. GoPlus noted the setup can mask how much of a token a single operation controls because dozens of seemingly unrelated addresses sell in stages instead of one wallet dumping a concentrated position. The two clusters share technical traits such as heavy use of Pons V2 infrastructure and wallet batching, but GoPlus reported it found no direct evidence that the same individuals operated both networks. The newer cluster relied more on fresh wallets that consolidated later, while the other used larger pre-positioned clusters to control supply early.

Robinhood Chain launched on July 1 and reached more than $1.5 billion in total value locked in under 90 days, according to DeFiLlama data. Token Terminal estimates the chain generated roughly $50 million in revenue over about three months, with revenue rising to about $40 million in September. Robinhood’s broader business includes 28.6 million funded brokerage customers and about $384 billion in assets, figures that reflect the company’s existing retail user base.

Researchers noted the permissionless nature of the network allows external developers to deploy tokens without prior approval. They also pointed to tools that interfaces, launchpads and wallets can add, such as screening, wallet warnings and concentration-analysis, which may help flag suspicious launches. The investigators warned that normal contract code does not always reveal concentrated token control, making pattern and wallet-structure analysis important for identifying coordinated exits.