GoPlus: Robinhood Chain exposes the Meme coin RUG factory again, with a flow exceeding 9 million USD

The GoPlus security team disclosed that a high-risk fraudulent Meme factory was recently discovered on the Robinhood Chain, with a transaction volume exceeding 9 million dollars in the past 30 days, involving hundreds of fraudulent Memes. The asset aggregation address is 0x8c3Bad30cc7563A2D0357F49509FFd063666bb00. As of September 28, 2026, the address balance is approximately 56.0635 ETH, equivalent to about 148,000 dollars; the address has a total of about 1,385 transactions, with the latest 400 transactions generating approximately 1,728.02 ETH in income and transferring out approximately 1,861.12 ETH; the two-way transaction volume is about 3,589.14 ETH, equivalent to about 9.49 million dollars.

Direct evidence of "authorizing or selling tokens ---> liquidating ETH ---> transferring to the same aggregation address" was found in the high-risk associated Memes. The amount is the gross amount transferred into the aggregation system from the same project batch and does not represent net profit. The fraudulent Meme factory model mainly includes "new accounts shipping out ---> layered aggregation ---> fund recycling: 1. Creating Tokens based on industry hotspots; 2. Allocating Tokens to a large number of new EOAs with only 4 to 11 transactions; 3. Selling in segments through PonsV2Helper / UniversalRouter; 4. Emptying ETH to local aggregators or the main aggregation address (0x8c3bad); 5. Providing funds for the next round of projects, new wallets, and trading operations. The key to this fraud model is: 1. Using a large number of new wallets to hide the actual concentration of chips; 2. Segmentally selling by these wallets to create the illusion of multiple independent traders; 3. After the shipment is completed, funds flow into the same aggregation system; 4. Reinvesting the profits from old projects into the next round.

On-chain researcher Wazz recently disclosed that a suspected continuous Rug gang initiated at least 53 Robinhood Chain Memes within about two months and extracted approximately 18.43 million dollars from them. Their main tactic is to control most of the token supply using 70 to 200 wallets, then reinvest the profits from the previous round into the next round. This case is similar to the fraudulent model in this case, but there is currently no evidence to indicate that it is the same gang.