On-Chain Tracking of a Meme 'Token Factory': Dumping in 3 Seconds, Million-Dollar Inflows Only

2026-10-27 21:11

Written by: the_smart_ape

Translated by: AididiaoJP, Foresight News

A wallet holds 1.0268 million USDC and has not sent a single transaction to date. Its funds come from two consolidation wallets, which are fed by 32 token-launch wallets. Following the fund flow upstream, I uncovered a meme-token conspiracy ring made up of 43 wallets: batch token launches, same-block bundled buys, dumps within seconds, and layered profit consolidation.

Since January 2026, this conspiracy ring has launched more than 6855 meme tokens on Pump.fun, and it is still ongoing.

Starting with the meme token fun

The trail begins with fun, contract address: 7nRtEVneLhdc4L4dHyiExoSZoSMJx9VEBTr7wbmDpump.

On October 22, fun launched. The token was deployed 8 seconds after a tweet was posted. The deployer bought, and 3 other wallets bought in the same block immediately after. Four seconds later, the deployer dumped.

Unusually, the token did not immediately go to zero. Ten minutes later, its market cap was about 150,000 USD.

The deployer and his bundled wallets earned 13.6 SOL on this token. They exited before the token pumped.

So I investigated who this deployer was and followed the money downstream. Funds first entered consolidation wallets, were converted into USDC, and were sent to a wallet holding a million dollars. Behind that wallet, another 31 token-launch wallets kept sending funds.

43 wallets, clear division of labor

The structure of this network is:

43 wallets: 32 token-launch wallets, 8 relay wallets, and 3 bundled wallets;
More than 6855 meme tokens launched since January 2026;
2 consolidation wallets;
1 sink wallet: holding 1.0268 million USDC and untouched to date.

The launch cadence has also changed. Before June, about 30 wallets launched tokens simultaneously; after July, only one deployer is used at a time. The current deployer is named DRXPafDu, and from September 9 to now, it has launched 1118 tokens.

One token launch, completed in five steps

The process for each launch is almost identical:

The deployer creates the token and buys 10% to 15% of the supply in the same transaction.
In the same block, 3 other wallets in the network buy immediately after.
External buyers enter: sniper bots, copy-trading bots, and people who think they bought early.
The deployer dumps. Median time: 3 seconds.
Profits first go to consolidation wallets, then to the sink wallet.

The bundling is not random. I checked 160 launches, and all 461 bundled buys were concentrated in the launch block. Of these, 90% followed immediately after the creation transaction, ranking in positions 1, 2, and 3; none appeared in later blocks.

This indicates that the launch and the 3 follow-up buys were packaged and submitted together, leaving external buyers no chance to get in.

The deployer also does not wait. The current deployer has launched 693 tokens in total, and 88% were fully sold within 5 seconds.

Follow-up buy wallets, bundled with each other

What surprised me most was that the 3 wallets buying after the deployer were not newly created on the spot. They were other token-launch wallets in the same network.

For example, wallet A launches a token, and wallets B, C, and D buy; when wallet B launches a token, wallets A, C, and E buy again. One wallet, 3cCqweS8…, participated in launches by 8 different deployers.

This is not a group of retail investors accidentally copy-trading; it is the same set of wallets pumping each other like an assembly line.

Smoking gun for a single operator: 36 wallets transferring in the same block

Wallets sending funds to the same destination is not enough to prove they are controlled by one person. What truly proves the point is the following.

At 15:39:14 on October 14, 36 wallets emptied their SOL into consolidation wallets in the same block. Two minutes later, another wallet followed suit. Three minutes after the batch transfer, the consolidation wallets sent 71,874 USDC to the sink wallet.

It is difficult to get 36 people to transfer in the same block; this can only be a script.

And it did not happen just once. The consolidation wallets receive funds in batches, with the same batch of wallets recurring on the same day.

At 1:07 a.m. on September 9, former deployer XXXX5JNG completed its 938th token launch, making its final deployment. At 4:05 a.m., a new aggregation wallet was funded. Six minutes later, new deployer DRXPafDu completed its first launch with three brand-new bundled wallets.

Five days earlier, XXXX5JNG had just transferred 247 SOL to this new deployer.

There is even more direct evidence: the deployer's first buys across hundreds of launches are identical down to the exact token amount. 110.9m tokens for 3.55 SOL occurred 966 times; 112.1m tokens for 3.56 SOL occurred 797 times. Same tool, same configuration.

Sink wallet: only inflows, no outflows

The sink wallet address is:

8wZf1QPda7HeQQYPXebVu8HGEKcCoiSoT7KsuwYLWtFX

It is a regular wallet controlled by a single private key. Since May 9, it has had 188 transactions, all inflows, with 0 outgoing transactions signed by it. Only two true senders: aggregation wallet #1 transferred $742,271 in USDC, and aggregation wallet #2 transferred $284,539 in USDC.

The first SOL received by this sink wallet came from a deployer wallet in the network.

Who is behind it? Only exchanges know.

I don't know.

This address has no KOLScan profile, no .sol domain, and no mentions on X. The wallets I traced were funded by KuCoin, Bybit, and Binance. Only these exchanges can match addresses to real identities.

I also compared this deployment network with nearly 1,000 known KOL wallets: no overlap and no transfers.

Who is paying?

Every SOL extracted by the deployer comes from people who bought after it.

Most of these tokens go to zero within seconds. Among the tokens launched by the current deployer, about 3% will take off like fun. But even if they do, the operators have already exited.

How to avoid becoming their exit liquidity

Open the deployment block. If three wallets buy immediately after the deployer, that is a bundled buy.
Check the deployer's history. Launching 50 tokens in one day indicates a cabal, not a project team.
Check whether the deployer has already sold. In this network, selling takes only 3 seconds.
Do not buy a token seconds before listing if it was launched by a serial deployer.

Address list

Sink wallet: 8wZf1QPda7HeQQYPXebVu8HGEKcCoiSoT7KsuwYLWtFX
Aggregation wallet #1: DNmciAfumzbkNRxpPym5kiEsquD69JY3Nvj1T8nWGBqD
Aggregation wallet #2: Hu92NuUGb9XMKaaqQnBaDfUGph7PnVRmoAtiKpPDrKUu
Current deployer: DRXPafDunsHAMoo6hqyak9J5LfqT1MKBQEp5iUJMFvb7
Former deployer: XXXX5JNGhjPpQEsqcFChLtzv4V1HWyqUaW8tEwyjBfW

The current deployer is still launching tokens.

Source: 深潮 TechFlow