1/ Over the past few months I have been tracking a series of...
ZachXBT@zachxbt
4 views
Nov 26, 2024
~3 min read
1
1/ Over the past few months I have been tracking a series of related compromises for McDonald’s, Usher, Kabosu Owner, Andy Ayrey, Wiz Khalifa, SPX 6900, etc on X & IG which has resulted in an estimated $3.5M+ stolen via launching Pump Fun meme coins.
2
2/ On Aug 21, 2024 the McDonald’s IG became compromised and a post was made promoting the bundled meme coin GRIMACE and the hacker began trolling after.
$690K+ from the pump and dump was consolidated to two wallets.
4RiNhTwBxYWgb4MSCtt9vXgVk2yuPhoQR3DR9pMVPU1W
2vjnmxwTYNJvTmFhtqxZkPiuCHkaKZK5rcxTLuoC2dPB
$690K+ from the pump and dump was consolidated to two wallets.
4RiNhTwBxYWgb4MSCtt9vXgVk2yuPhoQR3DR9pMVPU1W
2vjnmxwTYNJvTmFhtqxZkPiuCHkaKZK5rcxTLuoC2dPB
3
3/ On Sep 3, 2024 the McDonalds attacker transferred 101.5 SOL to two addresses which deployed and sniped SCHRADER after the Actor Dean Norris had his X account hacked.
4s9Uz9pTBXcEaEtcjs8eg98r2TVte3rq3JUm3rVTFMudfewGbNKmqNyYs9bSAMDUaTbTcuA1v39sWr7GRqkDJ6EM
1gxo1pjTqjbee7rHW4cGvuNffX1qP4F8fP17g6SSC5EYbQrnktDrKSFB1uh4ju7PxQjprWFin37WUsAe225b9c6
4s9Uz9pTBXcEaEtcjs8eg98r2TVte3rq3JUm3rVTFMudfewGbNKmqNyYs9bSAMDUaTbTcuA1v39sWr7GRqkDJ6EM
1gxo1pjTqjbee7rHW4cGvuNffX1qP4F8fP17g6SSC5EYbQrnktDrKSFB1uh4ju7PxQjprWFin37WUsAe225b9c6
4
4/ On Sep 6, 2024 proceeds from the McDonalds ATO was transferred to a casino deposit address.
CuNzegC9DE4CxCMn31ZcYLvtDaYsLD9RX8eRvmtZQrnB
By performing a timing analysis you can find the subsequent withdrawals made shortly after the deposits.
B2fwZt5nTbdrnJ2CPsgrYMPuB4UnhN82EAM34dXDARLh
CuNzegC9DE4CxCMn31ZcYLvtDaYsLD9RX8eRvmtZQrnB
By performing a timing analysis you can find the subsequent withdrawals made shortly after the deposits.
B2fwZt5nTbdrnJ2CPsgrYMPuB4UnhN82EAM34dXDARLh
5
5/ On Sep 12, 2024 B2fw transferred 110 SOL to two addresses which sniped a meme coin promoted during the Usher compromise.
4FUrwoHz1fuUf4eR6YEAYSG9d9rN5fzbowMXtbjwJAhTDtHXjpnTb1sz6aeF6T79JaiMFyT2xX2EuTxqT5UhFfKD
427zpHF1WWgYgKxcSiUzwXLg2UqsF6xq7K13PU3mh6Wr99mipiVA6GcDTwi7EY93RJeRuEUDZAK9BnoMeki7sU6C
4FUrwoHz1fuUf4eR6YEAYSG9d9rN5fzbowMXtbjwJAhTDtHXjpnTb1sz6aeF6T79JaiMFyT2xX2EuTxqT5UhFfKD
427zpHF1WWgYgKxcSiUzwXLg2UqsF6xq7K13PU3mh6Wr99mipiVA6GcDTwi7EY93RJeRuEUDZAK9BnoMeki7sU6C
6
6/ B2fw then transferred 4868 SOL to casino deposit address ECb5v
Directly connected to Ecb5vs are additional ATOs including Andy Ayrey and Enoshima Aquarium.
Ecb5vsomUG3MEnLCgiFvkdnnqpggTEXtN17z62iDPuU3
Directly connected to Ecb5vs are additional ATOs including Andy Ayrey and Enoshima Aquarium.
Ecb5vsomUG3MEnLCgiFvkdnnqpggTEXtN17z62iDPuU3
7
7/ On Oct 15, 2024 the Enoshima Aquarium X account became compromised and a bundled meme coin was promoted.
84 SOL from the scam was transferred to ECb5v that same day
5PDjh74JTLMPW4dXr6fKm3Yue2j3vhbxLSK5dPbQ3oEGK4axE7fua1ngBMas4xpRY6dBr92Ccps7b1WwcLdnxXWL
84 SOL from the scam was transferred to ECb5v that same day
5PDjh74JTLMPW4dXr6fKm3Yue2j3vhbxLSK5dPbQ3oEGK4axE7fua1ngBMas4xpRY6dBr92Ccps7b1WwcLdnxXWL
8
8/ On Oct 29 Andy Ayrey (creator of Truth Terminal) had his X account compromised for multiple days and 6 meme coins scams were promoted.
3GVUs was one of the addresses involved in sniping tokens.
3GVUs2gNr161ohqnVXjUeoNQmf3cELxKSiPrxyQu6pjd
On Oct 30, 2024 3gVUs transferred to 169 SOL to Ecb5vs .
67nwsLLE3aGua4VeH8p6qHc3SL3rpxi9omMxRnfpeyZVsBpZawnUHo4Pt4tdT5Vxny2uRNRDH3vSZ1fzvKkNCML4
3GVUs was one of the addresses involved in sniping tokens.
3GVUs2gNr161ohqnVXjUeoNQmf3cELxKSiPrxyQu6pjd
On Oct 30, 2024 3gVUs transferred to 169 SOL to Ecb5vs .
67nwsLLE3aGua4VeH8p6qHc3SL3rpxi9omMxRnfpeyZVsBpZawnUHo4Pt4tdT5Vxny2uRNRDH3vSZ1fzvKkNCML4
9
9/ $750K of the $2.178M netted from the Andy Ayrey ATO was deposited to casino deposit address Apc3e
Apc3eA9ScQksuZvfURQswZwVkusEYRaqeKEv4eXXbRZm
0.1 SOL from Kabosu ATO funded one of the addresses involved in the Andy Ayrey ATO
Apc3eA9ScQksuZvfURQswZwVkusEYRaqeKEv4eXXbRZm
0.1 SOL from Kabosu ATO funded one of the addresses involved in the Andy Ayrey ATO
10
10/ On Oct 17, 2024 the Kasbosu owner had their IG account hacked and a meme coin scam was promoted.
191 SOL from the scam was transferred to casino deposit address
6kwZ7tz8Xs7jaVqVJXZSRrZ2FtS2PPChEVuLXKrmMgCm that same day.
191 SOL from the scam was transferred to casino deposit address
6kwZ7tz8Xs7jaVqVJXZSRrZ2FtS2PPChEVuLXKrmMgCm that same day.
11
11/ Both the Kabosu and Andy Ayrey ATOs are directly connected to the Wiz Khalifa ATO.
On Nov 3, 2023 attackers posted a wallet address from Wiz Khalifas account. 29 SOL was transferred to 6kwZ7 just like for the Kabosu ATO.
NFCs23ddXQc9Zff2VJotEn2zaSAh4tvw6U6kb7fdXovZ8YPQgJMGQkXmtWiTutqnoBf6wR2khaKvFpyEKNhHfjJ
On Nov 3, 2023 attackers posted a wallet address from Wiz Khalifas account. 29 SOL was transferred to 6kwZ7 just like for the Kabosu ATO.
NFCs23ddXQc9Zff2VJotEn2zaSAh4tvw6U6kb7fdXovZ8YPQgJMGQkXmtWiTutqnoBf6wR2khaKvFpyEKNhHfjJ
12
12/ The deployer for WIZ was funded by the Andy Ayrey ATO. Other addresses involved in sniping transferred all proceeds from an instant exchange to casino deposit address 0x83ee
0x83ee6b53a0ae76b71bed0c32721a451776dbdb3a
0x83ee6b53a0ae76b71bed0c32721a451776dbdb3a
13
13/ 0x83ee received 0.54 ETH on Oct 16, 2024 from the deployer of the scam promoted while SPX 6900 was compromised on Oct 11, 2024.
On Solana another scam promoted by the compromised SPX 6900 account was funded by the Ken Carson attacker.
On Solana another scam promoted by the compromised SPX 6900 account was funded by the Ken Carson attacker.
14
14/ To further strengthen showing how the Kabosu owner, SPX 6900, Ken Carson, & Enoshima ATOs are related the deployer for each meme coin funded the previous deployer address using instant exchanges in an attempt to obfuscate the funding source.
15
15/ Part 2 of my investigation will likely be released tomorrow and will expose multiple threat actors linked to the 9+ compromises whereas the focus in Part 1 was solely on-chain connections.
