Stalking a Scammer: 21 Rugpulls in 5 Days and Counting.

Follow up to my first post on this subject: https://www.reddit.com/r/CryptoCurrency/comments/13kiyqv/im_stalking_a_scammer_and_have_watched_them/?utm_source=share&utm_medium=web2x&context=3

First I would like to give a huge thank you to u/TerraceTower for answering my primary question from the previous post: the second “approve coin” I was asked to sign but wasn't charged gas for was in reality a way for the scammer to blacklist any address that swapped for the scam coin – making it impossible to swap back.

Brief rundown: I use dextools to find new trading pair contracts. When I'm frisky I make a gamble on a random, new shitcoin. Extremely high scam rate. 5 days ago I bought a coin that rugged minutes later. I angrily and stupidly followed the scammers address and bought the very next coin they bought. This also rugged, turned out by the exact same person. I got genuinely curious at this point and followed them back to their origin wallet. I discovered that they had created and rugged 5 shitcoins within 24 hours. They are continuing to create and rug at this very moment.

Where things sit now: after a few days break of no new shitcoins, the scammer has gotten back to work with fresh new piles of shitcoins! Here's the list (in order of creation)

  • Rihanna – 0xb49b704659b90aa793a9823a18eadb12490eae0c – created 5/16/2023
  • Peppa – 0x8b29aaed5dbbe0b8d211e6ea6a04255f7cf53739
  • Cap – 0xCe0c34e864aC22d0a1E983bFFFf37C1aeB2a8Ca1
  • Lime – 0xaA00308732C717728b1A9F8A44859Be4a9b7A38D
  • Nut – 0xb14c6f1d7e46c9a36e9e0bcbb1593646594f9e2c
  • Ley – 0xeF92565Cf4AaeecF13173979bcb5aA9bB0083Cf9
  • Pikachu – 0xc0FEf688bEe3d1329Ea26414DE5bC11CE84e1903
  • Qwerty – 0x59CfC2fEC27a378cB41E84dfff1c5262840779F6
  • Shrek – 0x4725184D39d10E72e461C6d64dB53bbc7012Dd4e
  • Prince – 0x692ea4415be092fbec687ca533452fd6db02efc5
  • Alex – 0x3ddCc5AB7C5325729a518326760be061D3ad6Eba
  • Julian – 0x26d22b46c2C54f84978C5cc79a0c15fdA6b68A43
  • Bender – 0xeb79c31e260a435483e944205f7872840dada7ac
  • Mars – 0x343e5538e5DA0870f396502C8F5D5De91995c6f4
  • Pluto – 0x07a807773c5dF07B25A14392B8a8a444198d7234
  • Moana – 0x4e6af20c6054a42e558628e95e4d0a17375eab4d
  • Leaf – 0x4e6af20c6054a42e558628e95e4d0a17375eab4d
  • Riven – 0x84826a07b913b8be8570025a463697f2a8429851
  • Tom – 0xdeCF79793D83091fFCe6d4403615708B8ae23F0A
  • Pepsi – 0x51e083B05617a680d57965184B19a1AA911fA7A9
  • SevenUp – 0xfF29087d37e689B41D3b8fD820741125dD383036
  • Mcqueen – 0x789b6033a3402c2b4477a6e96d03c6361f70e196
  • Nikita – 0x789b6033a3402c2b4477a6e96d03c6361f70e196

21 shitrugs, and it's still happening. Mcqueen is the current shitcoin. If anyone sees any relation amongst these names, shout out your theory. I've noticed themes come in pairs (Pepsi/SevenUp, Mars/Pluto).

How Shitrugger operates: so far the chink in the armor is the initial withdrawal from Bybit – an exchange not allowed for USA customers. What Shitrugger did is take that initial deposit from Bybit, split off around 4 ETH to a separate address, then create and fund a shitcoin/ETH trading pair. The 4 ETH in the separate address was then split into approximately 50 -100 new addresses that were used to make fake trades. I tracked about 15 of these trading addresses, so far I haven't found any extra suspicious activity on them. For any traders that make a trade (like me), after swapping for the shitcoin, if you attempt to swap back for ETH, you will be prompted to “approve” the shitcoin. Several moments later, you will be asked to “approve” it again – but at no gas cost. As said in the intro, that second “approval” is what locks your address from swapping. I was never able to actually click the “swap” button. I was either rugged too fast, or I got a “Your transaction is expected to fail”, so I never swapped. Each of the above coins were rugged approximately 2 hours after creation. The average is 5 scam coins per day. Shitrugger is a busy person.

At one point Shitrugger pulled about 14 ETH and sent it to Stargate Finance. I have not researched this much, yet, but it appears to be some kind of bridge. If any kind souls can enlighten me, I'd be very grateful.

I sent an initial email to Bybit, mainly to see if I even could contact someone. I stated I had a suspected scammer that had started out from their exchange. I got a response back asking for more information on that initial transaction, so I filled them in on everything earlier today. I will update once I hear more.

Included at the bottom of this post is an excel sheet of how I tried to make sense of all the transactions. I need a new method of organization. The numerous trading wallets clogged up my sheet immediately. I gave up tracking each and every trading wallet – there were too many instances of transferring money between wallets.

https://preview.redd.it/6a3ck21qfa1b1.jpg?width=1886&format=pjpg&auto=webp&v=enabled&s=6e73c3e67c61a81920852c05054c46c9159c7c4a

Thanks to all who helped out a few days ago. I intend to follow Shitrugger until the end.

EDIT: Mcqueen has rugged. I also see I missed a shitcoin in my list. LEAF was created shortly after MOANA, with the same wallet. Edited the list to include LEAF. That makes 22 Shitcoins.

EDIT: I see I missed ANOTHER shitcoin. Nikita was created shortly after Mcqueen, using the same wallet. I thought Mcqueen had just rugged, but it was actually Nikita. One transaction was a rug, the very next one was creating a shitcoin. Shitrugger has some balls. Saves on gas, I suppose.

EDIT: The Stargate Finance transfer I saw appears to indeed be a bridge to Arbitrum. I am seriously struggling finding Shitruggers' address on Arb. Arbscanner brings up nothing. Using Stargate's Omnichain has led me to what I believe is the transaction (amount of eth bridged and the date matches, but that site sucks holy balls and is impossible to navigate). It's late so I will work more on this tomorrow.

reddit image

49 thoughts on “Stalking a Scammer: 21 Rugpulls in 5 Days and Counting.”

  1. The more we expose this type of behavior the easier it becomes to stop it, keep up the great work!

  2. It’s insane how easy it is for them to make a new coin and rug pull it if they’re able to lure any money into it.

  3. The amount of people getting rich off these rug pulls with no consequence is insane, good effort OP. It’s good to see the community track some of these people down.

  6. There are scammers who have been doing this for 2 years straight with 2-3x new tokens per day. Absolute insanity. They got hustle…

  8. Thanks for sharing! Glad the community has people like you looking into this stuff

  11. It’s hard to call for mass adoption when this is the type of stuff people get away with…

  15. What’s with these normal sounding coin names like Alex and Tom lol. Who would buy these? He needs to work on his skills and name it PepeElonCumSpermInu

  17. I feel like OP is the rugger and these posts are like a diary or trophy of his work

  18. It’s astounding and sad someone has this dedication to scam.

    Where does it end ?

  20. Very impressed by your spreadsheet work. I wonder if you’d benefit from a tool like Arkham Intelligence’s visualizer. For example, I simply input the first address you provided and expand by one layer. This is the output:

    https://i.imgur.com/LJPLiKb.jpg

    The screenshot doesn’t do it justice as I’m on mobile, but some useful features:

    • expandable addresses to easily follow the flow of assets

    • custom tags, e.g. “Rihanna contract”

    • easy to visualize inflow (green) / outflow (red)

    • filter by time, type of asset, in/out flow, etc.

    • exchanges, KYC deposits, and protocols are automatically labeled

    It might save you some time in your investigative work.

  22. Next on: Confessions of a Scammer Stalker; Crypto Files

    • Cue the Michael Bay theatrics

  26. Would be crazy if shitrugger is here in cc the whole time watching us watch him.
    Oi! You here shitrugger, you little prick!?

  31. The amount of rug pulls her & that too by a scammer is insane… These guys make money without a conscious!

  32. This is what we call a legendary shitcoiner. I pity for the people that fall for his scam. Gambling on shitcoins is not right. I hope he is caught.

  33. Great post! Following closely.

    >I am seriously struggling finding Shitruggers’ address on Arb.

    Stargate is indeed a bridging app, which I use frequently.

    The default way is to send the funds on the same address on a different network. However, you can choose to receive the funds on another address.

    Check out the bridging transaction from the origin, it might contain some information about the destination. Alternatively, check out the transactions in the Stargate contract around the time of his bridge.

    Probably you’ll find a similar transaction to Arbitrum for the same amount of ETH.

    Cheers!

  34. OP How did you find this token?

    I’m interested in the marketing of these scammers.

  36. Get on them, all these people bringing bad name to crypto basically. I have got scammed as well, twitter influencer are worst and knowingly do shill these coins

  38. Curiouser and curiouser. Hope you can get the ARB address and they dump out to a KYC somewhere.

  39. I remember your initial post. You’ve done a lot of work tracking this guy. But will anything come of it. Is there somewhere you can report him?

  41. Should you even be allowed to handle money when you do things like buying a coin named shrek, honestly

  42. >EDIT: The Stargate Finance transfer I saw appears to indeed be a bridge to Arbitrum. I am seriously struggling finding Shitruggers’ address on Arb. Arbscanner brings up nothing. Using Stargate’s Omnichain has led me to what I believe is the transaction (amount of eth bridged and the date matches, but that site sucks holy balls and is impossible to navigate). It’s late so I will work more on this tomorrow

    You don’t need to try and navigate Stargate’s “Omnichain” to find the Arbitrum destination address – it’s contained within the input transaction data viewable on Etherscan. Look at a Stargate Bridge transaction on Etherscan, click “Show More”, Scroll to the Input Data section, Click Decode Input Data, and you’ll see the _toAddress field for the destination chain.

    For example “Mars” made this Stargate transaction for 18.92 ETH which ended up at this address on Arbitrum. It was then combined with more ETH and bridged back to this address on Ethereum.

    DM me if you want help tracking some transactions.

  45. This is a good research. Great work. All we can do is not dump our money seeing all these pumps.

  46. This is the kind of content I hope to see more of from this community, fuck the scammers, let’s expose every single one that we can to clean this space up!

Comments are closed.