BlockBeats reported on Sept. 28 that GoPlus Security had identified a high-risk fraudulent meme coin factory on Robinhood Chain, with more than $9 million in transaction flow over the past 30 days and links to hundreds of scam meme tokens.
Collection address and on-chain activity
GoPlus said the fund collection address tied to the operation is 0x8c3Bad30cc7563A2D0357F49509FFd063666bb00. As of Sept. 28, 2026, the address held about 56.0635 ETH, worth roughly $148,000.
The address has recorded about 1,385 transactions in total. In its latest 400 transactions, inflows were about 1,728.02 ETH and outflows were about 1,861.12 ETH. That puts two-way turnover at around 3,589.14 ETH, or about $9.49 million.
GoPlus said the amount reflects the gross value routed into the collection system for batches from the same projects and should not be treated as net profit.
Pattern identified by GoPlus
Across the high-risk related meme tokens, GoPlus said it found direct evidence of the same sequence on-chain: token approval or token selling, conversion into ETH, and transfer into a shared collection address.
The firm described the scam factory model as a cycle of fresh-wallet distribution, layered fund collection, and capital recycling:
- creating tokens based on current market narratives;
- distributing those tokens to a large number of new externally owned accounts, each with only 4 to 11 transactions;
- selling in stages through PonsV2Helper or UniversalRouter;
- emptying ETH into local collectors or the main collection address, identified as 0x8c3bad;
- using the funds to support the next round of projects, wallets, and trading activity.
Core traits of the scheme
GoPlus said the model relies on several recurring features:
- using a large number of new wallets to hide the real concentration of token holdings;
- selling in tranches through those wallets to create the appearance of multiple independent traders;
- routing funds into the same collection system after distribution is complete;
- recycling proceeds from older projects into the next round.
Comparison with a case disclosed by Wazz
GoPlus also referred to a recent disclosure by on-chain researcher Wazz, who said a suspected serial rug group launched at least 53 Robinhood Chain meme tokens in about two months and extracted about $18.43 million. According to Wazz, the group mainly used 70 to 200 wallets to control most of the token supply and then rolled proceeds from one round into the next.
GoPlus said that case shows a similar fraud pattern, but there is currently no evidence that the two cases involve the same group.