Late on Sept. 21, 2026, a token called DEED opened trading on Robinhood Chain.
At first glance, it looked like a standard hot meme launch. The curve was bought out within a few blocks, the token graduated early, and it moved into a Uniswap v4 pool connected to Pons V2. Under the rules, the pool’s LP was permanently locked. Security tools also showed the usual green checks: sellable, not a honeypot, and liquidity locked.
The packaging looked complete as well. The project pitched itself as a “real estate vault on Robinhood Chain”: deposit rent into a vault, hold DEED, and receive rental income. It had an X account, @DeedEstate, a website, and language such as “The Roll to be announced on the 1st,” which gave it the feel of an RWA-style project.
One detail did not fit. In the first second after launch, 86% of the supply had already been allocated. It went to 98 addresses. Those addresses were funded at nearly the same time, placed orders at nearly the same time, and then began selling in near lockstep.
Twelve hours later, DEED’s market cap had fallen from a peak of about $3 million to $4.3 million back to near zero, a 99% drawdown. About 229 ETH, roughly $630,000, was pulled out. The operators also collected about $180,000 in Pons creator revenue.
The capital used to open that trade came from another launch that had just finished distributing out, only 16 seconds earlier.
Wazz mapped 53 launches
On-chain analyst Wazz documented that 16-second handoff. On Sept. 27, he posted a fund-flow chart covering 53 tokens and 53 launches, spanning from July 10 to Sept. 21, 2026.
According to his tally, the identified launches extracted about $18.43 million in total, or around 7,447 ETH. He said that was only the portion he was able to trace.
Why the setup worked on Pons V2
Pons V2 works in a way that closely resembles pump.fun: a fixed supply of 1 billion tokens, a bonding curve, automatic migration to Uniswap v4 once the curve fills at roughly 4.2 ETH, and a permanent LP lock after graduation. It also applies an anti-snipe tax in the first few seconds after launch, starting at about 99% and decaying to 0 within seconds.
The anti-snipe tax was meant to stop bots from taking all the cheapest supply in the opening second.
The issue, the report says, is that the creator can whitelist up to about 32 addresses at launch and exempt them from that tax.
That became the opening these groups used. Older rug designs relied on removing liquidity, blacklisting users, or imposing a 99% sell tax, effectively blocking the exit. This structure did the opposite. The path out stayed open, the pool stayed permanently locked, and the token remained sellable. What had already disappeared was the cheapest supply at the very start of trading.
DEED was not even in the top 10
In Wazz’s list, DEED did not rank among the 10 largest extractions.
The three biggest were:
- CRUMBS: about $3.12 million, with 92 wallets involved in the initial buy;
- LEGS: about $2.9 million, with 77 wallets;
- PINK: about $1.44 million, with 125 wallets.
Each launch followed the same basic pattern. The operators used 70 to 200 wallets to create the appearance of dispersed ownership while taking more than 70% of supply. One review of the activity found that tax-exempt wallets plus the creator address typically controlled 82% to 86% of supply after launch.
The creator exempted 15 to 25 addresses from the anti-snipe tax in the launch transaction. Then, within one to three blocks, a single transaction bought on behalf of those addresses, emptied the bonding curve, and pushed the token straight into the pool. The wallets then sold in parallel and moved on to the next project.
The report also says the operators understood the behavioral side of the trade. They would warm up the market with several fake contract addresses, then publish the real CA on X once FOMO had built.
GoPlus identified another cluster
The report says this was not limited to one group. Security firm GoPlus found another cluster whose funds were consolidated into one address with a balance of about 56.06 ETH, or roughly $148,000.
After breaking down 1,385 transactions tied to that cluster, GoPlus found that the most recent 400 transactions included inflows of about 1,728 ETH and outflows of about 1,861 ETH, for combined turnover of about 3,589 ETH, equivalent to roughly $9.49 million.
Six structural signs of the new launches
The article lays out six recurring features.
1. The pool is locked, but the token is still sellable
After a Pons V2 token graduates, LP moves into Uniswap v4 and stays permanently locked. That can look safe on the surface, but it says nothing about whether the initial distribution was fair.
2. Between 70% and 86% of supply is taken internally in the opening seconds
The creator exempts 15 to 32 addresses from the anti-snipe tax, then uses a single transaction within one to three blocks to buy for those addresses together. Outside buyers who rush in during the first second face a tax near 99%. Insiders do not.
3. Holdings are split across dozens or hundreds of fresh wallets
Instead of one obvious operator wallet holding 80%, the supply is spread across 70 to 200 addresses that look like ordinary users. The holder chart appears decentralized by design.
4. The new wallets behave in highly uniform ways
Many of the EOAs have only four to 11 transactions. The path is repetitive: receive a small amount of ETH, buy or receive tokens, approve, sell in stages, then send ETH to the same collection address.
5. The money moves as a production line
ETH from the previous launch is sent to the next funding key within seconds or tens of minutes. Viewed one by one, the launches can look unrelated. Viewed as a fund-flow map, they form a chain.
6. The packaging looks more credible than older scams
The projects often come with fake websites, fake product narratives, and staged launches. The examples cited include stock rebates tied to receipts, order-book language, and real-estate-vault stories. A common pattern is to push a fake CA first, then release the “official” contract later. Posts from KOLs are often deleted soon after the rug.
How retail traders can reduce the risk
The article says these launches are hard to avoid completely, but it offers five checks that can help.
Check the launch transaction, not the website
Open the token’s first creation transaction in a block explorer and look for a tax-exemption list or a long address array with a name such as snipeTaxExempted. If more than 10 addresses are explicitly exempted, treat it as a factory launch.
Review the buyers in the first one to three blocks
Look for a single transaction buying for a dozen or more addresses at once. Then check whether those addresses were funded with similar amounts of ETH by the same funding key shortly before. If they appeared together, got funded together, and bought together, the report says that is a bundle, not a coincidence.
Open the top 20 holder addresses one by one
Check wallet age and transaction count. If more than half were created the same day, have only a handful of transactions, and send sale proceeds to the same destination, the launch shows factory-like behavior.
Trace where the creator’s ETH came from
Look at the previous large inbound transfer to the creator or funding address. If it came from the collection address of a meme token that had just collapsed, and the gap is only a few dozen seconds, that is one of the clearest fingerprints of a serial operation. In DEED’s case, the gap was 16 seconds.
Search for dead launches using the same name
If the same narrative has already appeared two or three times within 24 to 72 hours, with a fake CA first and a real CA later, the article says it should be treated as a harvesting design rather than a signal to chase the “correct” contract.
The closing rule is simple: if two of those five checks hit, leave.