The Buyers Were Funded Before the Token Existed

At 10:09:31 UTC on 26 July, six Solana wallets received the first transaction of their lives. Same slot, 435312803. Most of them in the same transaction.

Forty-three slots later, about seventeen seconds, the wallet that paid them paid one more: J6FAJ2Pz2htqoKUD1WLZJC9RTsRuF9oQYo8RxS3s6dnH. At 10:12:12 that wallet created a token called United States Water Reserve, ticker USWR. The six wallets bought it.

They kept buying. Over the following days those same six accounts bought twenty different mints across three supposedly unrelated deployers. Every one of those mints belonged to the same invented catalogue: United States Oil Exchange, United States Uranium Reserve, Vanguard Oil Retirement Fund, Transnational Oil Supply, Seized Asset Custody Fund. Tokens dressed as sovereign commodity reserves, sold to nobody, because the only buyers were paid for by the seller.

Rugburn had scanned none of it. Not one of the 22 wallets carried a label, a deployer edge, a cluster membership or a single scan. The engine had been looking at this operation for two weeks and had nothing to say about it.

What the chain showed

The catalogue is the first thing that gives it away. Across 30 days those 22 wallets created 85 mints, and the names repeat in a pattern that copycatting does not produce.

USWR appears under six different deployer wallets across nineteen mints. USOH appears under six wallets across ten. USOX, USUR and TNOS each appear under four. On their own those numbers mean little, because a ticker that catches will be cloned fifty times within the hour on pump.fun.

The detail that rules cloning out is what individual wallets did. 3iM6FfJi shipped USWR, USOH, USOX, TNOS and NTFS. DrZhh8Uz shipped seven distinct members of the family. A copycat chases the one ticker that is moving. Someone working through a product line ships the catalogue.

The relaunch cadence says the same thing. J6FAJ2Pz fired USWR ten times between 10:12 and 15:54 on a single afternoon. DrZhh8Uz fired RISE eight times across 2 August. Relaunch the brand until one catches, let the winner run, extract.

The money is not trivial. Across the group the average peak liquidity in a rugged pool runs from $18,000 to $110,781. The spam factories that dominate pump.fun sit near $4,000 and never take a cent from anyone, because nobody ever buys. This is a different animal.

Why nothing flagged it

Two separate failures, and neither of them looked like a failure from the inside.

The first was attribution. Rugburn lists a deployer's tokens through Helius DAS getAssetsByCreator, which resolves the metadata creator. For all 22 of these wallets it returns a total of zero. As a control, three known pump.fun spam factories return ten out of ten on the same call. Every one of the 22 launched on pump.fun, confirmed against pump_evt_createevent, so this is not a venue gap. It is a metadata attribution split, and the effect is that the product returned a clean empty list for exactly the operators worth looking at. An empty list and an absent answer render identically.

The second failure was clustering, and it is the one worth the post.

Rugburn resolves who funded a wallet by walking to its first inbound transfer and reading the source. Run against these 22, three levels deep, sixty-six hops: twenty-two distinct funders at level one, twenty-two at level two, twenty-two at level three. One collision in the entire graph. By that measure these are twenty-two unrelated people who happen to like the same fake government tickers.

That result is wrong, and the way it is wrong is instructive. Twenty-two wallets with zero funder overlap is not what independent users look like. Independent users collide constantly, because they withdraw from the same handful of exchange hot wallets. Zero collisions across sixty-six hops is not a property of a crowd. It is a property of generated chains.

Transaction 5MH1joF6GwM7AM8rxL7UujoRhqKS2P84qaNPbpa89CxUUS7n6YHyUtHvB5Aguu96avqD4GLhXg3SGb72Rug7GWDW, slot 434968741, shows the shape. One fee payer, 6yD19aNx, twelve instructions, and inside them five pairs:

6yD19aNx → EMCKVMXS → G1GFpAmU     50.1062 SOL
6yD19aNx → tqDqvJaz → Dab3b4Ap     54.8538 SOL
6yD19aNx → 8RDSd4f9 → kYoMZFCQ     53.5369 SOL
6yD19aNx → 6iSNuZHW → GkYjjPed     52.4114 SOL
6yD19aNx → 7hmqajUs → 6bRPnT6z     54.5854 SOL

Roughly 265 SOL, near $48,000 at the time, into five wallets through five intermediaries that exist for the length of one transaction and are never used again. The hop is atomic. It happens inside the same signature as the payment it is hiding.

So when the walk asks "who funded this wallet", the honest answer it gets back is a throwaway. Each throwaway is unique to its recipient. Grouping by funder address therefore reports no relationship between wallets that were paid by the same person in the same instruction list. The engine was not failing to find the link. It was reading a field the operator had made meaningless, and reporting the absence as a finding.

Defeating it cost one extra instruction per recipient.

What we changed

Group by the transaction, not the address.

resolveFunder had been returning the funding signature the whole time. Both callers discarded it with an underscore. The fix keeps it and uses it as the grouping key, falling back to the address when no signature is available.

Measured on the six wallets in the cold open: grouping by address gives six groups of one. Grouping by transaction gives one group of five and one of one. The bundling rule needs five to trip, so the same evidence that was silent now fires.

That mattered because the rule feeds the score, and the score was in trouble. Of 24 tokens the drain oracle has confirmed rugged, only ten were scanned before the rug happened. The other fourteen were scanned afterwards, when the confirmed-drain cap had already forced the score to 10, so they measure nothing. On the ten genuine predictions, five said Medium Risk. A structurally clean pump.fun launch scores 71 in our engine. The same launch with five buyers traced to one funding source now scores 35.

The verification was cross-source. The same transaction was pulled from Helius and from public Solana RPC: slot, fee payer, instruction count and error status match exactly.

The limits

The single-actor claim does not survive its own evidence, and I am not going to make it.

Three separate root purses fund these groups, not one: EAY8a66z, 6yD19aNx and D4AomtcU. Twenty of the twenty-two wallets share no common ancestor within three hops. One brand chain is proven, the USWR chain in the cold open, where the same wallet paid the buyers and the seller seventeen seconds apart. The rest is a shared catalogue and a shared buyer base, which is strong and is not proof. It could be one operator with three funding trees, or three operators running the same playbook, or a launch service selling the playbook to customers. The walk cannot separate those.

The scoring fix has a narrower reach than it sounds. The behaviour indexer that produces these counts currently runs on roughly four percent of scans, from a queue rather than inline. A correct signal that reaches almost no tokens is still almost no coverage, and that gap is the real ceiling right now, not the detection logic.

The ten-token prediction set is small. It is the entire population of tokens we scored before a confirmed drain, so it is the honest denominator, but ten is ten and the next twenty will move the number.

And the attribution hole is open. getAssetsByCreator still returns zero for these wallets, so the deployer page still shows an empty catalogue for the operators who take the most money.

The follow-up, because this is not finished

Four things are unresolved, in the order I intend to take them.

Do the three purses converge. The walk stopped at three hops because that is where the question was answerable. It should continue until it terminates at an exchange deposit address or a genuine origin. If EAY8a66z, 6yD19aNx and D4AomtcU share an ancestor, the single-actor claim becomes provable. If they terminate at three different exchanges, the shared catalogue means something else entirely, and that is a more interesting finding than the one I expected.

Test the co-buyer overlap across all 22, not the eight I sampled. Twenty-five wallets were found buying across two or more deployers, in three groups of exactly six with matching purchase footprints. That was a sample. The full pass either finds one buyer population behind the whole catalogue, or it finds three, and that answers the same question as the funding walk from the other end.

Follow the extracted SOL. Everything so far traces money going in. Nothing traces where it went after the pools were emptied. If the outflows converge where the inflows do not, that is the strongest available link and nobody has looked.

Establish whether 85 mints is the whole catalogue. The 22 wallets came from a filter on peak liquidity and graduation rate. The naming family is now known, and a search across all pump.fun create events for that family will show whether this is the operation or a corner of it. The Dune cohort table holds 140,994 deployers and 32 of them carry a Rugburn label. That ratio is the actual state of coverage, and it is the reason a catalogue this legible sat unread for a fortnight.

The wallets in the cold open were funded two minutes and forty-one seconds before the token they were created to buy. Every one of those transfers was public the whole time.

The ledger is public: rugburn.io