September 21, 2026, late at night.
A token called DEED launched on Robinhood Chain. The curve was bought out within a few blocks, and the token prematurely "graduated" to a Uniswap v4 pool integrated with Pons V2, where, as per protocol rules, the LP is permanently locked. Safety plugin indicators lit up one by one: sellable, not a honeypot, liquidity locked.
A few minutes ago, it looked like a typical popular meme launch—all the elements were there. The narrative was "real estate vault on the Robinhood chain": pay rent into the vault, hold DEED to receive rental income. There was a Twitter account @DeedEstate, a website, and buzzwords like "The Roll is dropping on Day 1," sounding very much like RWA.
Only one thing is wrong: in the first second of trading, 86% of the supply had already been distributed—to 98 addresses. These 98 addresses received funds almost simultaneously, placed orders almost simultaneously, and then began selling almost simultaneously.
Twelve hours later, DEED’s market cap dropped from a peak of approximately $3 million to $4.3 million back to near zero—a 99% drawdown. Approximately 229 ETH, worth around $630,000, was withdrawn. The creators also pocketed $180,000 in Pons creator revenue.
The funds for this order were transferred here 16 seconds ago from another order that just completed its exit.
An on-chain analyst named Wazz captured these 16 seconds. On September 27, he posted a funding chart showing 53 tokens, 53 launches, scheduled from July 10, 2026, to September 21, totaling approximately $18.43 million, or about 7,447 ETH. This is only the portion that can be identified.
Why can it be done on Pons
Pons V2's mechanics are nearly identical to pump.fun: a fixed supply of 1 billion tokens, following a bonding curve; once the curve is fully filled (approximately 4.2 ETH), it automatically migrates to Uniswap v4 with permanently locked LP; an anti-snipe tax is applied in the first few seconds of launch, starting at around 99% and decaying to 0 within seconds.
The intention behind the anti-snipe tax is good: to prevent bots from snapping up all the cheap assets in the first second.
However, the rules include a backdoor: the creator can whitelist up to approximately 32 addresses at launch to exempt them from this tax.
That’s the key point—these groups have found a way to exploit a bug. Previous scams made it impossible for you to sell; now, that’s no longer necessary. Old-school rug pulls blocked the path by removing liquidity, blacklisting addresses, and imposing 99% sell taxes—essentially “shutting the door.” Pons’s design does the opposite: the path is open, liquidity is permanently locked, and tokens can be sold anytime. But the earliest, cheapest batch of tokens sold at launch has already been snapped up by insiders.
Fifty-three trays
DEED does not rank in the top ten on Wazz's list.
The three most heavily drawn are:
· CRUMBS: Approximately $3.12 million, with 92 wallets participating in the purchase;
· LEGS: Approximately $2.9 million, 77 wallets;
· PINK: Approximately $1.44 million, 125 wallets.
The operational logic is always the same: use 70 to 200 wallets as a smokescreen to secure over 70% of the supply. Analysis of these operations shows that, combined, tax-exempt wallets and the creators can acquire between 82% and 86% of the supply after launch.
The creator exempted 15 to 25 addresses from the anti-snipe tax in the launch transaction, then within 1 to 3 blocks, used a single transaction to buy tokens for all those addresses at once, draining the liquidity curve and immediately graduating into the pool. They then immediately sold their holdings and moved on to the next project.
They also understand human psychology well—they know people will FOMO, so they first release a few fake contract addresses to build hype, then announce the real CA on Twitter to trigger a market surge.
This is not the only group; the security firm GoPlus identified another group that consolidated funds into a single address with a balance of approximately 56.06 ETH (around $1.48 million). Analyzing 1,385 transactions, they found that in the most recent 400 transactions, approximately 1,728 ETH flowed in and 1,861 ETH flowed out, resulting in a total two-way volume of about 3,589 ETH, equivalent to roughly $9.49 million.
What does a new listing look like?
Remember the six structural characteristics.
The pool is locked, but you can still sell your coins.
After Pons V2 graduates, LPs move to Uniswap v4 and are permanently locked.
In the seconds before opening, 70% to 86% of the supply was absorbed internally.
The creator exempts 15 to 32 addresses from the anti-snipe tax, then uses a single transaction within the next 1 to 3 blocks to purchase tokens for all these addresses. Outsiders who try to buy in the first second face a tax close to 99%, while insiders pay no tax.
The position has been split into dozens or even hundreds of new wallets.
It’s not one single whale address holding 80%; rather, 80% is held collectively by 70 to 200 addresses that appear to be ordinary users. The distribution chart is designed to look dispersed—it’s meant to give you the impression of dispersion.
The characteristics of new accounts are very consistent.
A large number of EOAs have only 4 to 11 transactions, following a fixed pattern: receive a small amount of ETH → buy or receive tokens → approve → sell in batches → send ETH back to the same aggregation address.
Funds are a continuous process, not a one-time transaction.
ETH from the previous round is transferred to the funding key of the next round within seconds to minutes. Individually, each round appears as a standalone project, but when viewed together, the fund flow forms a chain.
The packaging looks more like a legitimate project than the old one.
Fake websites, fake product narratives (receipts returning stocks, order books, real estate vaults), fake launches: first hype a CA to generate FOMO, then announce the "official contract." KOL posts are often deleted immediately after the rug pull.
How should retail investors avoid risks?
It's indeed hard to prevent, but we can try to mitigate it as much as possible.
Watch the launch transaction, not the official website.
Open the first creation transaction of this token in your browser and look for a long array of addresses such as a tax exemption list or snipeTaxExempted. If more than 10 addresses are listed as exempt, treat it as a rug pull.
Watch the buyers in the first to third blocks after open.
Is the same transaction buying for ten or twenty addresses at once? Have these addresses recently received similar amounts of ETH from the same funding key?
Simultaneous appearance, simultaneous funds, simultaneous purchases—that’s a bundle, not a coincidence.
View the top 20 holders.
Look at the number of transactions and account age. If more than half were created today, have only a few transactions, and all ETH sold flows into the same address, it’s a factory.
Trace back the origin of the creator's ETH.
Was the previous large deposit to the creator or funding address transferred just seconds ago from a consolidation address associated with a meme coin that has already halved in value?
This is the most stable fingerprint from the series factory. The interval on DEED is 16 seconds.
Check if there are any identical named dead projects.
The same narrative was posted 2 to 3 times within 24 to 72 hours (fake CA + real CA), with a warm-up phase followed by a contract switch—prioritize treating this as a rug pull design, and avoid chasing the "correct CA."
If two of these five steps are triggered, it’s time to exit.