GoPlus: Robinhood Chain Exposes Another Meme Coin RUG Factory, With Over $9 Million in Volume

BlockBeats news, September 28 — The GoPlus security team disclosed that a high-risk fraudulent Meme factory was recently discovered on Robinhood Chain, with over $9 million in volume in the past 30 days, involving hundreds of fraudulent Memes.

The asset aggregation address is 0x8c3Bad30cc7563A2D0357F49509FFd063666bb00. As of September 28, 2026, the address balance is approximately 56.0635 ETH, worth about $148,000; the address has about 1,385 transactions in total, with the latest 400 transactions showing approximately 1,728.02 ETH in inflows and approximately 1,861.12 ETH in outflows; two-way volume is approximately 3,589.14 ETH, worth about $9.49 million.

Direct evidence of "approve or sell tokens —> clear out ETH —> transfer to the same aggregation address" was found in all high-risk associated Memes. The amounts are gross amounts transferred into the aggregation system in batches from the same project and do not represent net profit. The fraudulent Meme factory model mainly includes "new account distribution — layered aggregation — fund recirculation":

1. Create Tokens based on industry hotspots;

2. Distribute Tokens to a large number of new EOAs with only 4–11 transactions;

3. Sell in segments through PonsV2Helper / UniversalRouter;

4. Empty ETH to local aggregators or the main aggregation address (0x8c3bad);

5. Provide funding for the next round of projects, new wallets, and trading operations.

The key to this fraud model is:

1. Use a large number of new wallets to hide the actual concentration of holdings;

2. Have these wallets sell in segments to create the illusion of multiple independent traders;

3. After distribution is complete, funds flow into the same aggregation system;

4. Reinvest the proceeds from old projects into the next round.

On-chain researcher Wazz recently disclosed that a suspected serial Rug group launched at least 53 Robinhood Chain Memes in about two months and extracted approximately $18.43 million from them. Its main method was to use 70–200 wallets to control most of the token supply, then invest the proceeds from the previous round into the next round. This case is similar to the fraud model in this case, but at this stage there is no evidence that they are the same group.