Security firm GoPlus reported that, in the 30-day window ending September 28, a high-risk network moved more than $9 million worth of ETH through a shared fund-consolidation address. The central wallet recorded roughly 3,589 ETH—about $9.5 million—across 400 transactions. The operation creates tokens around trending narratives, disperses supply to newly generated wallets with minimal history, and sells the tokens via contracts such as PonsV2Helper and UniversalRouter. Proceeds are swept through intermediary wallets before converging in the main consolidation cluster.

Distinct yet similar playbooks

A separate analysis by on-chain researcher known as Wazz identified a different serial-rug operation that extracted roughly $18.43 million from 53 memecoin launches over a two-month span. This scheme relied on groups of 70-200 wallets that amassed a dominant share—often exceeding 70%—of a token’s supply shortly after launch. Funds from one project were routinely transferred to wallets that seeded the next, indicating a recycling of capital rather than a one-off cash-out.

Both investigations note common elements: heavy reliance on the Pons V2 infrastructure, the use of large batches of wallets to mask supply concentration, and the flow of capital from one launch to another. While GoPlus cautions that the two clusters may not be operated by the same actors, the repeatable structure suggests a broader ecosystem of coordinated dumping that can masquerade as ordinary trading.

Robinhood Chain’s explosive growth

Robinhood Chain, an Ethereum layer-2 solution that launched on July 1, has amassed $1.5 billion in total value locked in under 90 days, according to DeFiLlama data. Token Terminal estimates the network generated about $50 million in revenue within roughly three months, with September alone accounting for $40 million of that total. The platform sits behind Robinhood’s 28.6 million funded customers and $384 billion in assets, offering developers a potential gateway to a massive retail audience.

Detection challenges and mitigation pathways

Because the contracts involved function normally, traditional code-based scanners may not flag these tokens. The real risk lies in the coordinated ownership and staged exit across dozens of seemingly unrelated addresses, which can create the illusion of independent market activity before funneling proceeds to a central pool. As Robinhood Chain remains permissionless, external developers can deploy products without direct approval, placing the onus on launchpads, wallet providers, and trading interfaces to implement screening tools, concentration analytics, and user warnings.

Why it matters

The emergence of multiple rug-factory patterns on a rapidly expanding layer-2 highlights a tension between open development and investor protection. With millions of retail users poised to migrate onto-chain via Robinhood’s brokerage platform, robust early-warning mechanisms are essential to prevent coordinated scams from exploiting the network’s scale and liquidity.

Keywords: Robinhood Chain, Ethereum, memecoin, rug pull, DeFi