Case Study10 min read

🔍 PIPPINU Rug Pull Analysis

380 fake wallets, 97% loss, 72 hours. Step-by-step anatomy of a real rug pull — what signals did Taranoid detect, and when?

Case Summary

Taranoid Score

/ 100 risk

Real Holders

estimated people

376+

Fake Wallets

clustered

97%

Loss

in 72 hours

Note: This case is an educational analysis built from real blockchain manipulation patterns.

Chronology of Events

●

Hour 0 — Beginning

Token Created on Pump.fun

PIPPINU token was created on Pump.fun with ~0.02 SOL cost. 80% of the total supply started gathered in 2 wallets. Initial liquidity: $1,200.

●

Hour 0–2

Fake Holder Inflation — Phase 1

Small transfers between 0.001–0.003 SOL were made from the main wallet to over 200 sub-wallets. Each sub-wallet immediately bought PIPPINU. Visible holder count jumped from 12 to 240.

●

Hour 2–6

Fake Volume — Wash Trading

Cyclical trading began among 30 wallets. VLR reached 340x (liquidity $3,500, 24h volume $1.2M). Entered the 'Trending' list on DEXScreener.

●

Hour 6

Social Media Campaign

'Found a 1000x gem' messages spread in Telegram channels. Coordinated posts were made by bot accounts. Real investors began buying.

●

Hour 6–24

Pump Phase — Price Peak

With real investors entering, price skyrocketed +1400% from launch. Market cap reached ~$180,000. Fake holders still held 67% of the supply.

●

Hour 24–48

Gradual Dump Begins

Fake wallets began selling one by one — 10–30 minutes apart to avoid detection. Price dropped slightly with each sell. Liquidity slowly drained.

●

Hour 72

Rug Pull Completed

All fake wallets finished selling. Developer closed the liquidity pool. Price dropped 97% from peak. Telegram channel was deleted.

Taranoid Metrics — Snapshot

Metrics displayed when analyzed by Taranoid 2 hours after token launch:

Metric Details

VLR (Volume/Liquidity)

340x

Normal: <10x

Holder Count

247

Actual: ~4 people

Cluster Score

94/100

376 wallets, 2 clusters

Wash Trading

78/100

Cyclical loop detected

Sybil Attack

91/100

Timing + funding analysis

RLS (Rug Liquidity)

82/100

Unlocked liquidity

Top 10 Concentration

89%

Critical threshold: 60%

Token Age

2 hours

<24 hours: high risk

Overall Risk Score

It was possible to see this score 4 hours before the pump phase

Wallet Clustering — Detailed Findings

Funding graph analysis revealed a 4-stage distribution network:

Cluster 1 — Main Operator

Supply: 42%

The master wallet that funded the entire operation. Sent SOL to all other wallets.

Cluster 2 — Distribution Layer

Supply: 25%

8 intermediate wallets funded from the master wallet. These then distributed to sub-wallets.

Cluster 3 — Fake Holders

243

Supply: 28%

Wallets funded from distribution wallets and used specifically to inflate holder count.

Real Holders

124

Supply: 5%

Independent users who fell for the social media campaign and actually bought the token.

Detected connection signals:
• Funding: 252 wallets → funded from single source
• Timing: 180 wallets → created in 47 minutes
• Behavioral: 230 wallets → ±3% similar amounts
• Graph: 2 connected components (95% of supply)

5 Lessons Learned From This Case

Holder count is misleading

247 visible holders were actually 4 people. Look at clustering analysis, not raw numbers.

VLR >50x = emergency warning

340x VLR is physically impossible. Such high ratios definitively indicate wash trading.

Gradual dump is more dangerous

Slow selling over 24 hours instead of an instant dump — requires active monitoring to notice.

Trending list = caution signal

It's easy to trend with wash trading. A trending token is examined with less suspicion — an advantage for scammers.

Detection was possible 2 hours prior

All signals were already present 2 hours after launch. Checking before the pump saves capital.

The only defense: data-driven decisions

The PIPPINU example teaches us this: intuition, social media, and FOMO are inadequate. Blockchain data does not lie. Clustering, VLR, and concentration scores reveal the truth in milliseconds — if you know where to look.

Did you spot a suspicious token?

See the 87-point risk in advance. Just provide the token address.

Analyze Token

Share this case:Share on Telegram Share on X