Quote from: Mocny on April 18, 2025, 04:50:14 AM

Hi everyone,

While doing some research on-chain, I came across a wallet that raised a few red flags:

Code:

Wallet address: 0x99e2ae3dd7fdb5684950176551911d19d55dfcab
Etherscan: https://etherscan.io/address/0x99e2ae3dd7fdb5684950176551911d19d55dfcab

Here’s what I noticed:

The wallet is receiving hundreds of transactions — all within similar timeframes.
Most of the transactions are from accounts created over 1400 days ago (based on Binance registration data).
Nearly all transfers are of similar FUN token amounts.
The pattern is very repetitive and looks automated.

This smells like potential manipulation — maybe from a dev, someone trying to simulate token activity, or create artificial volume on-chain.
Any thoughts or deeper insights from the community?

It is already known that the wallet address belongs to FreeBitco.in. I noticed these transactions a few days ago also, and I initially thought something suspicious was going on. What I eventually determined was that they were sweeping their old deposit addresses and moving everything into their primary wallet. As far as I can tell, user deposits were rarely or perhaps never consolidated and funds were just sitting there spread out across hundreds of addresses.

It makes sense that almost all of the incoming deposits are from Binance because it is one of the few exchanges that supports this token and they have the largest volume for it.

The strange thing about this process is that at the beginning they tried to use the Railgun decentralized mixer so they could move the consolidated funds to address 0x9577AC11DE84c4efE4f6abC3A131D0f2678eb794, which would then deposit them on Binance.

This was a dumb idea because Binance could have frozen their account and they gained no privacy due to Railgun having zero liquidity for mixing FUN for any amount, much less $600k+. They also lost a huge chunk of tokens paying entry and exit fees to Railgun’s treasury.