Five layers, every link a transaction you can look up. Solid thread is money going down into the operation; dashed thread is money swept back up. Nothing here is inferred — each figure is a balance delta.
The treasury wallet is small enough to read completely — 394 signatures, every one parsed. It funds an operator wallet, the operator runs one token, then the survivors of that capital come back. Each row is one production, and the return is the whole business model in a column.
Twelve of thirty-four operations made money. The median operation lost 4.4%. Across the week the treasury pushed out 25,233 SOL and got back 22,130 — about $2.4 million deployed to lose $295,000.
And the worst single row is the token this file is about. $CATALORIAN was the treasury's largest deployment and its largest loss.
The block-0 snipe and the operation are two different books. Three of the five block-0 wallets were traced end to end: they risked 40.1 SOL and returned 2,910. The other two paid a further 46 SOL in block 0 and their exits were not separately traced. The operation then spent roughly 4,000 SOL buying — because a chart does not walk from $800k to $26.5M on its own, and somebody has to be the bid. That inventory was distributed into the eleven-hour plateau and then into a −96% collapse. The arithmetic closes exactly: 4,050 SOL out, 1,521 SOL back, 73 SOL still in the operator, about 4 SOL scattered across 212 drained wallets.
Market cap on a log scale, every two minutes. The shaded band is the block-0 cluster distributing; everything after it is the operator's own money working.
7RfpN81B…EZxQ receives its first ever transaction from the treasury — two minutes before the token exists. It will be topped up to 4,050 SOL and will spend its entire 1.3-day life on this one mint before being discarded.
The earliest of the 212 trading wallets is created before the mint. This was set up, not improvised.
The operator signs a transfer to a brand-new wallet. The token is created 2.8 seconds later. A deployer with a three-second history is a disposable handle, not a founder.
Five wallets take 79.5% of supply for 85.0 SOL (about $8,200) in the creation block. All five trace to the same operator. Every other transaction on the bonding curve — 301 of them — failed. Outsiders never touched the curve at all.
Two of the four transactions carried two buyers each — a signer and a co-buyer paying separately in the same instruction. An earlier version of this file reported 3 wallets and 49.4%, because it read only the signer of each transaction. The co-buyers CN3NfnEo…SCUG (21.9% of supply, 20.00 SOL) and AiTHdnGQ…2g62 (8.0%, 25.97 SOL) were invisible to that method, and trace to the same operator as the other three.
The cluster liquidates 449 million tokens in near-identical slices every 10–20 seconds, sweeping each lot to the operator. This is what pins the price flat at $500–800k for 45 minutes: not a base forming, a bot feeding supply to arrivals. Gross: 2,950 SOL.
Buying starts absorbing more than 14.85 SOL per interval and price leaves the range — $525k at 12:20, $1.06M by 12:35. The seller is still selling; it just cannot hold the lid any more. This is the only moment on the chart that was tradeable in real time.
The three block-0 wallets are empty and discarded. The operator keeps going with a rotating set that reaches 212 wallets, and from here it is a net buyer. 19× in under three hours.
Price holds $14–18M while 30-minute volume decays from $920k to $37k — and the operator signs 9,180 transactions, 76% of its entire life, inside exactly this window. Flat price on dying volume is somebody large trying to get out. They did not get out cleanly.
A 60% spike on $673k of volume, fully retraced to $14.5M within thirty minutes.
$16M → $5.3M in one half-hour, then $2.6M, $1.6M, $775k. Now ~$890k. The largest holder on chain is the liquidity pool at 4.9%; no wallet holds more than 0.44%. The operator has returned 1,521 of 4,050 SOL and holds 73.
Every bar is one block-0 sale, sized by the SOL it returned. The flat line is 14.85 SOL.
Every token, re-derived from the launchpad's own creator field and its funding chain — not from wallet co-occurrence, which is how the first version of this table got one of them wrong. Ring A marks the twelve confirmed to share a single treasury. The last column is how far the chart ran from a buy five minutes after launch, measured strictly forward.
Every one of them is a pump and a death — the median token peaked at $424k and sits at a few thousand today. $CATALORIAN reaching $26.5M is a 40× outlier against its own stablemates, not a house style.
But the ring's P&L and an outsider's are different books, and the catalogue is where that stops being an argument. Across Ring A’s twelve tokens — all twelve fully charted — eight doubled from a five-minute entry. The ring lost money on the week; a follower buying the same launches with no obligation to support the price did not.
Operations still trading when this file was first compiled at 19:20 UTC on 24 August, largest peak first. It is kept here because what happened next is the point.
The top row did not survive the evening. $PawPatrol rugged at 20:44:13 — ten wallets sold roughly 500,000 tokens each, twenty sales, all inside a single second, one second after its own all-time high. About $7,367 came out. Market cap went from $906,205 to roughly $1,730.
Lower down the table, four tokens were launched within about seventy seconds of each other at 19:44, and most had lost the majority of their value inside the hour. Their launch times come from the launchpad and are solid; the SOL figures beside them do not, for the reason below.
Two things in that table were wrong when it was written, and both are corrected below. $PawPatrol was not a Ring A operation — it belongs to an unrelated group, shown in Exhibit I. And the 2,210 SOL attributed to it came from a mis-derived link rather than a measurement.
JBG and OUTCAST do not carry the pump address suffix the other tokens here do. pump.fun’s API returns them, but they may have been created through a different path — which would mean these operators are not pump.fun-exclusive, and that a scanner deriving a pump.fun bonding-curve address returns nothing for launches like them. Not investigated further.
Ten dollars of real money through the test wallet 26nmSpWZ…3iwV, to find out what the analysis was worth outside a spreadsheet.
| 20:42:00 | Bought 11,033.276467 $PawPatrol for 10.00 USDC | $0.00090635 | mcap $903k |
| 20:44:12 | Its all-time high | — | mcap $906k |
| 20:44:13 | Ten wallets dump in one second | — | mcap $1,730 |
| now | Position value | — | about $0.02 |
The entry was 2 minutes 13 seconds ahead of the dump, not into it — a $10 order was 0.1% of that pool and moved nothing. Take-profit orders at 2× and 3× were placed and will never fill.
The mechanism was pool depth, not the selling. The $7,367 of sales left $1,738 behind, so the pool held roughly $9,100 against a $903,000 nominal market cap. About one percent of the notional was backed by anything. At that depth no exit was ever going to fill, whatever the chart did.
Pool depth had already been named, in writing, as the single biggest unmodelled risk in this strategy — together with the instruction to read reserves at entry and size to a few percent of them. The trade was then executed without reading reserves. GeckoTerminal returns reserve_in_usd on a call that had already been made twice that evening; one field would have shown $9k of depth under a $903k cap.
That is now rule R6: a stated risk that is not coded is not a control. The loss was $10 plus about a dollar of fees, which is the cheapest available version of that lesson.
The first version of this file mapped tokens to operators by looking at which wallets they had in common. That is not evidence of shared control, and it produced a false link. Every row was rebuilt from the launchpad's own creator field and that wallet's funding chain. Three distinct groups came out of twenty tokens.
Ring A is real and it is old. Twelve of the twenty tokens trace through one spine — treasury to treasury to treasury, each handing its successor exactly 10.0000 SOL and then emptying — and the chain runs back to 11 June. Five of those twelve stopped one hop short on the first pass because their operator wallets hold 20,000–30,000 signatures and the walk would not name a funder it could not verify. A deeper walk closed four of them onto the treasury directly. The fifth is still capped at 30,000 signatures; it sits in the treasury's ledger with 2,100 SOL against its name, so it is almost certainly the same, and it is marked unconfirmed rather than counted.
$PawPatrol is somebody else. Its chain runs twenty-two hops and had not terminated — a ladder of wallets each holding exactly two signatures and zero balance, all created within hours of the launch purely to break the trail. Ring A does not bother with any of that; it pays its operators directly. The tradecraft is different, the funding size is different (195.8 SOL to the deployer against Ring A's 0.203), and the bonding curve saw six transactions against $CATALORIAN's 305.
$Cockroach shows the same twenty-two-hop shape and also fails to terminate, but shares no wallet with $PawPatrol's ladder. Same technique, no proven link — grouped together with that caveat stated, not asserted.
$Polycat is a third group again. Seven wallets took 50.7% of supply in its creation block, but their funding traces to MEXC, Binance and other exchange-sized wallets — not to any shared private treasury. Its own creator carries 40,000 signatures and dates to 30 June, which makes it a launchpad deployer service rather than a person, so creator-lineage cannot classify it at all. It is not Ring A.
The false link claimed an operator whose treasury funding ended on 23 August ran a token created on the 24th. A single assertion — that a funder's activity window must contain the token's creation time — kills it without any additional data. That test now runs before any edge is accepted, and the rest are written down in METHOD-RULES.md, each attached to the wrong answer that produced it.
Five tokens with known answers, run through the block-0 scanner. The result is not the one you would guess.
Concentration does not discriminate. $PawPatrol took 79.6% of its supply in block 0 — indistinguishable from the three Ring A tokens at 79.5%, 79.9% and 79.6%. Every bundled launch looks identical on that measure. A filter built on b0_supply_pct would have passed the token that rugged inside two hours just as readily as the one that ran 39×.
What separates them is cofund_n — whether the block-0 wallets share an ancestor. The three Ring A tokens return 5 of 5 wallets converging on a single funder. $PawPatrol and $Polycat return zero.
The scan traced four hops. $PawPatrol's funding ladder is at least twenty-two hops of single-use wallets, so its zero is a limit of the search, not evidence of independence. $Polycat's zero is different and stronger: its chains terminate at exchanges, and an exchange is never treated as a shared ancestor because Binance funds thousands of unrelated people. Reaching one means the wallets are not proven related — not that they are proven unrelated.
The obvious idea after finding this was: watch the funder, be early on its next launch. That idea is dead, and the reason is the most useful thing in this file.
The operator wallet is disposable. Its entire existence is 18,300 transactions across 1.3 days, all on one mint, and it was created two minutes before that mint. It has no future launches. Neither did the eight operator wallets before it — each ran one token and was drained to zero.
The layer above rotates too, just slower. Each treasury lives two to four weeks, seeds its successor with exactly 10.0000 SOL, and is emptied:
So the durable object is not a wallet at all — it is a shape. Which is why the useful artefact from this case is a feature, not a watchlist.
Everything that identified this operation was decided in the creation block and never changed afterwards, which makes it cheap to compute and impossible to fake later. bundle_features.py emits it for any mint in about fifteen RPC calls, with no API key and no paid provider:
Share of supply taken in block 0 by wallets that answer to one funder. This — not raw concentration — is what separates a ring from an unrelated bundle.
Gap between the deployer's first-ever transaction and the mint. Real projects do not deploy from three-second-old wallets.
301 of 305 bonding-curve transactions failed. The float was taken atomically and everyone else was locked out.
Separates a factory from an exchange. Binance, KuCoin and MEXC funders hold 124k–400k SOL. Labels do not do this; balance does.
The trade the ledger points at is not the one the operator is running. The operator loses because it has to be the bid all the way up and the seller all the way down. A follower carries neither obligation, which is why the ring's −12.3% says nothing about an outsider's return.
Priced across Ring A's twelve tokens — every one of which has full chart data, so there is no coverage gap to hide in — the rule returns between 1.14× and 2.50× per trade. Eight of the twelve reached 2× after the entry; two topped before it and are counted as losses. It stays positive with $CATALORIAN removed entirely, so it does not rest on the one outlier.
The detection side is already cheap. ring_watch.py watches the treasury and fires three signals: a deployment of 100+ SOL to a fresh wallet means a token is coming in about four minutes; that operator paying ~0.2 SOL to another fresh wallet means the mint lands in three seconds; and an exact 10.0000 SOL transfer means the treasury has rotated and the watcher should follow it.
Slippage. Entries sit at $60k–600k market caps on thin pools, where a trade worth a few percent of reserves costs about 5% round trip and ten percent of reserves costs north of 20%. That caps position size at low thousands per token, and it is the difference between the 1.14× case and a losing one. $PawPatrol's pool held about $9,100 under a $903,000 nominal cap — roughly one percent backed. Two of the twelve tokens also topped inside their first minute and were unwinnable; both are already counted as losses here.
Twelve tokens from one week and one ring. The rule has been priced on that history, never traded on it — the one live attempt was on a token from a different group and lost. The 34-row ledger is a real base rate for the treasury, not for the entry rule; slippage is not in the multiples. Before any of it is sized, the block-0 features need running across a far wider sample, token-weighted and with intervals, to establish how common co-funding is among tokens that go nowhere — because this exact shape is also the standard shape of a rug, and $PawPatrol is the proof.
Two headline numbers in the first version of this file were wrong: the size of the creation-block cluster, and which group $PawPatrol belonged to. Both came from the same class of mistake — reading a convenient signal instead of the authoritative one.
Tokens were mapped to operators by looking at which wallets they had in common. That linked $PawPatrol to an operator whose funding had stopped a day before $PawPatrol existed. A missing edge announces itself; a wrong one propagates silently into every number downstream. The detection costs nothing: a funder's activity window must contain the token's creation time. That one assertion kills the false link with no extra data. The mapper now has no inference fallback at all — it returns nothing rather than a guess.
Eight further rules came out of the same session, each attached to the specific wrong answer that produced it, in METHOD-RULES.md. The ones that changed numbers on this page: never name a funder from a signature walk that did not reach genesis; a failed read is UNKNOWN, never zero; verify an action from its own transaction receipt rather than a follow-up balance query; measure forward-looking statistics strictly forward of the decision point; and treat missing data as missing rather than as absence of value.
And R9, which is why the $PawPatrol correction happened at all: structural evidence outranks a single weak link. The chart shape, a six-transaction bonding curve against $CATALORIAN's 305, and a deployer funded with 195.8 SOL against 0.203 all said "different scheme". One weak wallet edge said otherwise, and the edge was the thing that was wrong.