On-chain Tracking of Meme 'Token Factory': Clearing in 3 Seconds, Millions of Dollars Flowing In and Out

36 wallets transferred funds in the same second, revealing the script flaws behind the Meme coin harvesting network.

Written by: @the_smart_ape

Compiled by: AididiaoJP, Foresight News

One wallet holds $1,026,800 USDC and has never made a transaction. Its funds come from two aggregation wallets, which are continuously funded by 32 token issuance wallets. Tracing the funding chain upwards, I discovered a conspiracy group of 43 wallets involved in Meme coin operations: bulk token issuance, bundled purchases in the same block, dumping within seconds, and then layering profits into aggregation wallets.

Since January 2026, this conspiracy group has issued over 6,855 Meme coins on Pump.fun and continues to do so.

Starting from Meme Coin Fun

The clue starts from fun, with the contract address: 7nRtEVneLhdc4L4dHyiExoSZoSMJx9VEBTr7wbmDpump.

On October 22, fun went live, and the token was issued 8 seconds after a tweet. The issuer bought in, and three other wallets followed suit in the same block. Four seconds later, the issuer cleared their position.

Unusually, this coin did not immediately drop to zero. Ten minutes later, its market cap was about $150,000.

The issuer and their bundled wallets made a profit of 13.6 SOL on this coin. They had already exited before the coin took off.

So I investigated who this issuer was, tracing the funds downwards. The money first went into an aggregation wallet, then converted to USDC, and deposited into a wallet holding a million dollars. Behind that wallet, there are still 31 token issuance wallets continuously funding.

43 Wallets, Clearly Defined Roles

The structure of this network is:

• 43 wallets: 32 token issuance wallets, 8 transit wallets, 3 bundled wallets;
• Over 6,855 Meme coins issued since January 2026;
• 2 aggregation wallets;
• 1 sediment wallet: holding $1,026,800 USDC, untouched to date.

The rhythm of token issuance has also changed. Before June, about 30 wallets issued tokens simultaneously; after July, only one issuer was used at a time. The current issuer is called DRXPafDu, who has issued 1,118 coins from September 9 until now.

Five Steps to Issue a Token

The process for each token issuance is almost identical:

1. The issuer creates the token and buys 10% to 15% of the supply in the same transaction.
2. In the same block, three other wallets in the network follow with purchases.
3. External buyers enter: sniper bots, follow bots, and those who think they bought in early.
4. The issuer clears their position. Median time: 3 seconds.
5. Profits first go to the aggregation wallet, then into the sediment wallet.

Bundling is not random. I checked 160 token issuances, and all 461 bundled purchases were concentrated in the token issuance block. Among them, 90% followed immediately after the transaction creation, ranking in the 1st, 2nd, and 3rd positions; none appeared in later blocks.

This indicates that the token issuance and the three follow-up purchases were sent out together, leaving external buyers no chance to squeeze in.

The issuer does not wait either. The current issuer has issued coins 693 times, with 88% sold out within 5 seconds.

Follow-up Wallets, Interconnected

What surprised me the most is that the three wallets buying after the issuer are not newly created. They are other token issuance wallets within the same network.

For example, Wallet A issues a token, and Wallets B, C, and D buy in; when Wallet B issues a token, Wallets A, C, and E buy in again. One of the wallets, 3cCqweS8..., participated in the issuance of 8 different issuers.

This is not a group of retail investors coincidentally following; it is the same batch of wallets lifting each other, like an assembly line.

Ironclad Evidence of One Person Operating: 36 Wallets Transferring in the Same Block

Transferring money to the same place is not enough to prove it is the same person. What truly indicates the issue is the following.

On October 14 at 15:39:14, 36 wallets cleared their SOL in the same block into the aggregation wallet. Two minutes later, another wallet followed. Three minutes after the bulk transfer, the aggregation wallet transferred out $71,874 USDC to the sediment wallet.

It is hard to get 36 people to transfer in the same block; this can only be done by a script.

And it’s not just once. The aggregation wallet receives payments in batches, with the same batch of wallets appearing repeatedly on the same day.

On September 9 at 1:07 AM, the old issuer XXXX5JNG issued the 938th coin, making the last issuance. At 4:05 AM, a new aggregation wallet was funded. Six minutes later, the new issuer DRXPafDu completed the first issuance with three brand new bundled wallets.

Five days prior, XXXX5JNG had just transferred 247 SOL to this new issuer.

There is even more direct evidence: the issuer's first purchase, among hundreds of issuances, is precisely the same in token quantity. 110.9m tokens exchanged for 3.55 SOL appeared 966 times; 112.1m tokens exchanged for 3.56 SOL appeared 797 times. The same tool, the same configuration.

Sediment Wallet: Only Inflows, No Outflows

The sediment wallet address is:

8wZf1QPda7HeQQYPXebVu8HGEKcCoiSoT7KsuwYLWtFX

It is an ordinary wallet controlled by a single private key. Since May 9, there have been 188 transactions, all inflows, with 0 transactions signed by it. The real senders are only two: aggregation wallet #1 transferred in $742,271 USDC, and aggregation wallet #2 transferred in $284,539 USDC.

The first SOL of this sediment wallet came from a token issuance wallet in the network.

Who is Behind It? Only the Exchanges Know

I do not know.

This address has no KOLScan data, no .sol domain name, and no one has mentioned it on X. The wallets I traced were funded by KuCoin, Bybit, and Binance. Only these exchanges can match the address with real identities.

I also compared this token issuance network with nearly 1,000 known KOL wallets: no overlaps and no transfers.

Who is Paying

Every SOL the issuer withdraws comes from those who buy in after them.

Most of these coins drop to zero within seconds. Among the coins issued by the current issuer, about 3% will take off like fun. But even if they take off, the operator has already exited.

How to Avoid Becoming Their Exit Liquidity

• Open the token issuance block. If three wallets follow closely behind the issuer, that indicates bundled buying.
• Check the issuer's history. Issuing 50 coins in a day indicates this is a conspiracy group, not a project team.
• Check if the issuer has already sold out. In this network, selling only takes 3 seconds.
• Do not buy in the seconds before a coin issued by a continuous issuer goes live.

Address List

• Sediment Wallet: 8wZf1QPda7HeQQYPXebVu8HGEKcCoiSoT7KsuwYLWtFX
• Aggregation Wallet #1: DNmciAfumzbkNRxpPym5kiEsquD69JY3Nvj1T8nWGBqD
• Aggregation Wallet #2: Hu92NuUGb9XMKaaqQnBaDfUGph7PnVRmoAtiKpPDrKUu
• Current Issuer: DRXPafDunsHAMoo6hqyak9J5LfqT1MKBQEp5iUJMFvb7
• Old Issuer: XXXX5JNGhjPpQEsqcFChLtzv4V1HWyqUaW8tEwyjBfW

The current issuer is still issuing tokens.