On surface level, this token uses completely fresh execution wallets intentionally rotated to avoid basic screening. However, a deep forensic query extracting all routing participants across the last 50 transactions reveals identical infrastructure to Rug #2. The exact wallet used to extract $75,000 in Rug #2 is physically bridging transactions on this token.
Checking the primary signature address on transactions shows no overlap with the main 137 master nodes. The operator has successfully rotated wallets on the surface. But analyzing the underlying message internal accounts—the routers, token accounts, and bridges participating during execution—blows their cover immediately.
| Underlying Account Used | Role Confirmed via Deep Trace |
|---|---|
| HLnpSz9h2S4hiLQ43rnSD9XkcUThA7B8hQMKmDaiTLcC | RUG #2 EXTRACTOR WALLET — Captured the 478 SOL withdraw |
| BQ72nSv9f3PRyRKCBnHLVrerrv37CYTHm5h3s9VSGQDV | Shared Routing Node |
| GGztQqQ6pCPaJQnNpXBgELr5cs3WwDakRbh1iEMzjgSJ | Shared Routing Node |
| 3rmHSu74h1ZcmAisVcWerTCiRDQbUrBKmcwptYGjHfet | Shared Routing Node |
| cpamdpZCGKUy5JxQXB4dcpGPiikHawvSWAd6mEn1sGG | Shared Routing Node |
Fresh, unrecorded wallets executing the trades. These will not flag as RING participants natively, but their transactions route via the matched extractor nodes above.