A second suspected memecoin rug factory has been identified on Robinhood Chain, highlighting the security challenges facing the rapidly expanding Ethereum layer-2 network.
Blockchain security firm GoPlus said on Sept. 28 that it had linked hundreds of tokens launched on Robinhood Chain to a network of wallets responsible for more than $9 million in gross flows during the previous 30 days. The activity involved newly created wallets buying and selling tokens before sending proceeds through a series of related addresses into a common consolidation network.
According to CryptoSlate, the operation’s main consolidation wallet recorded about 3,589 ETH—approximately $9.49 million—in two-way flows across its latest 400 transactions as of Sept. 28. GoPlus stressed that this is a measure of total movement through the wallet, not a calculation of profits earned by the operators or losses suffered by investors.
How the suspected operation worked
GoPlus described a repeatable process. Operators would launch tokens built around popular narratives, distribute substantial amounts of supply across wallets with little or no prior transaction history, and sell through contracts including PonsV2Helper and UniversalRouter. ETH received from those sales then moved through smaller sweep wallets before reaching the broader consolidation cluster.
Using many apparently independent wallets can make a coordinated exit harder to recognize. Rather than one address selling a large position at once, dozens of wallets can sell in stages. The resulting activity may look like ordinary market participation, even though the proceeds eventually converge at related addresses.
GoPlus said the pattern differs from a classic rug pull, where liquidity is abruptly removed or holders are prevented from selling. In this case, the concern is the coordinated control of token supply and the way proceeds from one launch appear to be used to finance later launches. The token contracts may function normally while the wallet structure creates the risk.
That distinction is important for screening systems. Checking whether a contract contains malicious code would not necessarily reveal that a large share of supply is controlled by wallets linked to the same operation. Wallet warnings and analysis of supply concentration could therefore become relevant tools for users, trading interfaces and launch platforms.
Earlier investigation found $18.4 million across 53 launches
The GoPlus disclosure follows an investigation by on-chain researcher Wazz into another suspected serial-rug operation on Robinhood Chain. That group allegedly extracted around $18.43 million from at least 53 memecoin launches over approximately two months.
The earlier operation used a somewhat different wallet arrangement. Groups of between 70 and 200 wallets acquired significant portions of tokens soon after launch, and the clusters often held more than 70% of a token’s supply. Wazz also found connections between successive launches, including funds moving from one project into wallets used to seed another.
GoPlus said both operations shared several characteristics, including extensive use of Pons V2 infrastructure, large wallet groups that could conceal supply concentration, and capital moving from one launch to the next. However, the security firm said there was no evidence that the two clusters were controlled by the same operators.
The newer group relied more heavily on fresh wallets and later consolidation, while the Wazz-linked operation used larger clusters to gain early control of token supply. Their differences suggest that similar economics can be implemented through multiple wallet structures, making coordinated selling harder to distinguish from normal trading.
Rapid growth increases the potential reach
The suspected activity comes as Robinhood Chain expands quickly. The Ethereum layer-2 launched on July 1 and had surpassed $1.5 billion in total value locked as of the source report, based on DeFiLlama data. The network reached that level in less than 90 days.
Token Terminal estimates that Robinhood Chain generated about $50 million in revenue over roughly three months, indicating the scale of activity already taking place on the network. Robinhood also brings a potentially large distribution channel: the brokerage has 28.6 million funded customers and approximately $384 billion in assets.
An open, permissionless blockchain allows outside developers to deploy applications without Robinhood approving every contract. That openness can support rapid growth, but it also means abusive token operators may attempt to use the same ecosystem to reach users. As the network becomes more visible, the consequences of inadequate detection could grow as well.
The emergence of a second suspected rug factory increases pressure on wallets, launchpads and trading interfaces to identify related addresses, flag unusual concentration and warn users about potentially coordinated activity. The central challenge for Robinhood is maintaining the open environment that has helped the chain expand while limiting the ability of organized token operators to use its distribution layer to access retail capital.
Moneyiar market picture
Moneyiar market data at the stated times showed the following prices and moves:
- Solana (SOL): $121.026989553, up 3.59% over 24 hours and 6.91% over seven days, as of Sept. 25, 2026, at 22:04 +03:30.
- Monad (MON): $0.0259233891, up 3.26% over 24 hours and 3.03% over seven days, as of Sept. 25, 2026, at 22:03 +03:30.
- OriginTrail (TRAC): $0.3767661846, up 1.25% over 24 hours and 10.53% over seven days, as of Sept. 25, 2026, at 22:04 +03:30.
- ORDI: $4.6558457524, up 1.21% over 24 hours and 3.52% over seven days, as of Sept. 25, 2026, at 22:04 +03:30.
