Two Ethereum Scam Schemes Exposed

I build DexMarketCap, a DEX analytics tool with a wallet tracker. The part that matters for this story is how the PnL works: instead of computing a wallet's profit when someone opens it, we keep the realized and unrealized PnL of every wallet and every token pre-aggregated in the database, updated live with each swap. That is what makes a wallet page load instantly. It also had a side effect I did not plan for: it gave us a view over every wallet trading on Uniswap at once.

So we sorted by success rate. A few wallets had a near-perfect record, hundreds of tokens, hundreds of wins, zero losses. Nobody trades like that. We dug into the data behind those wallets and found a rug-farm: an operation that has launched and rugged more than 900 tokens since July 2026 and paid one insider wallet about $800,000. On the way we also ran into a second scheme, a token that plants fake balances in 219,000 wallets to lure their owners in. Here is the data, address by address, and at the end a checklist you can run in two minutes before buying any token.

Every number below comes from our own indexed swap, liquidity and holder data, cross-checked against the public GoPlus security API, as of 24 October 2026.

The wallet that never loses

The wallet that stood out most is 0x3e88a2ec0f332a9053de55a32cb6835ef11a3faf. Since 16 July 2026 it has traded 945 different tokens: 915 wins, 0 losses, $796,655 realized profit on $1.96 million of volume. Every position is the same shape: one buy, one sell, same day, and the token is dead shortly after. Of its 667 closed positions, 554 ended in a rug pull. It is not a good trader. It is an insider of a factory that launches a token, lets the insider buy first, lets the public pile in, lets the insider sell, and then pulls the liquidity. Our wallet safety check tags it rug-farm for exactly this reason: view the wallet.

Following the tokens. The 945 tokens look unrelated. Every one has a fresh deployer wallet used once, a verified contract, no taxes, no blacklist, no mint function, and a clean GoPlus audit. The link between them is the liquidity: in every token we checked, 100% of the Uniswap V2 LP tokens sit in the same contract, 0xf38521f130fccf29db1961597bc5d2b60f995f85, unlocked. That contract is the factory's hand on the rug.

Token	Deployer wallet (used once)	LP held by 0xf385…	Insider profit
LEMONBOB (lemonbob)	0x2e3a2b4909b9d02d624359eb70e5a88ee8e1c5c8	100%	$2,634
MANA	0x481a4d42cb11f751a1d648fd403227e37c2f0818	100%	$2,943
WindChill (The Coge)	0xeba5ed22b976584c0ac144c63b09fb97ebdd3caa	100%	$2,633
SXSI (SpaceXSI)	0xa35a20b8874a8555bc50d620ab09e8ce773b8255	100%	$2,590
JEANPHIL (Jean Phil)	0xd568117b5a3d2579f25cf0049f1c60f664d9f854	100%	$2,449
LOOP (Loop)	0x3ee5ec7f475a7c42f6d2772ad37a92eed2776af0	100%	$2,340
Kimchi (Aura Final Boss)	0x3fa89283471165317a19ccc161b94b6f4501a05d	100%	$2,338
Noiz	0xae47227e72fcf1f9ef4778cf05ddfdd73591cc36	100%	$2,332
NEEGY (Neegy)	0x62898e23083f3372176865d61183cc6551566ddc	100%	$2,287

How one launch plays out. LEMONBOB, 1 August 2026, is typical:

1. A one-time wallet deploys the token and adds the liquidity. The LP tokens go to the factory contract.
2. The insider wallet buys 117.9 million LEMONBOB for $552.80 in the first minutes.
3. Retail buyers arrive. The token ends up with about 39 holders, the same count as every other token in the farm.
4. 324 seconds after its buy, the insider sells 106.1 million tokens for $3,132. Profit: $2,634, a 477% return in five minutes.
5. The factory removes the liquidity. The token is dead; DexMarketCap marks it rug. Every buyer who was not the insider is left holding nothing.

The same script ran 945 times in three months, on average about ten launches a day, each netting the insider $2,000 to $3,000. The names change every time: MANA, Official Trump Coin, Uber Driver, Hedge Fund, Titcoin, The Gamestop Bull. The contract holding the LP does not.

The second scheme: airdrop bait with 219,000 fake holders

The second scheme surfaced from the holder data, not the PnL. "Privacy Coin" (PVC), contract 0x514b9e5467b9eb811519e316263c9099eae546ca, exists to appear in your wallet. Its declared total supply is 21 million tokens. Yet the balances it reports across 219,233 wallets add up to 219 billion tokens, more than 10,000 times the supply. The contract hands out tokens it does not have. At the pool price of $0.00129 each, a typical planted balance of about one million tokens shows up as roughly $1,300 of free money in a portfolio app. That is the hook: the victim goes looking for a way to sell it, and either buys more to "unlock" it, or lands on a phishing site that drains the wallet. See the pool.

The real token is tiny and fully controlled:

• The only market is one Uniswap V2 pool, PVC/WETH at 0x2a77ccf28ca71f5339ee18e88f2b1bb57850bba8, holding about $16,600, created 11 December 2025.
• One wallet, 0xdbc6c48b59112123bc1a771d0d03ba1b5069ecf6, holds 80% of the real supply and 100% of the LP tokens, unlocked. It can empty the pool in one transaction.
• The contract source is not verified, so nobody can read what the transfer function actually does.
• Trading is near zero: about 250 five-minute candles in ten months and no trade in the last 24 hours. DexScreener does not list the pair at all, and honeypot.is has never been able to simulate a sell on it.

The fake balances are what make this scheme dangerous rather than merely worthless. A normal rug costs you what you chose to buy. This one is designed to make 219,000 people who never bought anything come to it.

Before you buy any token: a two-minute checklist

Both schemes fail the same handful of checks. None of them needs a paid tool.

1. Who holds the liquidity? Open the token's security report (GoPlus, or the audit panel on the DexMarketCap pool page) and look at the LP holders. If one address holds close to 100% of the LP and it is not locked or burned, the owner can pull the rug at any moment. Both PVC and every rug-farm token fail here.
2. Who holds the supply? If one non-exchange wallet holds more than about 20% of the circulating supply, it decides the price, not the market. PVC's owner holds 80%.
3. Is the contract verified? Unverified source means nobody, including the audit APIs, knows what a transfer or sell really does. Treat it as a no.
4. Does the holder count make sense? Total balances must add up to the supply. A token in hundreds of thousands of wallets with no trading volume is an airdrop, and an airdrop you did not sign up for is bait. Never interact with it, never approve it, never visit a site it links to. Just hide it.
5. Who made the first trades? Open the earliest buyers in the wallet tracker. A wallet with hundreds of tokens, a near-100% win rate and no losses is an insider. If it bought in the first block, you are the exit liquidity.
6. Has the deployer done this before? A deployer wallet used exactly once, funded minutes before launch, is the signature of a factory. Legitimate teams have history.
7. Can anyone actually sell? Look for sells by several different wallets in the trade list, not just the deployer. DexMarketCap only clears a honeypot flag after three or more distinct wallets have sold in the last 24 hours.
8. Size the bet to the worst case. On a token under a day old with under $50,000 of liquidity, assume the money is gone the moment you buy. If that is unacceptable, do not buy.

What the tool does with this

Finding a scheme once is a blog post. Catching the next one is the product. Everything above is now a check that runs automatically on every token and wallet DexMarketCap indexes, so the warning is on the page before you read the chart. It is free to use.

• Risk tags on every token. Each token is judged from its own on-chain history, not only from third-party audits. rug means the liquidity was pulled. dump means the pool was drained by sells. honeypot means independent audits say it cannot be sold, and the tag is cleared only when real sells from several wallets prove otherwise. dead means the market is gone. All 945 rug-farm tokens carry the tag.
• Wallet tracker with scam labels. Open any address and see its full trade history, win rate, realized and unrealized profit. A wallet that profits from rug pulls again and again is labelled rug-farm, as 0x3e88… is. Check the first buyers of any new token the same way: wallet tracker.
• Bubble chart of holders. The holder map shows who owns what and how wallets are connected. A token whose supply sits in one bubble, or whose holders are all one cluster, is a controlled market: bubble chart.
• Security audit on the pool page. LP holders and their share, supply concentration, verified source, taxes, blacklist and mint functions, straight from GoPlus and honeypot.is, next to the chart.
• Report a scam. Every pool page has a scam report that bundles the evidence (the tokens a wallet exited, the LP contract behind them, the linked wallets) so you can share it in one link.

If you trade new tokens, open the token on DexMarketCap before you open the swap.

Addresses in this article

All on Ethereum mainnet. Do not send funds to, approve, or interact with any of them.

Role	Address	Scheme
Insider wallet, 945 tokens, 554 rug exits	0x3e88a2ec0f332a9053de55a32cb6835ef11a3faf	Rug farm
Contract holding 100% of the LP of every farm token	0xf38521f130fccf29db1961597bc5d2b60f995f85	Rug farm
LEMONBOB token	0xea990b4ea53dfbdbe763309401e4ea55aa62aa44	Rug farm
LEMONBOB deployer	0x2e3a2b4909b9d02d624359eb70e5a88ee8e1c5c8	Rug farm
MANA token	0x806d575a0eb563a87a0600a58ffdb4892a4e5d58	Rug farm
WindChill token	0x12c774d8ab53a77deca8fe972986876cf7c65470	Rug farm
SXSI token	0x39eddb8d3ee90100291970cd58c46818861383a6	Rug farm
JEANPHIL token	0xf94c1017263edd73fbb2e13441b451fd67213db5	Rug farm
LOOP token	0xb79ca08f0285cbb892563af0f1617050d87a0394	Rug farm
Kimchi token	0xe431c13450baacfa3bc0e18f765799cd1c493f83	Rug farm
Noiz token	0xd4a2537f8aa22447d08778b00bb8f3f65c324406	Rug farm
NEEGY token	0x520b3d7578bc5e5bb7d182a229f5c4ae6080f4e2	Rug farm
PVC "Privacy Coin" token (unverified)	0x514b9e5467b9eb811519e316263c9099eae546ca	Airdrop bait
PVC/WETH Uniswap V2 pool	0x2a77ccf28ca71f5339ee18e88f2b1bb57850bba8	Airdrop bait
PVC owner: 80% of supply, 100% of LP	0xdbc6c48b59112123bc1a771d0d03ba1b5069ecf6	Airdrop bait
PVC contract creator	0x4202c46507510dcd89dbe0c64a49a7a2a47d0254	Airdrop bait

Sources: DexMarketCap indexed swap, liquidity and holder data; GoPlus token security API; honeypot.is. Figures as of 24 October 2026.