BALD memecoin investigation: scam developer’s identity finally discovered?

Ah, August! The long-awaited return of the vacations, a quiet market that lets you get away from the screens and enjoy the fine weather, but also a time that’s conducive to memecoin party.

The start of the month was characterized by a Dantesque performance of several million percent and then the rugpull à 20 million dollars token BALD on Base, the brand new Layer 2 launched by CoinBase. Much mysticism and theorizing ensued when our beloved data archaeologists discovered that the token’s issuer had interacted with one of CoinBase’s wallets in the past.Alameda Researchthe famous trading company launched by Sam Bankman-Fried and collapsed with the fall of FTX.

With the fuse lit, it didn’t take long for the Twitter begins to accuse Sam Bankman Fried (SBF), in prison at the time of writingof being behind this umpteenth scam. Here’s a look back at all the events in this crazy story, which also offers us some juicy details about the potential involvement of key figures in the crypto space.

History of events

From $500 to over a million overnight

The story begins on July 30 with a post that resonates in every corner of X, cheatcoiner.eth, which announced the day before that it had purchased the token $BALD a few minutes after it had been deployed, woke up to discover that it had literally flown off to the far reaches of the universe overnight, he is now a millionaire.

A beautiful story of moonboy as we like them, but which is already putting the flea in the ear of many independent researchers, because contrary to the majority of the shitcoinsthe token deployer has deposited hundreds of ETH to support LeetSwap’s liquidity pool. As millions begin to cross the one-way Ethereum bridge at Base to join the party, the first discoveries began to arrive.

Inside trading from CoinBase?

On the same day, a few curious people began to scrutinize the wallet of the token’s developer and discover that he is the holder of the majority of cbETHthe token of Liquid Staking from Coinbase. This directly feeds the theories accusing insiders of Coinbase to be behind it. An alleged strategy used to promote their new Layer 2 by attracting liquidity, when temporarily blocked on the latter, until the implementation of a bridge to Ethereum.

This theory was partially dismissed the following day, thanks to the Head of Research at Wintermutewho discovered that this wallet had not minted directly the cbETH with Coinbasebut had bought them on UniSwap.

In any case, the financial power of the developer remains highly suspect, especially on its importance in the trading volumes and governance of several DEX and deposits for CEX for several hundreds of millions of dollars.

>> Prefer to keep your cryptos safe? Choose a Ledger wallet (commercial link) >>;

Less than 48 hours after launch, token issuer empties liquidity pool

The FUD showing its face on July 30 and 31, after simulating large purchases on the token, the developer withdrew all the liquidity initially providedresulting in a gain of over 3,000 ETH, or about 6 million.

The latter defended himself in a tweet, claiming that he had not sold any tokenbefore being caught by a user reminding him that technically, when the price goes up, the tokens BALD are sold for ETH. Tweet to which he responds with a brief « correct », like a famous antagonist well known in our landsSBF.

The token deployer irrevocably linked to Alameda Research, but not only…

With the discovery of joint deposit accounts with a number of centralized exchanges, analysts subsequently found several other portfolios unmistakably linked to the developer. This is how we discover an account that once sat in the place of top traders on protocol DYDX v3, then a second, who turns out to be one of the oldest participants in the governance of SushiSwap. Even more curious, Alameda Research seems to be directly linked to the latter, as well as toAndew Keysex-Head of Business Development at Consensys.

And since Alameda will never cease to amaze us, even though it doesn’t appear in Nansen’s report on the depeg from UST, the address 0x000F7 seems to have been involved in its triggering with several tens of millions of dollars volume, notably through arbitration transactions between Curve, Binance and FTX.

What if we’ve got the wrong Sam?

Neither one nor two, Twitter, or rather XThanos has just passed through the portal of the multiverse. « SBF is back «  reads the English-language CT. A treasure hunt ensues to find all the little details that would betray his personality, and even if it seems far-fetched, it’s true that their accumulation begins to raise serious doubts about his personality. the developer’s identity.

Also, it didn’t take long for our detectives to make the connection with an old tweet from ZackXBT which announced that the former Seruma DEX Solana created by FTX and Alamedawas renamed in « 0xLukaEth a few months after their fall. An account that, of course, gave its all to promoting the $BALD token as soon as it’s launched!

But for Igor Igamberdievquoted above, believes that SBF would be too easy a conclusion. According to its temporal analysis of the activity of accounts linked to the developer of the token, Sam Trabucco seems a much better candidate.

Their activities would correspond quite precisely to his decision to resign as co-CEO. He also notes timings highly correlated with Trabuccoand wallet activity linked to Alamedaparticularly on their involvement in Stargate Finance.

>> Security is the basis! To keep your cryptos close to you, trust Ledger (commercial link) <<

After theories, real answers

And that’s an understatement, but even if you think you’ve come full circle, I assure you that this story is far from over. The search on-chain being one of my specialties, although I most often confine myself to my own heart blockchain, I’ve decided to go beyond its boundaries to bring you, I hope, the end of the story. It’s here that we leave observation behind, and plunge into the world of blockchain. the heart of the investigation.

Cheatcoiner.eth, a pseudonym rightly worn?

This is the first point that ticked me off, as his story seemed to be much more of ainside trading a helping hand from cosmic will. He proudly announced that he had bought around 500 USD of $BALD under $50,000 of market capand yet no purchase seems to match.

Moreover, his Ethereum Name Serviceof which he has proved ownership, does not show no bridge to Base on this date, nor the accounts linked to it. Our dear influencer in « cheat « coin having clamped funds only long after the rugpull finished, on August 4. Also, no link that could link it in any way to the developer of the token shows his nose by peeling his wallet.

On the other hand X (aka the best feature ever developed on a social network) will tell us that his freshly renamed account bears the stigmata of an old scammer who worked on Solana. An allegation he would deny, saying simply that the account had been purchased. So it was all in the name? Not so sure.

What about potential? insiders who bought only a few minutes after the token was deployed?

Breadscrumb or any other data analysis tool not yet implemented on Base, I investigated on my own, thanks to the two best friends of the data analyst in the making, Python and the public API ! It was at this point that I began to doubt the summary analysis presented above, yet another example that data on-chain, can easily bias us when they are incomplete.

In fact, if we cross-reference the data of all buyers below fifty thousand dollars in market capitalization, we discover partitioned purchases of 615 dollars then re-centralized funds once the tokens sold! Which might fit in with the narrative of Cheatcoiner.eth. If it really is him, he has left us a few traces, perhaps even a name via his address on theEthereum.

But I’m keeping this part in reserve, as I can only link it to an account X protected and cannot be linked to crypto space, given the limited information we can find. Let’s get to the heart of the matter.

So, SBF or not SBF?

Fasten your seatbelts, because there’s a lot to talk about! (Feel free to open the graph in a second window for better visibility via the link in the caption)

The first thing to note are the two central pivots of the graph, i.e. the count « Bald Deployer and « Bald 2 ». As mentioned above, the latter share (at least) three deposit accounts on CEX. Two on FTX and one on Binancewhich leaves no doubt as to their common affiliations. The branded account « Bald2«  received funds fromAlamedawith whom he also shares two other deposit accounts at Huobi and FTX.

Then, in a very surprising development that I haven’t seen mentioned anywhere so far, the account « FTX Deposit 2 » seems to have been fed by Richard HeartCEO of the $HEX token and blockchain PulseChainagainst which the SEC recently lodged a complaint. But also 69secrets.ethaddress linked to Mirana Venturesan investment fund severely affected by the fall of Three Arrows Capitaland known antagonist to some rugpulls and drama in recent years, such as reveals Nansen. Almost one million ETH sent by only four addresses passed through a smart-contract, before arriving in the famous wallet deposit FTXwhose operation is reminiscent of a simple relay. When it receives a transaction, the same amount is sent directly to another address.

Despite this, caution is still called for, even if the risk of misinterpretation seems low. It should also be noted that the dozen or so accounts displayed represent only a fraction of the total. tiny fraction of the funds transferred by this smart-contractwhich includes several hundreds of output addresses. However, it remains a minority of the total volume received by the account. « FTX Deposit 2most of which comes from centralized exchanges and the two accounts of the developer of the $BALD.

On the right, you can now see the labelled account « Aaron Henshaw Funded »who is none other than the Head of Engineering at Coinbase Cloud who originally sent funds to this address and therefore probably created the wallet. Followed by (in chronological order) Nanexcool.eththe Head of Smart-Contract at MakerDAO, Shiv MalikCEO of Pool Dataan address linked to Helena « @helsfoftroy »Co-Founder ofETH Berlin and other people more or less known anonymously on X.

That’s a lot of people!

The account « Bald2 » will regularly send ETH to this address, and even with a little « GM » hidden in the transaction data. We also note a transaction sent in March to the « Cat in a box » a protocol for lending in which he is financially involved, yet their account X had claimed to have no connection with him after the accusations ofIgor Igamberdievcertainly based solely on mentions on social networks. So it seems to have a closer link than it advertises.

Finally, the part that will interest us most is the address « Milkyway16.eth » which shares a deposit account Coinbase with one of the depositors of « FTX Deposit 2, revealing a direct link between the developer and this address. Other elements support this thesis, such as transactions to Parsec Financea tool on-chain which seems to correspond to a subscription renewal on different, complementary dates. As well as two payments of identical amounts to the artist NFT Veenyard.eth at dates very close in common with the account « DYDX Top Farmer.

And then, bingo! Shortly afterwards, a X reveals that he made a bet with MilkyWay16.ethwhich was paid from the account « DYDX Top Trader as underlined by ZackXBT in this tweet. (A little bitter that I didn’t get first dibs on the discovery, I admit ^^)

Checkmate.

Bald Deployer = MilkyWay16.eth

The manhunt

Since this revelation, which has remained rather discreet in the French-speaking world, a real manhunt has begun for the identity of MilkyWay16.eth. A good opportunity to learnOSINT, Unfortunately, for obvious reasons, I can’t show you all the results. Investigation is a captivating practice, but that doesn’t mean our space has to become a potentially dangerous public tribunal.

Just know that a few of us have his name, his nationality, names of people he worked with, and although they seem to be close to many crypto and Twitter, to the best of my knowledge, his real identity as well as his potential links with Alameda or FTX have yet to be found. So he doesn’t seem to be anyone publicly known other than through his account. X, MilkyWay16ethbut rather an actor who has always acted more or less in the shadows.

Nevertheless, the mind mapping intensif allowed me to find a lot of other information that is interesting to reveal on the crypto side. In particular a public message directly exchanged with SBFon the portfolio in which the latter had recovered the property from smarts-contracts by SushiSwap.

But also older discussions Twitter visit Sam Trabucco and Milkyway16ethrevealing an old pseudonym, « vallard14 »the gateway to his identity.

And last but not least, a message sent to the wallet having drained the accounts of FTX in November just after the empire crash SBFmessage sent only forty minutes after the first drainage transactions began, revealing a very well-informed person!

Meanwhile…

While brains were spinning at full speed to find the darkest corners of this story, which I’m sure still hasn’t finished surprising us, Bald’s deployer, after stealing millions of dollars, posts the following tweet.

He seems to have no desire to stop the adventure, and is waiting for a DEX of good reputation to boost pool which, a few hours earlier, had been shut down by LeetSwap due to potential flaws, for the same reasons as the Curve pool hack. Scammer one day, scammer but the most unexpected is SushiSwap’s response, TWO minutes later, to finish off the most gullible in the back of the class.

Not unlike the earlier setbacks of Chief Nomithe original developer of the protocol who had bequeathed the keys to the Japanese restaurant to SBF, after using techniques more than similar to the rugpull which we’re talking about today. Chief Nomi which, incidentally, was already the subject of all kinds of theories, some thinking that SBF and he were in fact one and the same, a theory echoed by our colleagues at CoinBureau at the time.

Satoshi, let’s go home, it’s starting to rain

If we already knew that our space was plagued by dubious actors, this story shows us that the reality may be even worse. Whether malevolent as much as falsely or genuinely benevolent, many seem to revel in the mediocrity of others and that all rub shoulders, without saying a word, even though they’re probably aware of their damaging actions to the whole ecosystem. But that’s probably a good thing after all: if our ecosystem is still so immature, it’s because technology is far from reaching its full potential, which will hopefully leave us another Bull Run or two to weed out the bad seed.

Always eager for self-deprecation, we’ll probably keep repeating one of our other favorite mantras to ourselves, « we really deserve this bear market »with the hope that time will eventually resolve these anomalies of its own accord. I remain convinced, however, that our crypto-verse won’t clean itself up, and that it’s high time we went to war, with data as our only weapon.

In crypto, don’t cut corners! So, to keep your cryptographic assets safe, the best solution is still a personal hardware wallet. At Ledgerthere’s something for every profile and every crypto. Don’t wait to secure your capital (commercial link)!