Event background

At 2 pm UTC time on October 23, SHAR[1] performed in a dramatic way debut, its price soared from the opening price of $0.00056 to $0.05986, and its market value soared to $60 million in just one hour, an increase of nearly 100 times. In the next few hours, negative news about the SHAR team[2] began to emerge, with some pushers accusing it of manipulating KOLs to attract investment. Due to negative public opinion, the price of SHAR fell to $0.02393 in the next three hours, and the market value dropped to less than half of its high point. But despite the negative news, many buyers believe it will not have a major impact on the SHAR project, as some well-known KOLs continued to buy in large quantities at low prices and expressed optimism about SHAR’s future. From 6 to 8 pm on October 23, the price of the token gradually rose back to $0.042.

At 9:26 pm UTC on October 23, address CHj3[3] initiated a transaction[4] to transfer 500 million SHAR tokens (approximately 50% of the total supply) was exchanged for 19,619 WSOL, almost depleting the liquidity pool. This operation caused the price of SHAR to plummet to $0.0013 within a minute, the market value dropped to $3 million, and investors suffered a sell-off.

Using MetaSleuth, you can clearly track the capital flow in this incident and reveal some valuable clues. Two or three days before the crash, that is, between October 20 and October 22, the perpetrator of this incident (the entity controlling address CHj3[5]) withdrew a total of 6,045 SOL from four exchanges. . The four exchanges are Binance 2[6]2595 SOL, KuCoin[7]950 SOL, MEXC 1[8]580 SOL, and OKX 1[9]1920 SOL. The extracted SOL was assigned to 14 addresses, and these 14 addresses were all controlled by the perpetrators of the crash.

The implementer achieved two purposes through these addresses: artificially raising the price of SHAR tokens, and hoarding a large amount of SHAR tokens to prepare for the eventual crash. Prepare.

The following is the flow chart of funds from four exchanges to these 14 addresses:

At 2pm UTC on October 23, within two minutes of SHAR going online, these 14 addresses exchanged all their SOL holdings for SHAR tokens. This move injected a large amount of value into the liquidity pool , and quickly pushed up the price of SHAR. Here are some of the transactions used by these 14 addresses to purchase SHAR: Q81H[1. 0], 4Jxa[11], 5q5n[12], 3xvB[13]. Over the next half hour, the implementer transferred all SHAR held in these 14 addresses to 104 other addresses under its control, To further disperse these tokens. Below is a chart of the SHAR allocation funds for 4 of these 14 addresses.

This decentralization strategy makes it appear that no single address holds a large amount of SHAR tokens from the on-chain data, thus reducing external concerns about the security of SHAR assets. However, it is clear through the analysis of fund flows It was discovered that although these large amounts of SHAR tokens were dispersed to multiple addresses, they were ultimately owned by the same Controlled by one entity (the implementer). The implementer retains the ability to dump all of these SHAR tokens at any time, thereby extracting potential value from the liquidity pool, indicating that there are significant security risks with this centralized control and decentralization of SHAR tokens. The disguised model not only exacerbates the opacity of the market, but also directly threatens the financial security of investors.

Ultimately, as the SHAR price rose, the implementer seized the opportunity to sell. At 9:25 pm UTC on October 23, the implementer transferred all SHAR tokens in the 104 addresses it controlled And concentrated to the address CHj3[14]. Just one minute later, the address CHj3 initiated a transaction[15], selling the accumulated 500 million SHAR tokens at one time, which almost exhausted the SOL in the liquidity pool. store As a result, the implementer obtained 19,619 SOL tokens, worth approximately US$4.2 million. At 9:26 pm on October 23, all users who still held SHAR became victims of this smashing, and their holdings were reduced. SH The value of AR plummeted to one-tenth of its original value in just one minute. Here is a picture of the flow of funds that showed some SHAR tokens being concentrated (from 104 addresses) to the address CHj3 and subsequently sold to the liquidity pool. .

In order to track how the perpetrators cashed in the 19,619 illegally obtained SOL, we continue to track the flow of these 19,619 funds. SOLs are reserved at address CHj3[16]For nearly a week, until 4:21 pm UTC on October 29, the implementer initiated two transactions (ajqYwt[17] and 3uD6Ys[18]) to transfer 6,000 SOL to another address under its control, J7aV[19 ]. Over the next 20 minutes, the implementer deposited 6,000 SOL into the OKX[22] exchange through two additional transactions (5STJND[20] and 3z6C72[21]). Subsequently, at 7:52 pm UTC time on the same day, another 5,000 SOL was transferred [23] to the address J1wF [24], and transferred to the OKX [26] exchange through transaction [25] at 7:53 pm. Between November 4 and November 10, the implementer gradually exchanged the remaining 8,600 SOL in address CHj3 for USDC and USDT. The following is a list of all swap transactions: 2rGGMf[27], 5cWJte[28], 4AE6z7[29], 5HovYa[30], 4Da6zR[31], 5P9rmx[32], 5AAHn1[33], 5nm1Xy[34], Mn3Rxa[ 35]. As of 8:30 a.m. UTC on November 14, 2023, the USD 1.41 million USDC and USD 168,000 USDT obtained by the implementer through the exchange still remain in the address CHj3. In addition, approximately 19 SOL remain in the CHj3 address that have not yet been redeemed. Below is a fund flow chart for all swap transactions (left) and deposits into OKX (right).

Smashing address: CHj3vHyMhF6DF3VkwhzgK833o7uvsN7CrPVyUdmbFo5E.

14 addresses controlled by sellers that bought large amounts of SHAR at low prices at the opening:

•E78TudQEcPwqiwnJ5HYEjJzogKPVAHGcLx7YRonxMuU3•5Cyg8Y4jEKKgna8Pf4xVXWLtNRZmJQksU23p1GyKnToU•EzHJnPZ83RKvXzGDZLtfgoEBWoVjLEe tMHFos2XcES6g•5rXZD1pZjJqSLCNRSxhn3MQLvRQUQB5nDD1Gf8nNXjT3•5MMdwsfXXcZNpK95mHFTtYz8K7JQ3JcboRNAimH61suC•DZnhX2VG7LKLvfB747DgAmahGBdARevBfeTM4K1p1Rz7•BnCFNcGHh6pMZXgHUHJi4a82Vfo2Xtcw818b9FNMU49P•75fXUzEqjNeBtqhXzjAbVKa84AcfnvG 59nMUnvb3SXUx•DEGdacTknp6BSYQc6fhJdfq9dZNZM3T4NBTSt8jnkygA•H6x6k37wSe7ZBUct4eHyHn6W1o2TTXfAy2z9W yvUNLpZ•Bhx3ZqViaRA4ZbXapro4VakYuS5bwhu2rc4cS8Dog1cy•RSaAciLFtxDVtBH3awdnrjrDmcGUQBjYTon2FPRpCJG •3UtiQzi1HGH7sEg28T1sZpeQPLAb4m6Hive2cW6CV9XR•86DrFintdQt5w7jyJjobFQ5hVU63rbneYnDfkqC9xAbL

Transactions cashed out via OKX1 (5VCwKtCXgCJ6kit5FybXjvriW3xELsFDhYrPSqtJNmcD):

•5STJNDbQBMbigzHf6mzCrtiM6s8QJjpQazzu5j7zC61uBB46V9NkumCw8UwWHXg7Yxp omAFN664PnxHYMAU353q2•3z6C72fm6VVGdkFW3VcpjTccq725ZuVWpcZJv3GM3DBp3D3oLVjq2 nyaRDhNZbmG95fi9cTTZfZ8bT22rdXjdEfR·64wMUp3VFz7pxZEpZak9uXAPfbEMBDiTWUGZLgE CLn8fSMPexuR5ifRqJTSTpe98ELzRG676Pfe9xoXmG9DreiG1

104 addresses controlled by the implementer for decentralizing SHAR, and obtaining SOL through four exchanges for smashing Trading, as well as other detailed fund flow information, can be explored in MetaSleuth.

Explore more details and discover valuable clues now: https://metasleuth.io/result/solana/CHj3vHyMhF6DF3VkwhzgK833o7uvsN7CrPVyUdmbFo5E?source=5e4fca36-208b-4714-afb3-0800d5355323[36].