ANTHILLAsk your own question
Crypto · 7 min read · easy read

Crypto Town: Who Gets Paid First, and What the Records Show

This is research, not financial or investment advice. Crypto is high risk.
Internet Archive See source for rights
Last checked 2026-10-23. Sentence check: 5 paragraphs passed, 10 repaired, 2 removed. Every number links to the exact quote. Read the full version

In short

Some people in crypto have taken money from others in a few repeatable ways. In a rug pull, the operator takes all the money out of a pool after buyers arrive. Investors are left holding tokens that no one will buy 40. In one study, 76% of the accounts checked were marked as fake or copy identities made to grab rewards meant for real users 21. Gotbit and related groups sold market manipulation as a service 7. The authors say prices often move before a big sell order, through arbitrage or front-running via Miner Extractable Value (MEV) 61. Regulators have acted. The SEC said five people hired ZM Quant and Gotbit to manipulate trading volumes 6. Market abuse rules in MiCAR have applied since 30 December 2024 17. Some legal questions are still being tested. A US appeals court agreed to throw out federal securities claims against Uniswap. It said a person who wrote smart contract code should not be liable for a third party's misuse of the platform 12. A South Korean court acquitted operator Jonber Kim, because prosecutors did not prove that investors bought tokens because they were misled by promotions 11. New York's Attorney General got permanent bans against four top promoters of the NovaTech/AWS Mining scheme. They must also pay money back to victims 69. Some of the newest evidence is from October 2026. The HAWK token fell 56.0% over one year as of 22 October 2026 51.

Early Tricks: The Pull-the-Rug Plan

In July 2017, a weak spot in a Parity wallet program led to a reportedly $30 million theft of ether 45. Later, a new Parity bug reportedly locked roughly $160 million worth of ether 45. In 2022, attackers stole over $3.8 billion in digital assets from smart contracts 43. This included bridges and DeFi protocols 43.

Rug pulls follow a simpler plan. The operator adds a liquidity pool, waits for buyers, then removes all the liquidity. Investors are left holding tokens with no market 40. Token makers can allow free token creation and keep large parts of the supply. This raises the risk of a rug pull 44. Smart contracts can be controlled by admin keys or super users. These users can change the contract on their own, and change how it sends digital assets 36.

Rug pulls are called exit scams 39. The developers or influencers who promote a smart contract or app can take investors' money and get away with it at an agreed time 39. A power can look shared and still be held by a few people 42. A small group of main members can change a contract alone 42.

Free Coins, Robot Helpers and Many Fake Accounts

One operator runs several accounts 24. Each account is used with DApps. The operator expects every account to get the airdrop 24. Airdrop projects often set rules first. Users must do some basic steps inside the DApp to qualify 28. Sybils mess with those steps to qualify their accounts 28.

The damage hits real users. Fake users can make an app look popular. But that activity comes from fake users, and it lowers the rewards that real users would get 26. In one analysis, 76% of the accounts checked were marked as fake or duplicate 21. DeFi developer Banteg found an estimated 701,544 Starknet addresses that were allegedly linked to repeat or renamed GitHub accounts run by airdrop farmers 25. Even so, the Starknet airdrop still included those farmer addresses 27.

Trading also leaves measurable footprints. A 2022 study of 2.77 million swaps across 14 tokens found that unusually large sell orders correlate with negative future token returns, while large buys correlate with positive returns 53. For large sell orders, much of the abnormal price return happened before the sell event, which the authors attribute to informed trading such as arbitrage or front-running through MEV 61. For individual tokens, the mean reassessment was up to 0.79% after large sells within one follow-up trade 57.

Fake Trading Heads to Court

In 2024, the DOJ brought charges. A separate SEC action came at the same time 7. It described 'market-manipulation-as-a-service' deals by Gotbit and related groups 7. The DOJ said its cases focus on Gotbit, Vortex, Antier and Contrarian 9. The actions go back to 2018 9. The schemes tried to make token prices and trading amounts look higher 9. They did this through coordinated trading 9. According to the indictment, as the source summarizes it, GOTBIT allegedly sold trading services to token projects 10.

In March 2026 the GOTBIT indictment charged Antoine Tsao, Ian Sofronov and Nemanja Popov with conspiracy to commit wire fraud and two counts of wire fraud 8. The SEC's July 2026 action named Russell Armand, Maxwell Hernandez, Manpreet Singh Kohli, Nam Tran and Vy Pham as having hired ZM Quant and Gotbit to manipulate trading volumes 6. The reported settlements are expected to include monetary penalties and bars on serving as executives, but no amounts or durations were given 1. Court approval was still required before the terms were final 2, and the amount the promoters must pay was left for the court to decide 3.

Timing is another clue. Around 70% of pump announcements in the dataset occur between 15:00 and 17:00 UTC, showing that the timing of these events is highly concentrated 30.

Rules, Hype Makers and Missing Pieces

In June 2024, the New York Attorney General sued NovaTech and AWS Mining. The lawsuit said they aimed their promotions at Haitian immigrant communities. They used prayer groups and social media 71. The people who ran NovaTech used promoters. The promoters falsely said NovaTech was a registered hedge fund broker. They also said it was allowed to trade crypto in the US. They advertised profits of 2 to 4 percent each week 70. The SEC found that Kim Kardashian was paid about $250,000 to promote EthereumMax. She did not tell people she was paid. She had to pay a penalty 68.

Courts have been cautious about stretching liability to platforms. In February 2025 the Second Circuit affirmed dismissal of federal securities claims against Uniswap, reasoning that a smart-contract drafter should not be liable under the Exchange Act for a third-party user's misuse of the platform 12. A later district court ruling held that operating a marketplace where many users interact legitimately is not substantial assistance to fraud, even if some users act fraudulently 15.

Exchanges and regulators have added rules. Robinhood's policy bars insiders from trading a crypto-asset from the moment Robinhood publicly announces a new listing or delisting until 24 hours after that announcement 31. In Europe, MiCAR's market-abuse rules have applied since 30 December 2024 17, and persons who arrange or professionally trade crypto-assets must report any well-founded suspicion of market abuse to BaFin without delay 20. On X, paid partnerships cover any post made in exchange for compensation or incentive from a third party, including affiliate commissions, revenue-sharing, referral and discount codes, ambassador arrangements, and gifted products or experiences 47. Crypto promotion involving compensation, affiliate incentives, or commercial endorsement falls under this restriction, while organic discussion of digital assets remains allowed 49. The rule coverage article offers no measured evidence on returns for followers; it only predicts that non-compliant accounts may see reduced organic reach and temporary sentiment dips 50.

Where Things Stand Today

A South Korean court found crypto operator Jonber Kim not guilty. Prosecutors did not prove that investors bought the tokens because they were fooled by project promotions 11. This was a ruling from South Korea, not from the US, so it does not directly address Ciminelli 11. The New York Attorney General got permanent bans against four top promoters of the NovaTech/AWS Mining scheme. Those four must also pay money to victims 69. As of 2026-10-22, the HAWK token had dropped 56.0% over the past year. It was far below its 2025 all-time high 51. The source does not mention KOLs or influencer promotions 51.

The company got 8,658,685 restricted AVAX tokens from six counterparties. They were worth about $106.5 million 54. Separately, the largest tranche has 7,317,966 AVAX. On March 31, 2026, it was worth about $65.2 million. It starts unlocking in September 2026 and unlocks in 48 equal monthly parts through August 2030 65. Sorting portfolios by token dilution gives yearly return spreads of about 25% to 32% 56. A measure using the FDV premium and a 12-week dilution rate predicts crypto returns 52. The dilution premium is missing in the five largest blue-chip tokens and in mature coins. It is mostly found in a coin's first year of trading 60. The authors say it comes from limited investor attention to publicly disclosed vesting schedules, not from mechanical selling pressure from unlocks 64.

Still unknown

Do sniper and launch-bot wallets earn positive returns after fees, priority costs and slippage? The evidence in this file names sniper bots but contains no wallet-level return data, so this lane is thin.

Does paid KOL promotion produce measurable, fee-adjusted losses for followers? The only return evidence checked (HAWK) does not involve KOLs, so the question remains open.

Does the Ciminelli line of wire-fraud cases narrow the property theory for token holders as victims? The evidence touches this only through a Korean ruling that is not a US decision, so the US answer is unsettled here.

Were Robo Inu, Saitama or other Gotbit-linked tokens affected in exchange surveillance or delisting records? The file contains no exchange notices or thresholds for those tokens, so that link is unverified.

Explore this colony and ask your own questions

Connected to other stories

United States also appears in How did the Federal Reserve Act change who could create money?, Did Israel's ten lost tribes really disappear forever?, How early did people really reach Australia and Asia?, Where did Cajun and Creole people really come from?, What are the best ways to make money online in 2027?, Is the US government really poisoning us with processed food?, How long has AI been around for everyone to use?, Is it really only three licks to reach a Tootsie Pop center?, Could One Bitcoin Really Be Worth $200,000?, Have leaked Project 2025 plans really been happening?, Has Anyone Ever Used the Internet for Time Travel?, Did South Gate, California's city government really have corruption problems?, Why hasn't anyone flown to Mars yet?, Did the Poythress Family Really Come From Pocahontas?, How much would 10 sales a day at $500 make?, Can you really make money trading crypto?, What was the first real crypto trade, and when did it happen?, Who Is the Richest Freemason, and Can We Prove It?, Is the US really just taking minerals from Congo?, Can Anyone Really Name the First Horror Movie Ever Made?.

European Union also appears in How did the Federal Reserve Act change who could create money?, What are the best ways to make money online in 2027?, Is the US government really poisoning us with processed food?, How long has AI been around for everyone to use?, Could One Bitcoin Really Be Worth $200,000?, Can you really make money trading crypto?, What was the first real crypto trade, and when did it happen?, Is the US really just taking minerals from Congo?.

Federal Trade Commission also appears in How did the Federal Reserve Act change who could create money?, How long has AI been around for everyone to use?, Have leaked Project 2025 plans really been happening?, How much would 10 sales a day at $500 make?, Can you really make money trading crypto?.

Markets in Crypto-Assets Regulation also appears in Could One Bitcoin Really Be Worth $200,000?, Can you really make money trading crypto?, What was the first real crypto trade, and when did it happen?.

Supreme Court of the United States also appears in How early did people really reach Australia and Asia?, Is the US government really poisoning us with processed food?, Have leaked Project 2025 plans really been happening?, Did South Gate, California's city government really have corruption problems?, What was the first real crypto trade, and when did it happen?.

U.S. Securities and Exchange Commission also appears in How did the Federal Reserve Act change who could create money?, How long has AI been around for everyone to use?, Could One Bitcoin Really Be Worth $200,000?, Can you really make money trading crypto?, What was the first real crypto trade, and when did it happen?.

Federal Bureau of Investigation also appears in How early did people really reach Australia and Asia?, Have leaked Project 2025 plans really been happening?, Did South Gate, California's city government really have corruption problems?, What was the first real crypto trade, and when did it happen?.

Securities and Exchange Commission also appears in Could One Bitcoin Really Be Worth $200,000?, Have leaked Project 2025 plans really been happening?, Can you really make money trading crypto?, What was the first real crypto trade, and when did it happen?.

Sources

[1] supported · niche source
The expected settlements for Armand, Hernandez, and Pham are reported to include monetary penalties and bars on serving in executive positions, but no specific amounts or durations are given.
"Those settlements are expected to include penalties as well as bars on serving in executive positions ."
SEC Charges Three Market Makers and Nine Individuals in Alleged Crypto ...
[2] supported · niche source
The article states the settlement terms were not yet final in a judicial sense because court approval was still required.
"Court approval remains a necessary step, so the terms are not yet fully finalized in a judicial sense."
SEC Charges Three Market Makers and Nine Individuals in Alleged Crypto ...
[3] supported · niche source
The amount of money the promoters must pay had not been set in the reported settlements; the court was to decide it.
"The court will decide how much money the promoters will have to pay."
Three Crypto Firms Named in U.S. Market Manipulation Probe
[4] supported · niche source
The SEC is seeking permanent injunctions, disgorgement, civil penalties, and officer-and-director bars against certain defendants.
"As part of its enforcement push, the SEC is seeking permanent injunctions, disgorgement of allegedly ill-gotten gains, civil penalties, and officer-and-director bars for certain defendants ."
SEC Charges Three Market Makers and Nine Individuals in Alleged Crypto ...
[5] supported · niche source
The SEC sought permanent injunctions, return of ill-gotten earnings with prejudgment interest, civil fines, and bans on serving as officers or directors against the defendants.
"They ask for permanent injunctions, the return of ill-gotten earnings with prejudgment interest, civil fines, and bans on serving as officers or directors."
Three Crypto Firms Named in U.S. Market Manipulation Probe
[6] supported · niche source
The SEC named Russell Armand, Maxwell Hernandez, Manpreet Singh Kohli, Nam Tran, and Vy Pham as having hired ZM Quant and Gotbit to manipulate trading volumes.
"According to the SEC, Russell Armand, Maxwell Hernandez, Manpreet Singh Kohli, Nam Tran, and Vy Pham hired ZM Quant and Gotbit to manipulate trading volumes."
SEC Charges Three Market Makers and Nine Individuals in Alleged Crypto ...
[7] supported · niche source
A parallel SEC action accompanied the 2024 DOJ charges, and it outlined 'market-manipulation-as-a-service' offerings by Gotbit and related actors. The article does not say which statutes or definitions the SEC complaint used.
"alongside a parallel United States Securities and Exchange Commission action that outlined “market-manipulation‑as‑a‑service” offerings by Gotbit and related actors."
DOJ Brings 10 Alleged Crypto Market Manipulators to Oakland Court
[8] supported · niche source
The GOTBIT indictment charged Antoine Tsao, Ian Sofronov and Nemanja Popov with conspiracy to commit wire fraud and two counts of wire fraud.
"The GOTBIT indictment charged Antoine Tsao, Ian Sofronov and Nemanja Popov with conspiracy to commit wire fraud and two counts of wire fraud."
Four financial services firms named in crypto indictments
[9] supported · niche source
The DOJ said the wash-trading cases centered on Gotbit, Vortex, Antier and Contrarian involved schemes to inflate token prices and volumes through coordinated trading, with conduct dating back to 2018.
"The DOJ said the cases, which center on Gotbit, Vortex, Antier and Contrarian over conduct dating back to 2018, involve schemes to inflate token prices and volumes through coordinated trading"
DOJ Brings 10 Alleged Crypto Market Manipulators to Oakland Court
[10] supported · niche source
According to the indictment as summarized by the source, GOTBIT allegedly sold wash trading services to token projects.
"According to the indictment as summarized by the source, GOTBIT allegedly sold wash trading services to token projects."
Four financial services firms named in crypto indictments
[11] supported · niche source
A South Korean court acquitted crypto operator Jonber Kim after prosecutors failed to prove that individual investors bought the tokens because they were misled by project promotions. This is a South Korean ruling, not a US wire fraud decision, so it does not directly address Ciminelli.
"Prosecutors did not prove that individual investors bought the tokens because they were misled by those claims."
South Korean Court Acquits Jonber Kim in $230 Million Crypto Case.
[12] supported · niche source
The Second Circuit affirmed dismissal of the plaintiffs' federal securities law claims against Uniswap, reasoning that a smart contract drafter should not be liable under the Exchange Act for a third-party user's misuse of the platform.
"it defies logic that a drafter of a smart contract, a computer code, could be held liable under the Exchange Act for a third-party user's misuse of the platform."
Second Circuit Strikes Down Attempt to Pin Fraud on Token Issuers
[13] supported · niche source
Prosecutors also lacked enough evidence to support charges that Kim manipulated token prices or diverted proceeds from POD sales.
"Prosecutors also failed to provide enough evidence to support charges that Kim manipulated token prices or diverted proceeds from POD sales."
South Korean Court Acquits Jonber Kim in $230 Million Crypto Case.
[14] supported · niche source
After affirming dismissal of the federal claims, the Second Circuit sent the remaining state-law claims back to the district court for consideration.
"However, the Second Circuit directed the lower court to consider Plaintiffs’ state-law claims."
Second Circuit Strikes Down Attempt to Pin Fraud on Token Issuers
[15] supported · niche source
The district court held that operating a marketplace where many users interact legitimately is not substantial assistance to fraud, even if some users act fraudulently, and that plaintiffs had to show affirmative assistance, concealment, or a failure to act when required.
"The court further held that creating a marketplace on which many users could interact legitimately did not constitute “substantial assistance” in facilitating the scams, even if some users acted fraudulently."
Second Circuit Strikes Down Attempt to Pin Fraud on Token Issuers
[16] supported · primary source
BaFin's list of applicable ESA guidelines for MiCA includes ESMA guidelines on supervisory practices for preventing and detecting market abuse under MiCA, with an application date of 8 September 2025. The listing does not mention front-running, transaction ordering, or how victims or harm are defined.
"Leitlinien zu den Aufsichtspraktiken der zuständigen Behörden zur Vorbeugung und Aufdeckung von Marktmissbrauch gemäß der Verordnung über Märkte für Kryptowerte ( MiCA )"
Translation: Guidelines on the supervisory practices of competent authorities for preventing and detecting market abuse under the Markets in Crypto-Assets Regulation (MiCA)
Anwendbare Leitlinien der ESAs für MiCAR - Bafin
[17] documented · primary source
The MiCAR rules on combating market abuse have applied since 30 December 2024.
"6. Vorschriften zur Bekämpfung von Marktmissbrauch (gelten seit 30. Dezember 2024)"
Translation: 6. Rules on combating market abuse (applicable since 30 December 2024)
Aktuelles & Presse - Kryptowerte-Dienstleister: Welche Vereinfachungen und Herausforderungen es jetzt gibt - Bafin
[18] documented · primary source
BaFin states that for other tokens whose admission to trading has been applied for, the MiCAR rules on preventing and prohibiting market abuse (Articles 86 ff. MiCAR) apply from the time of the application.
"Bitte beachten Sie, dass für sonstige Token, deren Zulassung zum Handel beantragt wurde, bereits ab dem Zeitpunkt der Beantragung die Regelungen zur Verhinderung und dem Verbot von Marktmissbrauch (Artikel 86 ff MiCAR) gelten."
Translation: Please note that for other tokens for which admission to trading has been applied for, the rules on the prevention and prohibition of market abuse (Articles 86 et seq. MiCAR) already apply from the time of the application.
Kryptoinstitute
[19] supported · primary source
MiCAR's stated objectives include increasing investor protection, preventing money laundering and terrorist financing, contributing to market functioning, and preserving financial stability.
"Das Ziel: MiCAR soll den Schutz der Anlegerinnen und Anleger erhöhen, Geldwäsche und Terrorismusfinanzierung verhindern, zur Funktionsfähigkeit der Märkte beitragen und die Finanzstabilität wahren."
Translation: The goal: MiCAR is intended to increase the protection of investors, prevent money laundering and terrorist financing, contribute to the functioning of markets and preserve financial stability.
Aktuelles & Presse - Kryptowerte-Dienstleister: Welche Vereinfachungen und Herausforderungen es jetzt gibt - Bafin
[20] supported · primary source
Persons who arrange or professionally trade crypto-assets must report to BaFin without delay any well-founded suspicion that market abuse has been, is being, or is likely to be committed in connection with an order or a transaction.
"Sie vermitteln oder führen beruflich Geschäfte mit Kryptowerten aus? Sie haben Hinweise, dass bei einem Auftrag oder einem Geschäft Marktmissbrauch begangen wurde, begangen wird oder wahrscheinlich begangen wird? Dann sind Sie verpflichtet, jeden begründeten Verdacht unverzüglich der Bafin über das MVP -Portal zu melden."
Translation: Do you arrange or professionally carry out transactions in crypto-assets? Do you have indications that market abuse has been, is being, or is likely to be committed in connection with an order or a transaction? Then you are obliged to report every well-founded suspicion immediately to BaFin via the MVP portal.
Kryptoinstitute
[21] supported · scholarly source
In the analysis reported by this source, 76% of the accounts examined were marked as Sybils, meaning fake or duplicate identities created to farm airdrop rewards.
"In the end, 76% of all the accounts analyzed were marked as Sybils."
Airdrop Sybil Attack detection framework support… — Library of Science
[22] supported · established source
Airdrop farmers create fake accounts on platforms solely to collect airdropped tokens, which reduces the share going to loyal users.
"Airdrop squatters are creating fake accounts on platforms for the sole purpose of farming airdrop tokens, thus taking away share from loyal users."
Token airdrops targeted by farm accounts and 'Sybil attacks'
[23] supported · established source
According to Gamic HQ, Sybil attacks capture a large share of airdropped tokens, leaving less for genuine users who would be more likely to use and support the project long-term.
"amass a large portion of the airdropped tokens, leaving less for genuine users who might be more interested in using and supporting the project long-term."
Token airdrops targeted by farm accounts and 'Sybil attacks'
[24] supported · scholarly source
A Sybil operator runs several accounts, each used to interact with DApps, and expects every account to qualify for the airdrop.
"A Sybil often creates multiple accounts, operates each account to utilize dedicated DApps, and expects airdrop qualifications of all the accounts."
Fighting Sybils in Airdrops
[25] supported · established source
DeFi developer Banteg identified an estimated 701,544 Starknet addresses allegedly tied to repeat or renamed GitHub accounts controlled by airdrop farmers.
"Banteg also identified an estimated 701,544 addresses that were allegedly linked to repeat or renamed GitHub accounts controlled by airdrop farmers."
Token airdrops targeted by farm accounts and 'Sybil attacks'
[26] supported · scholarly source
Sybil activity can make a DApp look popular, but the activity comes from fake users, which reduces the rewards that genuine users would receive.
"It seems that Sybils increase the popularity of DApps by bringing more activities, but these activities are from factitious users whose presence degenerates normal users’ rewards."
Fighting Sybils in Airdrops
[27] supported · established source
Despite Banteg's findings about farmer addresses, the Starknet airdrop still included those farmer addresses.
"Despite such revelation, the airdrop farmers’ addresses were included in the Starknet airdrop anyway."
Token airdrops targeted by farm accounts and 'Sybil attacks'
[28] supported · scholarly source
Airdrop projects usually require users to complete basic activities within the DApp before they qualify, and Sybils manipulate those activities to qualify their accounts.
"DApp projects often set up prerequisites for airdrop qualification, such that users need to complete some basic activities within DApps before being qualified for an airdrop."
Fighting Sybils in Airdrops
[29] supported · scholarly source
Sybils create multiple accounts and manipulate each account's activity to meet airdrop requirements, aiming to obtain more of the issued tokens.
"Sybils tend to create multiple accounts and manipulate each account’s activities for airdrop qualification, aiming at obtaining more issued tokens."
Fighting Sybils in Airdrops
[30] supported · scholarly source
Around 70% of pump announcements in the dataset occur between 15:00 and 17:00 UTC, showing that the timing of these events is highly concentrated.
"around 70% of pump announcements occur between 15:00 and 17:00 UTC"
PumpSense: Real-Time Detection and Target Extraction of Crypto Pump-and-Dumps on Telegram
[31] documented · primary source
Robinhood's policy bars insiders from trading a crypto-asset from the moment Robinhood publicly announces its new listing or delisting until 24 hours after that broad public announcement.
"They are restricted from trading of a crypto-asset(s) on Robinhood or another platform, from the time Robinhood publicly announces a new listing or delisting of such crypto-asset(s) up to twenty-four (24) hours after such broad public announcement."
10-K Robinhood Markets, Inc. (HOOD) (CIK 0001783879) 2026-02-18
[32] documented · primary source
Employees identified as 'Coin Aware Individuals' face stricter rules because they are exposed to material non-public information during the crypto listing and delisting process.
"those who have been identified as Coin Aware Individuals (as defined below) are subject to even more restrictive requirements due to their exposure to MNPI during the listing/delisting process."
10-K Robinhood Markets, Inc. (HOOD) (CIK 0001783879) 2026-02-18
[33] documented · primary source
The policy treats a crypto-asset's information as becoming public only after a 24-hour waiting period, compared with one full regular trading session for securities, before insiders may trade.
"You should refrain from trading until the market has had an opportunity to absorb and evaluate the information, which this Policy defines as one full regular trading session (in the case of securities) and 24 hours (in the case of crypto-assets) after the information was broadly disseminated."
10-K Robinhood Markets, Inc. (HOOD) (CIK 0001783879) 2026-02-18
[34] supported · primary source
Listings and delistings of a stablecoin are generally not material as long as its pegged price is not in doubt, but become material if the peg is at risk.
"So long as a stablecoin’s pegged price is not in doubt, listings and delistings of the stablecoin are unlikely to be material with respect to the stablecoin"
10-K Robinhood Markets, Inc. (HOOD) (CIK 0001783879) 2026-02-18
[35] documented · primary source
Some smart contracts can be controlled by admin keys or super users who can change protocol parameters or, in certain cases, access assets held within the protocol.
"Furthermore, some smart contracts can be controlled by "admin keys" or "super users" with special privileges. These users can make changes to protocol parameters or, in certain cases, access assets held within a protocol."
20-F Bullish (BLSH) (CIK 0001872195) 2026-03-10
[36] documented · primary source
Smart contracts can be controlled by admin keys or super users who can unilaterally change the contract, enable or disable features, and alter how it transmits digital assets.
"These users may have the ability to unilaterally make changes to the smart contract, enable or disable features on the smart contract, change how the smart contract receives external inputs and data or transmits Digital Assets, and make other changes to the smart contract."
424B3 Franklin Crypto Trust (EZPZ) (CIK 0002033807) 2025-12-01
[37] supported · scholarly source
The same Ethereum and BSC research found that the liquidity withdrawals collectively generated $240 million in profits.
"Theyfoundthattheliquiditywithdrawalscollectivelyhave generated$240millioninprofits."
SolRPDS: A Dataset for Analyzing Rug Pulls in Solana Decentralized Finance
[38] supported · primary source
If an attacker gains access to admin privileges or a super user acts maliciously, customers may suffer a total loss of their assets' value.
"If an attacker gains access to these privileges or a super user acts maliciously, customers may experience a total loss of their assets' value."
20-F Bullish (BLSH) (CIK 0001872195) 2026-03-10
[39] supported · primary source
Rug pulls are described as exit scams in which developers or influencers who promote a smart contract or application ultimately escape with investors' money at an agreed time.
"There may be opportunities for bad actors to perpetrate fraudulent schemes and engage in illicit activities and other misconduct, such as exit scams and rug pulls (orchestrated by developers and/or influencers who promote a smart contract or application and, ultimately, escape with the money at an agreed time), or Ponzi or similar fraud schemes."
424B3 Franklin Crypto Trust (EZPZ) (CIK 0002033807) 2025-12-01
[40] supported · scholarly source
In the basic rug pull, the operator, after adding the liquidity pool and waiting for buyers, removes all liquidity from the pool, leaving investors holding tokens with no market.
"Lastly,Everemovesalltheliquidityfromtheliquidity"
Token Spammers, Rug Pulls, and SniperBots: An Analysis of the Ecosystem of Tokens in Ethereum and in the Binance Smart Chain (BNB)
[41] supported · scholarly source
Rug pulls work by exploiting liquidity pools that users supply on decentralized exchanges, draining token value from the pool.
"todraintokenvaluefromtheliquiditypool"
SolRPDS: A Dataset for Analyzing Rug Pulls in Solana Decentralized Finance
[42] supported · primary source
Governance tokens can be concentrated among a small group of core community members, who could make changes to a smart contract unilaterally even when it uses decentralized governance.
"such governance tokens can be concentrated in the hands of a small group of core community members, who would be able to make similar changes unilaterally to the smart contract."
20-F Bullish (BLSH) (CIK 0001872195) 2026-03-10
[43] supported · primary source
Attackers siphoned over $3.8 billion in digital assets from smart contracts, including bridges and DeFi protocols, in 2022.
"Other smart contracts, such as bridges between blockchain networks and DeFi protocols have also been manipulated, exploited or used in ways that were not intended or envisioned by their creators such that attackers syphoned over $3.8 billion worth of digital assets from smart contracts in 2022."
424B3 Franklin Crypto Trust (EZPZ) (CIK 0002033807) 2025-12-01
[44] supported · scholarly source
Token creators can allow free token creation and retain large portions of the token supply, which increases the risk of a rug pull.
"enabledeveloperstoretainlarge"
SolRPDS: A Dataset for Analyzing Rug Pulls in Solana Decentralized Finance
[45] supported · primary source
A vulnerability in a Parity multi-signature wallet smart contract led to a reportedly $30 million theft of ether in July 2017, and a later Parity bug froze roughly $160 million of ether.
"in July 2017, a vulnerability in a smart contract for a multi-signature wallet software developed by Parity led to a reportedly $30 million theft of ether, and in November 2017, a new vulnerability in Parity’s wallet software reportedly led to roughly $160 million worth of ether being indefinitely frozen in an account."
424B3 Franklin Crypto Trust (EZPZ) (CIK 0002033807) 2025-12-01
[46] supported · primary source
A design flaw in the MakerDAO smart contract in March 2020 forced liquidations of depositors' crypto assets at significantly discounted prices, causing millions of dollars in losses.
"in March 2020, a design flaw in the MakerDAO smart contract caused forced liquidations of crypto assets at significantly discounted prices, resulting in millions of dollars of losses to users who had deposited crypto assets into the smart contract."
424B3 Franklin Crypto Trust (EZPZ) (CIK 0002033807) 2025-12-01
[47] supported · niche source
Paid partnerships on X cover any post made in exchange for compensation or incentive from a third party, including affiliate commissions, revenue-sharing, referral and discount codes, ambassador arrangements, and gifted products or experiences.
"Scope of Paid Partnerships — Applies to any post created in exchange for compensation or incentive from a third party, including direct payments, affiliate commissions, revenue-sharing, referral codes, discount codes, ambassador arrangements, gifted products, or experiences."
X Platform Paid Promotion Disclosure Rules
[48] supported · niche source
Compensation for crypto promotion can take the form of fiat, tokens, or affiliate commissions, and any of these triggers disclosure duties.
"Compensation, whether paid in fiat, tokens, or affiliate commissions, triggers disclosure responsibilities."
X Crypto Promotion Ban 2026: New Crypto Rules Explained
[49] supported · niche source
Any crypto promotion involving compensation, affiliate incentives, or commercial endorsement falls under the restriction, while organic discussion of digital assets remains allowed.
"While users may continue to discuss digital assets organically, any arrangement involving compensation, affiliate incentives, or commercial endorsement falls within the scope of the restriction."
X Expands Paid Promotion Ban to Include Cryptocurrency Partnerships - FinanceFeeds
[50] supported · niche source
The article offers no measured evidence on returns for followers; it only predicts that non-compliant accounts may see reduced organic reach and temporary sentiment dips.
"Crypto influencers and projects heavily reliant on X for promotion may see reduced organic reach if labeling is perceived as less authentic; expect temporary sentiment dips for non-compliant accounts or tokens."
X Platform Paid Promotion Disclosure Rules
[51] supported · niche source
As of 2026-10-22, the HAWK token had fallen 56.0% over the prior year and traded far below its 2025 all-time high, which is the only return evidence in the source. The source does not mention KOLs or influencer promotions.
"CoinGecko data for Hawk (HAWK) as of 2026-10-22: price $0.00003618, market cap $1,953,635, all-time high $0.00090156 on 2025-01-16, all-time low $0.00000892 on 2024-09-04, 1-year change -56.0%."
Hawk market data (CoinGecko, 2026-10-22)
[52] supported · scholarly source
The FDV premium and a 12-week dilution rate predict cross-sectional cryptocurrency returns, with Newey–West t-statistics of -3.13 and -2.79.
"the FDV premium and a 12-week dilution rate predict cross-sectional returns with Newey–West t-statistics of −3.13 and −2.79"
Token Dilution and the Cross-Section of Cryptocurrency Returns (2026)
[53] supported · scholarly source
Across 2.77 million swaps of 14 tokens on Uniswap v2, v3 and SushiSwap, unusually large sell orders correlate with negative future token returns, while large buy orders correlate with positive future returns.
"we find that the size of sell orders significantly correlates with negative future token returns, while buy size positively correlates with future token returns."
Liquidity Shocks, Token Returns and Market Capitalization in Decentralized Finance (DeFi) Markets (2022)
[54] documented · primary source
The Company received 8,658,685 restricted AVAX tokens from six counterparties, with a fair value of about $106.5 million, under the Contribution Agreement, the TSA, and separate subscription or contribution agreements.
"8,658,685 restricted AVAX tokens from six counterparties, with a fair value of $106.5 million, pursuant to a combination of the Contribution Agreement, the TSA, and separate subscription or contribution agreements with each investor."
8-K Avalanche Treasury Corp (AVAT) (CIK 0002092446) 2026-05-29
[55] documented · primary source
Anchorage agrees to enforce the Lock-Up Schedule through itself or an affiliate, which requires it to restrict withdrawals and transfers of the affected Native Tokens in certain client custody accounts.
"Pursuant to the terms hereof, Anchorage agrees to enforce (whether through itself or an affiliate) the Lock-Up Schedule, which shall require Anchorage (or such affiliate) to restrict withdrawals and transfers of applicable Native Tokens"
S-4/A Hyperliquid Strategies Inc (HYPS) (CIK 0002078856) 2025-09-22
[56] supported · scholarly source
Portfolio sorts based on dilution produce annualized long–short return spreads of roughly 25% to 32%.
"portfolio sorts yield annualized long–short spreads of 25– 32%"
Token Dilution and the Cross-Section of Cryptocurrency Returns (2026)
[57] supported · scholarly source
For individual tokens, the study finds a mean reassessment of token value of up to 0.79% after large sell orders, and up to 0.50% after large buy orders, within one follow-up trade.
"we find a mean reassessment of token value following short sales of up to 0.79% within just one follow-up trade (buy orders up to 0.50%)."
Liquidity Shocks, Token Returns and Market Capitalization in Decentralized Finance (DeFi) Markets (2022)
[58] documented · primary source
The transfer restrictions on the AVAX are enforced both by contract (paper locks) and by the Avalanche protocol itself (P-chain locks).
"These restrictions are implemented through a combination of paper-lock provisions (contractual restrictions enforced through the terms of the applicable agreements) and P-chain lock provisions (protocol- enforced restrictions embedded at the Avalanche blockchain level)."
8-K Avalanche Treasury Corp (AVAT) (CIK 0002092446) 2026-05-29
[59] documented · primary source
Anchorage's total liability for all claims related to its Lock-Up Support Services is capped at $25,000 in the aggregate.
"Anchorage’s total liability for all claims arising from or related to the Lock-Up Support Services shall not exceed, in the aggregate, twenty five thousand dollars ($25,000)."
S-4/A Hyperliquid Strategies Inc (HYPS) (CIK 0002078856) 2025-09-22
[60] supported · scholarly source
The dilution premium is absent in the five largest blue-chip tokens and in mature coins, and is concentrated in a coin's first year of trading.
"The premium is absent in the top-five blue-chip tokens and in mature coins but concentrated in the first year of trading"
Token Dilution and the Cross-Section of Cryptocurrency Returns (2026)
[61] supported · scholarly source
For large sell orders, much of the abnormal price return occurs before the sell event, which the authors attribute to informed trading such as arbitrage or front-running via Miner Extractable Value (MEV).
"In the case of sell orders, a high proportion of the abnormal return is already realized before the event, which indicates informed trading in the form of arbitrage or frontrunning via Miner Extractable Value (MEV)."
Liquidity Shocks, Token Returns and Market Capitalization in Decentralized Finance (DeFi) Markets (2022)
[62] documented · primary source
Lockup periods differ by investor, ranging from about 7 months to about 56 months, and each tranche unlocks in periodic monthly increments.
"The lockup schedules vary by investor, with restriction periods ranging from approximately 7 months to approximately 56 months. Each tranche is subject to a staged unlock schedule under which tokens become freely transferable in periodic monthly increments over the restriction period."
8-K Avalanche Treasury Corp (AVAT) (CIK 0002092446) 2026-05-29
[63] supported · primary source
The token issuer's lock-up schedule must be delivered to Anchorage and each lockup client at least fifteen days before locked tokens are deposited in their custody accounts.
"at least fifteen (15) days prior to the date Locked Tokens are deposited in the applicable Lockup Clients’ custody accounts."
S-4/A Hyperliquid Strategies Inc (HYPS) (CIK 0002078856) 2025-09-22
[64] supported · scholarly source
The authors attribute the dilution premium to limited investor attention to publicly disclosed vesting schedules rather than mechanical selling pressure from unlocks.
"pointing to limited investor attention to publicly disclosed vesting schedules rather than mechanical price pressure."
Token Dilution and the Cross-Section of Cryptocurrency Returns (2026)
[65] supported · primary source
The largest tranche, 7,317,966 AVAX (about $65.2 million at March 31, 2026), begins unlocking in September 2026 in 48 equal monthly increments through August 2030.
"Tokens unlock over 48 equal monthly increments beginning September 2026 and concluding August 2030."
8-K Avalanche Treasury Corp (AVAT) (CIK 0002092446) 2026-05-29
[66] supported · scholarly source
In the studied pump-and-dump events on 1021 tokens, about 70% of pre-event volume traded within one hour of the pump announcement.
"observe that 70% of pre-event volume transacts within one hour of the pump announcement"
Microstructure and Manipulation: Quantifying Pump-and-Dump Dynamics in Cryptocurrency Markets (2025) [cited 0 times]
[67] supported · scholarly source
Insider profits were estimated as conservative lower bounds under a single liquidation at 70% of peak price and under a tranche-based exit, with median returns above 100% and upper-quartile returns above 2000%.
"we compute conservative lower bounds on insider profits under both a single-point liquidation at 70% of peak and a tranche-based strategy (selling 20% at 50%, 30% at 60%, and 50% at 80% of peak), yielding median returns above 100% and upper-quartile returns exceeding 2000%"
Microstructure and Manipulation: Quantifying Pump-and-Dump Dynamics in Cryptocurrency Markets (2025) [cited 0 times]
[68] supported · niche source
The SEC's order against Kim Kardashian found she was paid about $250,000 to promote EthereumMax without disclosing the payment, and it imposed disgorgement, prejudgment interest, and a civil penalty.
"The Kardashian order found she was paid approximately $250,000 to promote EthereumMax without disclosing that payment, resulting in disgorgement, prejudgment interest, and a civil penalty."
U.S. Crypto Influencer Promotions: FTC Disclosures, SEC Penalties
[69] supported · primary source
The New York Attorney General obtained permanent bans from the securities, commodities, and cryptocurrency industries against four top promoters of the NovaTech/AWS Mining scheme, who must also pay disgorgement for victims.
"four of the scheme’s top promoters – Martin Zizi, Frantz Ciceron, Ricardo Roy, Sr., and James Corbett – will pay millions in disgorgement for the benefit of victims, and have been permanently banned from participating in the securities, commodities, and cryptocurrency industries."
Attorney General James Secures Nearly $6 Million From Crypto Scammers ...
[70] supported · primary source
NovaTech's operators, through promoters, falsely claimed to be a registered hedge fund broker and licensed to trade crypto in the U.S., advertised 2 to 4 percent weekly trading profits, and promoted recruitment bonuses.
"The Petions falsely marketed NovaTech as a registered hedge fund broker, misrepresented that NovaTech was licensed to trade cryptocurrency in the U.S., advertised high profits from trading of approximately two to four percent per week, promoted recruitment bonuses, and promised that investors could withdraw their funds and profits at any time."
Attorney General James Secures Nearly $6 Million From Crypto Scammers ...
[71] supported · primary source
The Attorney General sued NovaTech and AWS Mining in June 2024 over pyramid-scheme promotion targeting Haitian immigrant communities through prayer groups and social media.
"In June 2024, Attorney General James sued cryptocurrency trading company NovaTechFx (NovaTech) and cryptocurrency mining company AWS Mining Pty Ltd. (AWS Mining) for targeting immigrant communities, particularly Haitian New Yorkers, in prayer groups and through social media and WhatsApp group chats"
Attorney General James Secures Nearly $6 Million From Crypto Scammers ...
[72] supported · scholarly source
According to the paper, valuation anchoring and volatility depend on governance primitives such as effective circulating supply and the depth of regime-dependent speculative demand. This is a general model result and does not measure team or investor unlocks.
"Valuation anchoring and volatility depend on governance primitives such as effective circulating supply and regime-dependent speculative depth."
Discontinuous Adoption Dynamics and Token Valuation in Blockchain Platforms (2026)
[73] supported · scholarly source
Across the August 2021 to September 2025 sample, token unlocks have a negative and statistically significant association with ETH prices, which the authors read as supply expansion pushing prices down.
"indicating that supply expansion events are negatively associated with ETH prices."
Ethereum tokenomics and token value: a quantitative analysis of on-chain fundamentals (2021–2025) (2026)
[74] supported · scholarly source
Launch-time insider allocation (team plus investor allocation) has no significant correlation with governance concentration measured after distribution, at N = 50.
"insider allocation Pearson r = 0.09, p = 0.55, N = 50"
Auditing governance concentration beyond token allocation: a live-governance study of 52 token protocols (2026)
[75] supported · scholarly source
A cliff bars the initial token issuance to the affected group before a set date, while a lock-up applies after issuance and prohibits sales of those tokens until the lock-up end date.
"Whileacliffprohibitstheinitialtokenissuance"
Token governance in initial coin offerings: Implications of token retention and resale restrictions for ICO success (2024)
[76] documented · primary source
Ember Token smart contracts are designed so that any exchange listing the tokens must be recognized by the contract as a registered exchange or an SEC-registered ATS, which limits who can sell into the market.
"smart contracts embedded in the fabric of the Ember Tokens will require that any exchange listing Ember Tokens be recognized by the smart contract as a registered exchange or as an SEC registered ATS."
1-A/A Prometheum, Inc. (CIK 0001718271) 2021-06-02
[77] supported · primary source
Underwriting lock-up terms bar the locked-up holder from offering, pledging, selling, or hedging Lock-up Securities, with exceptions for open-market purchases made after the offering.
"Notwithstanding the foregoing, and subject to the conditions below, the person may transfer Lock-up Securities without the prior written consent of the Representative in connection with (a) transactions relating to Lock-up Securities acquired in open market transactions after the completion of the Offering"
1-A/A Prometheum, Inc. (CIK 0001718271) 2021-06-02
[78] supported · primary source
Lock-up transfers to family members, trusts, charities, or equity owners are allowed only if no disposition for value occurs and each transferee signs a matching lock-up agreement.
"provided that in the case of any transfer of any Lock-up Securities pursuant to the foregoing clauses (b), (c) or (d), (i) any such transfer shall not involve a disposition for value, (ii) each transferee shall sign and deliver to the Representative a lock-up agreement"
1-A/A Prometheum, Inc. (CIK 0001718271) 2021-06-02
[79] supported · primary source
Locked-up holders consent to stop-transfer instructions being entered with the company's transfer agent, so transfers that violate the lock-up can be blocked at the registry level.
"The person also agrees and consents to the entry of stop transfer instructions with the Company"
1-A/A Prometheum, Inc. (CIK 0001718271) 2021-06-02
[80] supported · primary source
The company states that the Ember Token's value is expected to depend on supply and demand, with network transaction volume driving demand, but it gives no assurance of this outcome.
"We believe that the value of Ember Tokens will primarily be a function"
1-A/A Prometheum, Inc. (CIK 0001718271) 2021-06-02