Two Rug Factories Pulled $28 Million From Robinhood Chain in Under 90 Days

Two suspected rug factories. Roughly $28 million in combined flows. One network that went live on July 1.

Robinhood Chain has a problem most fast-growing networks meet eventually. It just hasn't had to meet it at this scale before.

On Sept. 28, blockchain security firm GoPlus flagged a high-risk operation running behind hundreds of memecoin launches. The setup pushed more than $9 million through a single fund-consolidation network over 30 days. The main consolidation wallet carried about 3,589 ETH in two-way flows across its latest 400 transactions. That's roughly $9.49 million, and GoPlus is careful to note it's gross flows, not net profit and not investor losses.

Here's the structure. Operators spin up a token around whatever narrative is hot that week. Supply gets spread across fresh wallets with almost no transaction history. Sales run through contracts including PonsV2Helper and UniversalRouter. The ETH from those sales moves through local sweep wallets before landing in the wider consolidation cluster.

Why bother with all those hops? Because it hides the ownership picture. One wallet dumping a concentrated position is obvious. Dozens of unrelated-looking addresses selling in stages looks like organic market activity. The supply converges somewhere else, and the chart never shows the real concentration.

The chart is the chart. But on-chain, the chart can lie.

Two Factories, Different Machines

This isn't the first one. On-chain researcher Wazz identified another suspected serial-rug operation on Robinhood Chain that pulled about $18.43 million out of at least 53 launches over roughly two months.

That crew worked differently. Groups of 70 to 200 wallets grabbed large chunks of supply shortly after launch, often leaving the cluster holding over 70% of a token. Wazz also traced funds from one project moving into wallets used to seed another. Proceeds were getting recycled, not withdrawn.

GoPlus says the two operations share DNA. Heavy use of Pons V2 infrastructure. Big wallet batches to disguise supply concentration. Capital rolling from one launch into the next.

But there's no evidence the two clusters are the same crew. The newer one leans on fresh wallets and consolidation. The earlier one used bigger clusters positioned to control supply from the jump. Same economics, different plumbing.

That distinction matters more than it looks. It means this isn't one bad actor you can block and move on. It's a repeatable method, and the method has variants.

The Open Network Problem

Robinhood Chain crossed $1.5 billion in total value locked in under 90 days. Token Terminal pegs revenue at about $50 million across roughly three months, with around $40 million of that landing in September alone. That's real money moving through a chain that didn't exist in June.

Speed cuts both ways. The same permissionless design that lets developers ship without asking permission also lets organized token operators reach retail without asking permission.

And detection here's genuinely hard. Nobody has to write malicious code. The contracts work fine. Buyers can sell. Liquidity doesn't vanish. The problem is coordinated ownership spread across dozens of addresses, followed by a staged exit. Scanning for bad code won't catch that. Scanning for bad code is the wrong tool entirely.

So where does the fix go? Probably the interfaces. Wallets, launchpads, trading apps. Concentration analysis, wallet warnings, supply clustering flags. Robinhood can't screen every contract on a permissionless L2, and it shouldn't try. But it can decide what its own app surfaces to users before they ape in.

That's the tension. Robinhood has 28.6 million funded customers and about $384 billion in assets. That distribution is the whole pitch for building on this chain. It's also the biggest target any rug operation could ask for.

What This Actually Costs

Here's my read. The memecoin layer is the customer acquisition funnel, and it's currently leaking. If retail gets burned on launch week and the experience feels rigged, they don't come back for the lending markets and tokenized equities that arrive later. The rug isn't the loss. The retreat is.

The invalidation point for this whole thesis sits at the first serious blowup. One headline about a Robinhood user losing six figures to a coordinated exit and the onboarding math gets harder for quarters.

Exchanges and brokerages solve this the same way. They don't police the chain. They police the door. Curated listings, risk scores, graduated access for verified assets. Coinbase did it with Base. Binance did it with BNB Chain. Both gave up some permissionless purity and both kept the retail business intact.

My take is blunt. Robinhood should ship concentration warnings into the main app before it pushes another million brokerage users on-chain. Not because regulators will demand it. Because the second rug factory won't be the last, and the operators are clearly iterating faster than the safeguards.

$28 million is the opening bid. That number only goes up.