GoPlus flags second Robinhood Chain meme factory with ~$9.49M flows
By Crypto Wire
September 29, 2026
Security firm GoPlus has flagged a second suspected memecoin “factory” on Robinhood Chain—a high-risk consolidation network that routed more than $9 million through one wallet cluster over the past 30 days, involving hundreds of tokens. CryptoSlate’s September 29 wrap, matching ChainCatcher’s GoPlus readout, puts the main aggregation address at 0x8c3Bad30cc7563A2D0357F49509FFd063666bb00. As of September 28, that wallet held about 56.06 ETH (~$148,000) while its latest 400 transactions showed roughly 1,728 ETH in and 1,861 ETH out—about 3,589 ETH / ~$9.49 million in two-way flow. GoPlus stresses that figure is gross flow, not net profit or proven investor losses. This is a new Rug Room chapter after Wazz’s ~$18.43 million / 53-launch cluster (9882) and The Block’s tax-waiver confirm (9887)—not a silent edit of those URLs.
How the alleged factory ships. Per GoPlus’s reconstructed loop, operators mint narrative memecoins, park supply across batches of fresh EOAs with only 4–11 prior transactions, then sell in segments through PonsV2Helper and UniversalRouter before sweeping ETH into local aggregators and the main 0x8c3Bad… consolidation address—then recycle proceeds into the next launch, new wallets, and trading ops. Sample tokens in the GoPlus set used as few as 3–8 fresh wallets and extracted roughly 2–13 ETH apiece. The point of the pattern, GoPlus says, is not a classic liquidity-pull honeypot: contracts can look normal while coordinated ownership and staged exits create the illusion of many independent traders.
Why GoPlus separates this cluster from Wazz’s. Both operations lean on Pons V2 rails, large wallet batches to hide supply concentration, and capital recycling from one launch into the next. The newer factory leans harder on short-history EOAs plus consolidation; Wazz’s earlier desk read described clusters of 70–200 wallets often holding over 70% of a token early. GoPlus says there is currently no evidence the two crews are the same operators—treat them as parallel suspected factories on the same chain until a primary links the wallets.
Venue context that raises the stakes. CryptoSlate, citing DefiLlama, puts Robinhood Chain above $1.5 billion TVL since its July 1 mainnet—under 90 days—while Token Terminal estimates about $50 million cumulative chain revenue in roughly three months (about $40 million of that in September alone in the chart CryptoSlate republished). Free gas for Robinhood Wallet users was already on a September 29 end clock (10311); a second suspected factory does not invent a new fee table, but it does sharpen why wallet warnings and supply-concentration screens matter before any brokerage-audience push onto the same L2.
What collectors should verify on-chain—without inventing convictions. Pull the consolidation address on Robinhood Chain’s Blockscout explorer, confirm recent two-way ETH flow still tracks GoPlus’s September 28 snapshot, and treat any new token that routes sells through PonsV2Helper into thin EOAs then 0x8c3Bad… as high-risk until proven otherwise. Cross-check holder screens: if a brand-new ticker shows a handful of 4-to-11-tx wallets dumping into the same sweeper within hours of mint, that is the GoPlus pattern—not “organic community distribution.” Do not invent that GoPlus froze funds, that Robinhood delisted the tokens, or that the ~$9.49 million two-way print equals stolen principal. Attribute factory status as GoPlus’s high-risk designation, and keep the address balance (~56 ETH at the snapshot) separate from the much larger turnover print.
Detection limits matter for wallets and launch UIs. Because the contracts can behave like ordinary memecoins—no forced sell-block, no instant LP yank—code-only scanners miss the coordination. The actionable signal is relational: shared consolidation, recycled seed capital, and staged sells across fresh EOAs. That is why a second factory on the same Pons V2 rail is desk-relevant even when GoPlus declines to merge it with Wazz’s earlier map.
What this tick is not. It is not Bitget’s USDT reopen (still 08:00 UTC September 30), not Comer’s prediction-market letter drop (10345), and not a rehash of Wazz’s 53-launch / $18.43 million extraction alone. The unused fact is GoPlus’s separate ~$9.49 million consolidation cluster with the named aggregator and the no-link caveat versus Wazz.
What to watch on-chain next: whether 0x8c3Bad30cc7563A2D0357F49509FFd063666bb00 keeps recycling fresh PonsV2Helper sell batches after September 28—and whether any primary ever bridges that wallet set to the Wazz $18.43 million cluster already on this tracker.
Bottom line: GoPlus flags a second suspected Robinhood Chain meme factory with ~$9.49 million two-way flow through 0x8c3Bad…—gross, not net—running parallel to Wazz’s ~$18.43 million cluster with no proven operator link yet.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
