r from normal user behavior.

behavior from normal user behavior.

In addition, we also found that the addresses that split the funds are usually the addresses that receive the funds from the centralized exchanges, which further confirms our previous speculation that the Deployer obtains the start-up funds through withdrawals from centralized exchanges to create Rug Pull tokens and corresponding liquidity pools.

Telegram groups

In the previous section, we mentioned that Rug Pull gangs usually use ETH to purchase Rug Pull tokens to simulate normal liquidity pool activities, thereby attracting new robot purchases. In fact, this is not the only method used by Rug Pull gangs to attract users.

In addition to using ETH to purchase Rug Pull tokens, Rug Pull gangs will also use Telegram groups to push new tokens and directly promote Rug Pull tokens. In order to obtain more users to buy Rug Pull tokens, the gangs will cooperate with some Telegram groups to push new tokens and directly promote Rug Pull tokens in the groups.

To verify this possibility, we crawled and analyzed the historical push records of several Telegram groups with a large number of members and high activity, and counted the number of Rug Pull tokens pushed by these groups.

Among them, the Telegram groups we crawled include Banana Gun, Unibot, Apebot, and Chainlink Alert. These groups have a large number of members and high activity. They are also the main channels for users to obtain new token information. Among them, Banana Gun and Unibot are the groups with the largest number of members and the highest activity.

The statistics of the Rug Pull tokens pushed by the Telegram groups are shown in Table 4.

It can be seen from Table 4 that a large number of Rug Pull tokens were pushed in the Telegram groups during the period from November 2023 to early August 2024. Among them, Banana Gun pushed the largest number of Rug Pull tokens, reaching 31,664. In addition, the total number of Rug Pull tokens pushed by all Telegram groups reached 46,526, accounting for nearly half (49.53%) of the total number of tokens pushed.

According to our statistics, the cumulative investment cost of the Rug Pull gang behind these Rug Pull tokens was 149,813.72 ETH, and they made a profit of 282,699.96 ETH with a return rate of up to 188.7%, equivalent to about US$800 million.

In order to further understand the scale of the Rug Pull gang's use of Telegram groups, we counted the number of new tokens pushed by Telegram groups on the Ethereum mainnet during the same time period. The data shows that a total of 100,260 new tokens were issued on the Ethereum mainnet during this period, of which 89.99% were pushed through Telegram groups.

On average, about 370 new tokens were born every day, far exceeding reasonable expectations. After continuous and in-depth investigation, we found the truth that was disturbing - at least 48,265 of them were involved in Rug Pull scams, accounting for as high as 48.14%. In other words, almost one in every two new tokens on the Ethereum mainnet is involved in a scam.

In addition to the Ethereum mainnet, CertiK has also found more Rug Pull cases in other blockchain networks. This means that the security situation of not only the Ethereum mainnet, but also the entire Web3 new token ecosystem is far more severe than expected.output: In the past few months, the CertiK security team has captured a large number of Rug Pull transaction cases. It is worth noting that the tokens involved in these cases are all new tokens that have just been listed on the chain.

Subsequently, CertiK conducted an in-depth investigation of these Rug Pull cases and found that there were organized criminal gangs behind them, and summarized the pattern characteristics of these scams. Through in-depth analysis of the modus operandi of these gangs, CertiK discovered a possible fraud promotion channel for Rug Pull gangs: Telegram groups. These gangs used the "New Token Tracer" function in groups such as Banana Gun and Unibot to attract users to buy fraudulent tokens and ultimately make profits through Rug Pull.

CertiK counted the token push information of these Telegram groups from November 2023 to early August 2024, and found that a total of 93,930 new tokens were pushed, of which 46,526 involved Rug Pull tokens, accounting for as high as 49.53%. According to statistics, the cumulative investment cost of the gang behind these Rug Pull tokens was 149,813.72 ETH, and they made a profit of 282,699.96 ETH with a return rate of up to 188.7%, equivalent to about US$800 million.

To