r來自一般使用者的行為。

歐普推廣通路

behavior from normal user behavior, thereby improving the deceptiveness of the scam.

行為與正常用戶行為不同，從而提高詐騙的欺騙性。

In addition, we also found that the infrastructure addresses used by the Rug Pull gang are not limited to the above two addresses. There are also some infrastructure addresses that are used less frequently and are not included in the above statistics. These infrastructure addresses are mainly used to cash out the proceeds of Rug Pull scams through centralized exchanges or flash exchange platforms.output: Web3 scams are rampant

此外，我們也發現Rug Pull集團使用的基礎設施地址並不限於上述兩個地址。還有一些基礎設施地址使用頻率較低，未包含在上述統計中。這些基礎設施位址主要用於透過中心化交易所或閃兌平台套現Rug Pull詐騙收益。

In the Web3 world, new tokens are constantly emerging. Have you ever wondered how many new tokens are issued every day? Are these new tokens safe?

在Web3世界中，新的代幣不斷湧現。您有沒有想過每天會發行多少新代幣？這些新代幣安全嗎？

These questions are not without purpose. In the past few months, the CertiK security team has captured a large number of Rug Pull transaction cases. It is worth noting that the tokens involved in these cases are all new tokens that have just been listed on the chain.

這些問題並非沒有目的。在過去的幾個月裡，CertiK安全團隊捕獲了大量的Rug Pull交易案例。值得注意的是，這些案件涉及的代幣都是剛上鍊的新代幣。

Subsequently, CertiK conducted an in-depth investigation of these Rug Pull cases and found that there were organized criminal gangs behind them, and summarized the pattern characteristics of these scams. Through in-depth analysis of the modus operandi of these gangs, CertiK discovered a possible fraud promotion channel for Rug Pull gangs: Telegram groups. These gangs used the "New Token Tracer" function in groups such as Banana Gun and Unibot to attract users to buy fraudulent tokens and ultimately make profits through Rug Pull.

隨後，CertiK對這些Rug Pull案件進行了深入調查，發現其背後存在有組織的犯罪團夥，並總結了這些騙局的模式特徵。透過深入分析這些團體的作案手法，CertiK發現了Rug Pull集團可能的詐騙推廣管道：Telegram群。這些團體利用Banana Gun、Unibot等團夥中的「New Token Tracer」功能，吸引用戶購買詐欺代幣，最終透過Rug Pull獲利。

CertiK counted the token push information of these Telegram groups from November 2023 to early August 2024, and found that a total of 93,930 new tokens were pushed, of which 46,526 involved Rug Pull tokens, accounting for as high as 49.53%. According to statistics, the cumulative investment cost of the gang behind these Rug Pull tokens was 149,813.72 ETH, and they made a profit of 282,699.96 ETH with a return rate of up to 188.7%, equivalent to about US$800 million.

CertiK統計了2023年11月至2024年8月上旬這些Telegram群的代幣推送訊息，發現共推送了93,930個新代幣，其中46,526個涉及Rug Pull代幣，佔比高達49.53%。根據統計，這些Rug Pull代幣背後的團體累計投資成本為149,813.72 ETH，獲利282,699.96 ETH，回報率高達188.7%，相當於約8億美元。

To assess the percentage of new tokens pushed by Telegram groups on the Ethereum mainnet, CertiK counted the new tokens issued on the Ethereum mainnet during the same time period. The data shows that a total of 100,260 new tokens were issued during this period, of which 89.99% were pushed through Telegram groups. On average, about 370 new tokens were born every day, far exceeding reasonable expectations. After continuous and in-depth investigation, we found the truth that was disturbing - at least 48,265 of them were involved in Rug Pull scams, accounting for as high as 48.14%. In other words, almost one in every two new tokens on the Ethereum mainnet is involved in a scam.

為了評估 Telegram 群組在以太坊主網上推送的新代幣的百分比，CertiK 統計了在同一時間段內以太坊主網上發行的新代幣。數據顯示，這段時期共發行了100,260個新代幣，其中89.99%是透過Telegram群推送的。平均每天約有370個新代幣誕生，遠超合理預期。經過持續深入的調查，我們發現了令人不安的真相——其中至少有48,265人參與了Rug Pull詐騙，佔比高達48.14%。換句話說，以太坊主網路上幾乎每兩個新代幣就有一個涉及騙局。

In addition, CertiK has found more Rug Pull cases in other blockchain networks. This means that the security situation of not only the Ethereum mainnet, but also the entire Web3 new token ecosystem is far more severe than expected. Therefore, CertiK wrote this research report, hoping to help all Web3 members raise their awareness of prevention, stay vigilant in the face of endless scams, and take necessary precautions in time to protect their assets.

此外，CertiK在其他區塊鏈網路中也發現了更多Rug Pull案例。這意味著，不僅是以太坊主網，整個Web3新通證生態的安全情勢也遠比預想的要嚴峻。因此，CertiK撰寫了這份研究報告，希望能夠幫助所有Web3會員提高防範意識，面對層出不窮的騙局保持警惕，及時採取必要的預防措施，保護自己的資產。

ERC-20 Token

ERC-20代幣

Before we officially start this report, let's first understand some basic concepts.

在正式開始本報告之前，我們先來了解一些基本概念。

ERC-20 tokens are one of the most common token standards on the blockchain today. They define a set of specifications that allow tokens to interoperate between different smart contracts and decentralized applications (dApps). The ERC-20 standard specifies the basic functions of tokens, such as transfers, balance inquiries, and authorization of third parties to manage tokens. Thanks to this standardized protocol, developers can more easily issue and manage tokens, thus simplifying the creation and use of tokens. In fact, any individual or organization can issue their own tokens based on the ERC-20 standard and raise start-up funds for various financial projects through pre-sale tokens. Because of the widespread use of ERC-20 tokens, it has become the basis for many ICOs and decentralized financial projects.

ERC-20 代幣是當今區塊鏈上最常見的代幣標準之一。他們定義了一組規範，允許代幣在不同的智能合約和去中心化應用程式（dApp）之間進行互通。 ERC-20標準規定了代幣的基本功能，如轉帳、餘額查詢、授權第三方管理代幣等。由於這種標準化協議，開發者可以更輕鬆地發行和管理代幣，從而簡化代幣的創建和使用。事實上，任何個人或組織都可以基於ERC-20標準發行自己的代幣，並透過預售代幣籌集各種金融專案的啟動資金。由於ERC-20代幣的廣泛使用，它已成為許多ICO和去中心化金融項目的基礎。

USDT, PEPE, and DOGE, which we are familiar with, are all ERC-20 tokens, and users can buy these tokens through decentralized exchanges. However, some fraud gangs may also issue malicious ERC-20 tokens with code backdoors, list them on decentralized exchanges, and then induce users to buy them.

我們熟悉的USDT、PEPE、DOGE都是ERC-20代幣，用戶可以透過去中心化交易所購買這些代幣。不過，一些詐騙集團也可能發行帶有代碼後門的惡意ERC-20代幣，在去中心化交易所上市，然後誘導用戶購買。

Typical scam cases of Rug Pull tokens

Rug Pull 代幣典型詐騙案例

Here, we use a Rug Pull token scam case to gain a deeper understanding of the operation mode of malicious token scams. First of all, it should be noted that Rug Pull refers to a fraudulent act in which a project party suddenly withdraws funds or abandons a project in a decentralized financial project, causing investors to suffer huge losses. Rug Pull tokens are tokens issued specifically for the purpose of implementing such fraudulent acts.

在這裡，我們透過一個Rug Pull代幣詐騙案例來更深入地了解惡意代幣詐騙的運作模式。首先要說明的是，Rug Pull是指去中心化金融項目中專案方突然撤資或放棄項目，導致投資者遭受巨大損失的詐欺行為。 Rug Pull 代幣是專門為實施此類詐欺行為而發行的代幣。

The Rug Pull tokens mentioned in this article are sometimes also

本文中提到的 Rug Pull 代幣有時也是