Initial report regarding Suspected Aoa Rugs/Scams

---

I have mapped out a series of transactions showing with high confidence that @TheAngelOfAres was involved in over 50 different rug pulls. Some of these were meme coins. However, many of these tokens attempted to masquerade as legitimate Algorand or general blockchain projects, such as @FolksFinance, @TeamAlgogator, @algofiorg, @AlgodexOfficial, @AsaNexus, @CoolDWNGG, @MetaPunksOG, AlgoVanity, AlgoOptimizer, @purestakeco, @moonpay, @BleumiInc, @stablecorp, and others. 

The vast majority of these tokens go back to the period of November/December 2021 (when ALGO price was at its peak). However, I have discovered at least two tokens from as recent as June 2023. One of these recent tokens appears to have been an attempt at a rugpull that was foiled by arbitrage bots as a result of mismatched liquidity pool contributions. The other recent token was a successful rugpull operated under the account @MagicOnAlgo.

All of my work related to this initial report is laid out in a detailed transaction map, with relevant hyperlinks. View that transaction map here. However, I will attempt to summarize my initial findings here. To assist in directing you to where to look in the map as I explain it here, I have annotated the map with various numbers which I will reference in brackets (e.g. [1], [2], [3]) or will provide with direct hyperlinks, as appropriate.

To understand the visual map I created and how it lays out the connections between Angel and the scam/rug tokens, it is first helpful to explain how exchange deposit addresses work. On most exchanges, when you create an account on their platform or attempt to deposit crypto, they will create a unique deposit address for your account. For exchanges that do not require KYC, they will create a unique deposit address for each account you open. 

When you deposit Algo to the exchange, you send it to the unique deposit address associated with whatever account you are trying to fund. It is then credited as belonging to your account in their bookkeeping, and then swept into one of the exchanges’ hot wallets where it becomes mixed in with everyone else’s assets. However, because exchange deposit addresses are unique to a particular account on that exchange, they are helpful in identifying non-custodial wallets that are owned by the same person based on deposits to that address. It is highly irregular for anyone to send funds to a deposit address unless they either own the address or are directly instructed by the owner to send funds there.

Angel is the owner of the XPKN wallet.[1] We know this because both his Reddit account and his Twitter account have used this address for airdrops. Here are just two examples.  The map linked above includes many more. Screenshots have been taken as backup in case those posts/comments are deleted. As additional circumstantial evidence of Angel’s ownership of XPKN, that wallet has on several occasions sent transactions to Angel.Algo. [2] Further, the XPKN wallet was the first wallet to transact with the OUSY Kucoin Deposit Address (after Kucoin set it up) and has regularly deposited funds into the OUSY Adress. [3] This OUSY Deposit Address is where Angel’s other well-known wallets have regularly deposited funds afterward. [4]

On November 25, 2021, Angel’s XPKN wallet deposited 50 Algo into the OUSY Deposit address. This was then immediately swept into the Kucoin hot wallet IMGM. [5]  Later that same day (Nov. 25), the IMGM Kucoin exchange wallet funded the RYPZ wallet with 49.9 Algo. [6] That RYPZ wallet, in conjunction with the ZS52 wallet (which was itself funded by RYPZ), carried out the first rug pull for a token called “Why Not”. [6] 

RYPZ created Why Not Token. RYPZ then seed funded ZS52 with ~44 Algo total and 75% of of the token supply. RYPZ then created a Tinyman Pool with the remaining 25% of token supply and most of its remaining Algo. Presumably, by sending 75% of the supply to ZS52, the RYPZ wallet made it appear that the token was fully circulating. ZS52 later returned its 75% of token supply to RYPZ along with 5 Algo. RYPZ proceeded to add liquidity in small increments and in very quick succession (example 1, 2, 3, 4, 5). This LP baiting was done many times and very quickly (see LP Pool Token on Algoexplorer). Eventually, RYPZ rugged. 

On November 26, 2021, after completing the rug, both RYPZ and Ztheir proceeds back to the OUSY Deposit Address. [5] RYPZ closed out its remaining balance (~43.7 Algo) to the OUSY KuCoin Deposit address in two transactions (see 1, 2).  ZS52 closed out its account and sent its remaining balance of ~39.2 Algo to the OUSY Kucoin Deposit Address.

At this point, Angel appears to have set up a new account at Kucoin for purposes of carrying out an extensive series of rugpulls and scam tokens, which will be discussed later. At the time, Kucoin was non-KYC, and thus users could create new accounts simply by signing up with a new email address. This new Kucoin account used the YHND Deposit Address. [7]

I believe that Angel controlled the YHND Kucoin Deposit Address for two reasons: (1) the timing and amounts relating to the user wallet that funded it make it abundantly clear that it came from the proceeds of the RYPZ and ZS52 wallets; and (2) Angel’s other controlled wallets have deposited funds to YHND both directly and indirectly. 

First, the timing and amounts used make it abundantly clear that YHND was funded using a wallet that was tied to the the proceeds from the RYPZ and ZS52 wallets. On November 26, 2021, right after the RYPZ and ZS52 wallets deposited their proceeds to the OUSY Deposit Address, those deposits were swept into the IMGM Kucoin Hot Wallet at round 17660762. That combined deposit was 83.029735 Algo. 

Minutes later, at round 17661028, a Kucoin (i.e. Angel) user initiated a transaction that caused the IMGM Kucoin Hot Wallet to fund the PWEM wallet with 82.930569 Algo. [8] That PWEM wallet engaged in a rug pull, which we will discuss later. However, importantly, that PWEM wallet is also the first user wallet to interact with the newly created YHND Kucoin Deposit Address. Specifically, after completing its rugpull, it sent 194.117063 Algo to the YHND Deposit Address. [7]

Second, there is circumstantial evidence that Angel controlled the YHND Kucoin Deposit Address because his wallets deposited into the YHND Deposit Address on multiple different occasions. On two separate occasions, his XPKN wallet sent funds directly to the YHND Deposit Address (see 1, 2). [9]

In addition to direct deposits from XPKN, other wallets that appear to have been under his control made deposits. For instance, on November 29, 2021, the 5SK3 wallet sent ~1,802 Algo to YHND . [9] All of these funds originated from Angel’s XPKN wallet. First, XPKN sent Algos to the Z5ZQ wallet in a series of transactions (see 1, 2, 3).  The Z5ZQ wallet then sent these funds to 5SK3 in a series of two transactions (see 1, 2). XPKN also then sent funds directly to 5SK3 in two transactions (see 1, 2). The 5SK3 wallet then closed out its entire balance to the YHND Deposit Address. 

Finally, the DDCY wallet issued 5 different deposit transactions to YHND. [10] The DDCY wallet appears to be another wallet controlled by Angel. It was funded by Kucoin and largely transacted in trading Curator Coin, Ignite Tokens, and a handful of other questionable ASAs. However, when the wallet ended up closing out, it sent all of its remaining ASA’s to Angel’s XPKN wallet and then closed out to the XPKN Wallet (see 1, 2, 3, 4). 

I have identified well over 50 different rugpulls/scam token projects tied to the YHND Deposit Address. [11] The associated map provides relevant links/descriptions for each of those rugpulls/scams. 

While I will not recount all of the rugpulls/scams here, I will provide a few examples. For instance, at [8] we can see that the PWEM wallet was funded with 82.930569 Algo from the Kucoin Exchange Address and then immediately created Nemesis Token. It then created an LP on Tinyman and added 25% of the token supply plus 5 Algo as initial liquidity. PWEM then proceed to add further liquidity in small increments and in very quick succession (example 1, 2, 3, 4, 5). This LP baiting was done many times and in quick succession (see LP Pool Token on Algoexplorer). Shortly after people started buying it, PWEM rugged its liquidity, then started selling on those that added liquidity. It then swept its proceeds of 194.117063 Algo to the YHND Kucoin Deposit Address. PWEM, as you will recall from earlier, is the address that first interacted with the YHND Deposit Address and provided its initial funding. [8]

In addition to tokens with no name recognition, Angel also created many scam/rug tokens that attempted to masquerade as legitimate Algorand projects. For example, at [12] we can see the L3V5 wallet received 425 Algo from Kucoin and then immediately created a scam token called “AlgoLend”. This token was attempting to trick people into thinking it was from Folks Finance. Before becoming better known as Folks Finance, Folks was known as AlgoLend. Not only is the token named AlgoLend, but they listed Folks' real website as the token's website. L3V5 then created an LP on Tinyman and added 95% of the token supply plus 400 Algo. L3V5 then proceeded to add further liquidity in small increments and in very quick succession (example 1, 2, 3, 4, 5). This LP baiting was done many times and very quickly. (see LP Pool Token on Algoexplorer). Shortly after people started buying it, L3V5 rugged its liquidity, then started selling on those that had added liquidity. It then swept its proceeds of ~537.986626 Algo to the YHND Kucoin Deposit Address. [12]

Likewise, at [13] we can see the X2HJ wallet  received 883.9 Algo from Kucoin and then immediately created a scam token that was attempting to trick people into thinking it was from AlgoFi. [13] Not only is it named “AlgoFi”, but they listed AlgoFi's real website as the token's website. X2HJ then created an LP on Tinyman and added 800 Algo plus 85% of the token supply as initial liquidity. X2HJ then proceeded to add liquidity in small increments and in very quick succession (example 1, 2, 3, 4, 5). This LP baiting was done many times and very quickly (see LP Pool Token on Algoexplorer). X2HJ then started buying (example 1, 2, 3) and selling (example 1, 2, 3) its own fake AlgoFi Token. Eventually, X2HJ rugged and then sold off some of its tokens on others that had provided liquidity, then sold most or all of its remaining tokens. X2HJ then transferred its balance of 1,040.520447 Algo to the YHND Kucoin Deposit Address. [13]

Similarly, at [14] we can see that the A4II wallet was funded by 220 Algo from the Kucoin exchange and then immediately created a scam token that was attempting to trick people into thinking it was from AlgoGator. Not only was it named “AlgoGator”, but they listed AlgoGator's real website as the token's website. A4II then created an LP on Tinyman and added 150 Algo plus 60% of the token supply as initial liquidity. A4II then proceeded to add liquidity in small increments and in very quick succession (example 1, 2, 3, 4, 5). This LP baiting was done many times and very quickly (see LP Pool Token on Algoexplorer). A4II then started selling (example 1, 2, 3, 4, 5) its own fake AlgoGator Token. Eventually, A4II rugged and then sold off most of its tokens on others that had provided liquidity, then sold more. A4II then sent its balance of 521.471604 Algo to the YHND Kucoin Deposit Address. [14]

After recounting this first handful of rugs/scams in detail, I opted to just provide basic links for the remainder of the rugpulls/scams in the map. They tend to all follow the same pattern: the wallet is funded by Kucoin, a token is created, the wallet creates an LP,  then begins to add liquidity in small increments to bait others to buy and/or add liquidity, and shortly after people start buying the LP is rugged and the proceeds are swept into the YHND Deposit address. 

A few things are worth pointing out as you click through the map. First, though I hyperlink to the instance when the project rugs, it is important to know that this does not capture the full value of the rug. After rugging, the wallet often would either need to claim “excess” tokens from Tinyman to get all of its Algos, and/or would then sell off its tokens on anyone who had also provided liquidity. I generally did not add  hyperlinks to each of those “claim” or “sell off” transactions as it added a significant burden to an already time intensive process. Second, though the amounts at stake may seem trivial now (a few dozen to a few hundred Algo for each scam), it is important to note that these scams were undertaken when Algo’s price was between $1.50 and $2. 

Angel is the owner of the VNU2 Wallet (a/k/a “Hackerman”). [15] In a now-deleted Tweet, Angel was demonstrating his mass opt out tool by doing a video capture of his Pera wallet. As he scrolled down, two wallet addresses were visible (VNU2R7 . . .4GUMWY and LVD5UK . . .5FGFWU). You can tell that these are not "watched" accounts based on the blue wallet icons next to them. Further, you can tell that this video must have been captured by Angel as he is also the controller of the LVD5 wallet, which is located elsewhere in the transaction map. [16]

Accepting that Angel is the owner of the VNU2 Wallet, then we can also accept that he is the controller of the ZABT Kucoin Deposit Address, which is where the VNU2 Wallet deposited the bulk of its funds. [17] The ZABT Deposit Address has only ever received user deposits from VNU2 and from ECLA, which we will discuss below. It would be highly irregular for a user to deposit funds to an exchange deposit address that they do not control. 

The ZABT Deposit Address Owner (i.e. Angel) engaged in rugpulls as recently as June 2023. The first of these was an attempted rugpull that failed do to errors in how liquidity was added. The second, however, was a successful rugpull after having learned the errors of the first failed rug. 

First, the VNU2 wallet [15] was funded by MEXC with 606.32 Algo and later another 249.9 Algo injection. Right after the initial funding VNU2 then created SNEK Token (1104454952). VNU2 then made four swaps (each of 100 Algo) to acquire USDC, Vestige, and Pepe. VNU2 then used 100 Algo combined with 69.42B SNEK to create an Algo/Snek LP. It then created additional LPs using the full amount of USDC, Vestige, and Pepe it had acquired earlier, however it only added 1,000 SNEK into those LPs.

This caused a liquidity mismatch. These liquidity mismatches allowed bots to eat up the arbitrage opportunity (e.g. 1, 2). VNU2 tried to save itself by buying up tokens (e.g. 1, 2, 3) and adding more LP (e.g. 1, 2, 3) at various points, however, it eventually gave up and emptied its liquidity for the Vestige, USDC, Pepe, and Algo LPs. 

Learning from this, the ZABT Deposit Address Owner (i.e. Angel) funded the ECLA wallet from MEXC with 409.4 Algo on June 8, 2023. [18]  Right after, it created MAGIC Coin (1120414722). ECLA then made some swaps and used the proceeds to set up liquidity pools involving USDC, Vestige, COOP, Deflyand ALGO.

That same day, a profile on Twitter called @MagicOnAlgo then began advertising the coin and encouraging opt-ins. The profile stated that 25% of supply was in the liquidity pools and that the remaining supply would be "50% Free Airdrop for NFD Holders [and] 25% Accelerated LP Rewards." Continuing from June 8 through June 9, the profile continued to hype the project, its price rise, teased a vague additional giveaway,  encouraged people to add liquidity on multiple occasions, and utilized other projects to spread the word by giving them tokens to airdrop their holders.

Meanwhile, ahead of its first "LP rewards" airdrop, ECLA started removing its liquidity from pools in multiple transactions (see here, here, here, here, here, here, here, here, here, here, and here) and then completely opted out of all LPs (see here, here, here, here, and here). ECLA then sold 2.5% of supply (250k tokens). When questioned about this, @MagicOnAlgo claimed that they errantly had tried sending the rewards to the LP contract address, but since that wouldn't distribute liquidity to holders, they sold supply because that "achieves the same goal." ECLA proceeded to swap its Algo, USDC, Vestige, and Defly to COOP. ECLA later swapped between COOP and ALGO a couple times before settling in Algo and sending 2600A to the ZABT Kucoin Deposit Address.

The write up above and the associated transaction map are only an initial report. However, in my opinion it paints a very convincing picture that TheAngelOfAres has been behind dozens of scams, starting at least as early as November 2021 and continuing as recently as June 2023, siphoning off thousands of dollars from unwitting victims. The fact that something is not documented here does not mean that it has been ruled out. There are additional leads I am looking at and I may supplement with a new map/report. However, these initial findings present a cohesive structure worth publishing. If you have new or additional information and wish to share it, send it to the.governors.hat@gmail.com.