← Manipulation patterns · How each detector works · API: /v1/forensics/case/KOL-aafaab302c (JSON), ?format=html (printable), .pdf — full pack with a trial or paid key · MCP tool forensics_case

Case file KOL-aafaab302c: Caller 0xMartin — 6Fak…JX1d

Kind: kol · built 2026-10-23 18:17:09 UTC from the analysis snapshot of 2026-10-23 17:48:48 UTC (window 72 h) · builder cases-1.0

Preview. The full pack (all transaction signatures, funding graph, per-wallet P&L, full timeline, printable HTML and PDF) needs a trial or paid API key: /signup (14-day free trial) or /pricing.

Summary

On 20 of 26 calls of tokens it did not create, wallet 6Fak…JX1d bought before posting (median 0.3 min before) and sold 50%+ within 30 minutes after (median 2.5 min after the call) while other wallets were buying (325.43 SOL from 663 buys-by-wallet between the calls and the sells); net +7.488 SOL on those calls. pump.fun callouts are tied to a position, so holding before the call is expected; the flagged part is selling into post-call buying.
1 of 26 called tokens fell 50%+ below the call-time market cap within 1 h. This is a market outcome, not evidence of the caller's own selling; shown as context and not counted as a detector.

Subject

wallet	`6FaktzLtwfkwrQMv2nYnqLA6nGZ3jHCs78531GtgJX1d`
pumpfun handle	0xMartin
followers	2283
on public kol list	no
transfers from traced creators	0

Detectors

Each detector reports on-chain facts only, with a confidence from 0 to 1 that the pattern is present (not a finding about intent or identity).

Caller bought before its calls and sold into them fired · confidence 0.87 (high)
On 20 of 26 calls of tokens it did not create, wallet 6Fak…JX1d bought before posting (median 0.3 min before) and sold 50%+ within 30 minutes after (median 2.5 min after the call) while other wallets were buying (325.43 SOL from 663 buys-by-wallet between the calls and the sells); net +7.488 SOL on those calls. pump.fun callouts are tied to a position, so holding before the call is expected; the flagged part is selling into post-call buying.
False-positive risk: A caller can buy because they like the token and post it later; selling after posting can be ordinary profit-taking. We report timing only.
Evidence transactions: 2VsEd1…ib3oGL 37zSgU…1cjR65 4sCywE…Edu2vX

Called tokens fell 50%+ within 1 h (context, not a detector) not fired
1 of 26 called tokens fell 50%+ below the call-time market cap within 1 h. This is a market outcome, not evidence of the caller's own selling; shown as context and not counted as a detector.
False-positive risk: Many traders react to the same call; wallets of a group selling at once can also be one bot managing several wallets for unrelated reasons.

Calls (third-party tokens)

Token	First buy (UTC)	Call (UTC)	Min buy→call	Min call→sell	Bought SOL	Sold in 30 min	Others bought before caller sold	Net SOL	Mcap at call / min 1 h
FlingIt	2026-10-20 17:38:57 UTC	2026-10-20 17:43:01 UTC	4.1	24.7	2.6252	100% (6.9695 SOL)	105.0671 SOL / 164 wallets	+4.344	51.62 / -40%
FLAG	2026-10-20 21:03:37 UTC	2026-10-20 21:04:03 UTC	0.4	4.0	1.229	100% (1.7175 SOL)	13.6254 SOL / 24 wallets	+0.488	36.9 / -24%
SPG	2026-10-21 02:30:17 UTC	2026-10-21 02:30:27 UTC	0.2	0.3	1.1608	100% (1.3273 SOL)	1.0567 SOL / 4 wallets	+0.167	40.53 / -31%
AFLOW	2026-10-21 02:46:25 UTC	2026-10-21 02:46:46 UTC	0.4	2.6	1.0821	100% (1.1517 SOL)	8.5731 SOL / 22 wallets	+0.070	38.91 / -28%
PackManPad	2026-10-21 03:13:54 UTC	2026-10-21 03:15:19 UTC	1.4	2.7	1.0624	100% (1.0081 SOL)	5.1112 SOL / 16 wallets	-0.054	33.96 / -17%

Timeline

8 of 78 events shown (first buy per wallet; all creator trades; calls; peak; last trade).

Time (UTC)	Event	Wallet / caller	SOL	Tokens (% supply)	Mcap SOL	Tx / link
2026-10-20 17:38:57 UTC	caller buy (before call) FlingIt
2026-10-20 17:43:01 UTC	public call FlingIt
2026-10-20 18:07:41 UTC	caller sell (after call) FlingIt
2026-10-20 21:03:37 UTC	caller buy (before call) FLAG
2026-10-20 21:04:03 UTC	public call FLAG
2026-10-20 21:08:05 UTC	caller sell (after call) FLAG
2026-10-21 02:30:17 UTC	caller buy (before call) SPG
2026-10-21 02:30:27 UTC	public call SPG

Supporting transactions

5 shown of 61. Every row can be checked on Solscan or any Solana node.

Time (UTC)	Slot	Wallet	Role	Side	SOL	Tokens	Signature
2026-10-20 17:38:57 UTC	459315668	`6Fak…JX1d`	caller	buy	1.101195	24932716.0984	`2VsEd1…ib3oGL`
2026-10-20 17:42:44 UTC	459316710	`6Fak…JX1d`	caller	buy	1.523975	31519120.3031	`37zSgU…1cjR65`
2026-10-20 18:07:41 UTC	459323607	`6Fak…JX1d`	caller	sell	4.478894	31519120.3031	`4sCywE…Edu2vX`
2026-10-20 18:12:12 UTC	459324860	`6Fak…JX1d`	caller	sell	2.490613	26367615.7641	`4d55g3…cWFDKh`
2026-10-20 21:03:37 UTC	459372444	`6Fak…JX1d`	caller	buy	1.229012	33557231.3167	`59RbEn…ZVvdc6`

Limitations

Bonding-curve trades on pump.fun only (decoded from public Solana data by our collector); trades after migration to a DEX and transfers outside the curve are not in P&L.
P&L is in SOL, before fees and priority tips; unrealized value uses the last bonding-curve price, which a large sale could not achieve.
Wallet links are statistical (shared creation-block buying, shared funding wallet, shared exchange deposit path); one person can use many wallets and unrelated people can share infrastructure such as bots.
Caller (KOL) call times are pump.fun home-feed callout times; we link the caller's public X profile and, where we captured it, the post. Telegram calls are not collected.
Exchange cash-out paths follow up to 3 hops of plain SOL/USDC transfers and stop at labeled exchange wallets; amounts are upper bounds of the traced wallet's money on that path.
Collector gaps (RPC drops) can miss a small share of trades; transaction signatures can be checked independently on Solscan or any Solana node.

Integrity

SHA-256 of the full pack: 2d7177b86b4a1d3ceb298556cf579822ad0b4bb2094ed30f5e5eca6a8f8ee7de
Retrieved/built at: 2026-10-23 18:17:09 UTC
Method: JSON of the pack without the "integrity" field, keys sorted, separators (",", ":"), UTF-8, no ASCII escaping. Verify with the JSON from /v1/forensics/case/KOL-aafaab302c: python3 -c "import json,hashlib,sys;p=json.load(open(sys.argv[1]));p=p.get('pack',p);p.pop('integrity',None);print(hashlib.sha256(json.dumps(p,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode()).hexdigest())" pack.json

Automated analysis of public blockchain data. Detectors report on-chain facts and patterns "consistent with" known manipulation techniques; they make no claim about the intent or identity of any person. Wallets are not linked to real identities. Exchange labels come from public datasets and can be wrong. Not legal, financial or investment advice. Corrections: admin@deepcounterfeit.com.