Case file TK-b854841b3c: Unauthorized INU (UI) — G9nz…pump

Preview. The full pack (all transaction signatures, funding graph, per-wallet P&L, full timeline, printable HTML and PDF) needs a trial or paid API key: /signup (14-day free trial) or /pricing.

Summary

• Token UI (G9nz…pump) was created 2026-10-23 08:55:00 UTC by wallet 912k…ehJf.
• Market cap on the curve went from 46.0 SOL at the first trade to a peak of 253.4 SOL (238 s after creation) and 33.0 SOL at the last trade seen.
• 9 creator/early/group wallets realized +17.56 SOL on the curve; 17 public call(s) in the window.
• 8 wallets other than the creator bought 21.9% of supply in the creation slot 460382469 and the next 2 slots; 3 of them (7.5% of supply) are linked to the creator: they are in the creator's wallet group or also bought in the first slots of 2+ other launches by the same creator.
• The creator wallet bought 23.7% of supply and sold 100% of it; first sell 1 s after creation, realized +12.87 SOL.
• Within 15 minutes after the call by lil_cornfed at 2026-10-23 09:12:20 UTC, 3 wallets linked to the creator (creator, its wallet group, linked early buyers) sold 1.52 SOL (first sell 288 s after the call, versus 0.00 SOL in the 15 minutes before it); the market cap then fell 60% at its lowest within 1 h.
• Caller shanks10x (wallet AsBq…FJnc) bought 1.662 SOL of the token 1.4 min before posting the call, then sold 100% 1.9 min after it, while 134 other wallets bought 50.73 SOL between the call and that sell (caller net +2.276 SOL). pump.fun callouts are tied to a position, so the buy before the call is expected; the flagged part is selling into the post-call buying.

Subject

Detectors

Each detector reports on-chain facts only, with a confidence from 0 to 1 that the pattern is present (not a finding about intent or identity).

Public calls

Timeline

8 of 108 events shown (first buy per wallet; all creator trades; calls; peak; last trade).

Price impact (bonding curve, SOL market cap)

Supporting transactions

5 shown of 126. Every row can be checked on Solscan or any Solana node.

Limitations

• Bonding-curve trades on pump.fun only (decoded from public Solana data by our collector); trades after migration to a DEX and transfers outside the curve are not in P&L.
• P&L is in SOL, before fees and priority tips; unrealized value uses the last bonding-curve price, which a large sale could not achieve.
• Wallet links are statistical (shared creation-block buying, shared funding wallet, shared exchange deposit path); one person can use many wallets and unrelated people can share infrastructure such as bots.
• Caller (KOL) call times are pump.fun home-feed callout times; we link the caller's public X profile and, where we captured it, the post. Telegram calls are not collected.
• Exchange cash-out paths follow up to 3 hops of plain SOL/USDC transfers and stop at labeled exchange wallets; amounts are upper bounds of the traced wallet's money on that path.
• Collector gaps (RPC drops) can miss a small share of trades; transaction signatures can be checked independently on Solscan or any Solana node.

Integrity

SHA-256 of the full pack: 28d75c5f79a744d3afc93dd5c6212bf0c4a6aad57a75fffc5cb88ad3dfbdb860
Retrieved/built at: 2026-10-23 18:13:54 UTC
Method: JSON of the pack without the "integrity" field, keys sorted, separators (",", ":"), UTF-8, no ASCII escaping. Verify with the JSON from /v1/forensics/case/TK-b854841b3c: python3 -c "import json,hashlib,sys;p=json.load(open(sys.argv[1]));p=p.get('pack',p);p.pop('integrity',None);print(hashlib.sha256(json.dumps(p,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode()).hexdigest())" pack.json

Automated analysis of public blockchain data. Detectors report on-chain facts and patterns "consistent with" known manipulation techniques; they make no claim about the intent or identity of any person. Wallets are not linked to real identities. Exchange labels come from public datasets and can be wrong. Not legal, financial or investment advice. Corrections: admin@deepcounterfeit.com.