Malfoid: launch coordination, trader activity and promotion

A forensic review of Female Draco Malfoy on Solana. Trade coverage: launch on 1 October 2026 at 08:37:03 UTC through 04 October 2026, 23:15:02 UTC. A separate holder-state snapshot was retrieved at 23:51:49 UTC.

Finding: Malfoid had a coordinated launch pair, an immediate sale of the deployer’s direct allocation, substantial automated trading and a later promotional campaign. The deployer sold its initial position within 22 seconds, while the coordinated second wallet retained half its allocation. The evidence does not establish one cabal controlling the entire later rise.

This report separates cryptographically verifiable transactions, public provider labels and behavioral inferences. The ledger counts swaps and observable wallet addresses. It cannot count distinct human beings or identify every wallet under common control.

Exact mint: 6zzzG49KX5nksnqfogs31dwoMYSHaJXkropKbv1QZVga

The word "user" is necessarily limited here: a person can operate several wallets, a wallet can be controlled by software or several people, and relayers can pay fees for other traders. Holder counts, fee-payer counts, swap-event user fields and trading-wallet counts are different measurements.

1. What was indexed, and how complete is it?

The signature inventory contains 37,337 distinct transaction references through slot 453401116: 24,353 successful and 12,984 failed. Histories for the mint, original bonding curve and main PumpSwap pool were paginated to their ends. All successful transaction bodies in this inventory were requested; current retrieval completeness is 24,353/24,353. Failed transactions are preserved in the signature inventory and excluded from executed-trade counts.

Swaps were decoded from the official Pump and PumpSwap event schemas, scoped to the actual program invocation and the target mint. Event payloads repeated by CPI logging were deduplicated. Transfers, liquidity operations, account cleanup, reward distributions, failed attempts and conditional bot instructions that did not execute a swap do not count as trades. [1]

Additional pool discovery was cross-checked against account ownership. The actual Meteora pool had one initialization transaction and no observed swap history at the cutoff. Two purported closed pools had no signature histories; another provider-labelled pool was actually a token vault. The Meteora initialization was already included in the mint inventory. This is complete coverage of the enumerated successful transaction histories, not a guarantee that every unknown custom venue can be decoded from public event logs.

Attribution first uses the event user when it is a transaction signer. For routed trades, it uses the sole signer owning a direction-consistent token-balance change; a sole originating signer can be used for a zero-net multi-leg route. Ambiguous cases remain unresolved. Sponsored fee payers and router program accounts are not automatically treated as traders. The CSV preserves event user, fee payer, attributed wallet, attribution rule and validation status for audit.

Technical coverage: 0 unknown target pools, 0 unmatched event-CPI payloads and 0 non-extension decoding/read errors. Known events with trailing fields are retained only where their core fields can be read; the unparsed extensions and balance-validation exceptions remain in the evidence files. Consult coverage.json and decoder-review.txt for the exact limitations.

The first 26 seconds received a separate full-block audit: 102 consecutive blocks, 9,174 mint references, 8,161 failed attempts, 1,013 successful transactions and only 148 real trades by 87 wallets. The other 865 successful transactions did not trade this token. This distinction materially changes any apparent launch-volume or launch-user story.

2. The launch pair and the deployer’s exit

The deployer is WnBVqVTaiJk5hNbcwbHiffRVnMdf1aaxNU5JkSpvGub, publicly displayed on Pump as "early". This is confirmed by the creation transaction signer and CreateEvent.user. The creator field shown by some scanners points instead to the holder-rewards program-derived account 9w77zeGGmtNxH5yShwr1XYRRoCBqYdCdqgDG7pyLQQ6; treating that account as the human deployer would be an attribution error. [2] [3]

The deployer’s gross trading profit was 5.579841276 SOL. After curve fees its swap cash flow was 5.385093233 SOL. Its actual SOL balance gain across the 24 successful buy/sell transactions was 4.964201592 SOL, after the other debits and credits in those transactions. This final figure excludes separate failed attempts, later rent recovery and later rewards; it is not an audited lifetime profit. [4]

The following buyer is 6Hvn5eyCEkUPsGb9YuXeGuPvdnUZ7vKwjX4DV8QxiRWm. Adjacency alone would be weak ownership evidence, but the funding audit found three earlier transactions co-signed by these two wallets, each transferring 1 SOL directly from this buyer to the deployer. They occurred on 30 September at 17:03:38 and on 1 October at 05:37:57 and 07:48:46 UTC. [5] [6] [7]

At 08:33:37 UTC, just 3m26s earlier, the same two wallets used the identical 5 SOL / 1 SOL allocation pattern on The Odyssean Seal, again in consecutive transaction positions. Earlier joint launch workflows also redistributed quote tokens between the two. This supports high-confidence repeated launch coordination. It does not establish a single beneficial owner, a specific Jito bundle ID or control of unrelated traders. [8] [9]

The coordinated pair did retain exposure. At 08:37:39 UTC, the following buyer sold half its allocation, receiving 0.880444697 SOL after curve fees against its initial 1.0125 SOL outlay. It retained 12,773,809.523810 tokens, matching the later holder snapshot. Therefore, the deployer wallet’s zero balance should not be read as proof that the coordinated group had no continuing economic interest. Common ownership of the two wallets remains unproven.

A third launch-slot buyer, CHzNxiDnfpjC6iwfCurswe1itXH4jzbcqik9YFzG3kre, acquired 78.338 million tokens using a different transaction construction, including a durable nonce and a 0.068 SOL Jito tip. It is a reasonable sniper candidate, but the evidence reviewed does not place it inside the launch pair. Shared services, shared exchanges or dust transfers would also be insufficient on their own.

3. How many wallets traded, and how concentrated was activity?

The index attributes at least 1,838 distinct trading wallets across 8,514 nonprotocol swap events. There are 8,512 distinct nonprotocol swap transactions; a routed transaction can contain more than one swap. Another 29 swaps are protocol BOOST buys, excluded from the wallet and behavior counts. The 16 unresolved routed events could include additional wallets, so the attributed count is a lower bound, not an exact count of people.

Active-wallet counts overlap between dates. New-wallet counts use each wallet’s first observed swap in this token. The last date ends at 23:15:02 UTC, and the first begins at creation. Gross SOL adds buy and sell principal and therefore counts capital each time it is reused.

Among attributed wallets, 1,809 bought and 1,613 sold. These sets overlap; seller-only wallets can have received tokens through transfers or custody arrangements.

That means 1,584 wallets both bought and sold, 225 only bought, and 29 only sold in the attributed ledger.

Across venues, buy principal totals 2,608.847554 SOL and sell principal 2,445.458168 SOL. Pool fees total 61.331301 SOL, excluding network fees, tips and rent. Venue wallet counts overlap and must not be added to infer total participants.

The ten highest-volume wallets account for 15.32% of nonprotocol principal volume. The ten most frequent wallets account for 15.47% of swap events. These are two independently ranked sets. Such concentration can coexist with a long list of small holders.

Full addresses and every wallet aggregate are in wallets.csv. Swap cash flow means sell proceeds minus buy outlay after pool fees. It is not profit: it excludes the value of unsold inventory, transferred-in tokens, network fees, tips, account rent and outside transfers. A positive cash flow can result from selling tokens acquired elsewhere.

A mechanical screen found 1,188 consecutive exact-quantity buy/sell round trips within ten minutes, involving 619 wallets. Those pairs represent 23.28% of principal volume. This is a fast-trading indicator, not a measured wash-trading percentage: legitimate sniping, arbitrage, copy trading and market making can produce the same pattern.

4. Suspicious clusters: evidence and alternative explanations

A second directly coordinated pair. HL9rRBGSQRaeCqCXtFcraHBkx2mLBHnGEQpNqiPpuk3b and JNpVNLrY5b1wkHBx6grNmHge6Zi8K5uqAbZGFBxLSmv both signed one transaction executing two buys at 08:57:45 UTC on 1 October, and both signed another executing two sells at 08:59:15. Each spent 0.27 SOL on entry. This proves joint trade execution across the two wallets and explains why swap-event and transaction totals differ. It does not connect them to the deployer or establish that their round trip was fraudulent. [10] [11]

Copy-trading example. 2tgUbS9UMoQD6GkDZBiqKYCURnGrSb6ocYwRABrSJUvY and 38KJ8WdxDmdRGHscd3kkXoDsinsFzxoF5mHWbvbX9gXd bought at about 19:55:46 UTC on 4 October and sold at 19:56:27; they bought again at 21:15:05 and sold at 21:21:37-38. The smaller wallet followed by two or three slots and traded at roughly one-fifth of the leader’s size. These are four matched actions across two round trips. Repetition in both directions is more informative than one coincident buy. The full temporal-pairs file records the broader history and exact signatures. [12] [13]

Coordinated burst example. CTjZEsUMFcMSf4YE5Ki16hz3BLn5xzhxp2mCn1xcU6FV, 3K7XMbqvFTKT211Dqu8tXC1iK5vmQQ2MZp5mxSdEzWvx and F4cUjuWkXP7ptAVg13EUeCNPgPQYeuiLSUYNdZgYtW5w entered at 22:14:58 UTC on 4 October and sold at 22:15:43. Their entry was part of a wider two-second burst containing 16 sender addresses in the recent-trade sample. This supports automation or a shared trading signal; it does not independently establish self-dealing or deployer ownership.

Repeated sell synchronization. my33vNfT6sbuGGrtULuHWsfSUMoNEP1hzd6tQPNvakU and 2MT7y9hUCjebcYt8ve1mpL7oeLxFe7aLeySy7QcKP3ZZ sold in the same slots at 19:22:16, 20:13:35 and 20:31:37 UTC on 4 October. Same-slot timestamps are coarse, so these observations support a monitoring lead rather than a demonstrated common controller.

The complete ledger was screened for same-side wallet pairs separated by at most three slots, as well as shared fee payers and rapid exact-quantity round trips. This creates many candidate edges, especially during busy periods. There is no statistical null model or exhaustive beneficial-ownership graph here, so the candidate count is not presented as a count of cabal members. Sponsored relayers, launch tools and popular signals create correlations without shared ownership.

A separate bounded funding check examined the nearest 20 successful pre-first-trade transactions for each of four wallets in the two strongest automation pairs, plus 20 transactions before a later entry by 38KJ..., 100 transactions in total. It found no direct transfers or joint signatures between either pair or with the launch pair, and no shared material SOL funder in those windows. That is limited negative evidence, not a clearance of their entire histories. The 2zMj... / DiJF... pair also had 16 closely timed same-side trades across seven other mints in the six minutes around launch, with the second wallet’s token size near half the first. Execution order alternated in some same-slot cases, supporting a mirrored automated strategy rather than an invariably proven leader.

5. KOL participation: what can actually be attributed?

KOL Explorer publicly labels four wallets trading this exact mint. These are provider attributions, not identities verified by the wallet holders themselves. Marker is also labelled by Defined. The table joins those public labels to the on-chain wallet addresses; a label does not prove a paid promotion, an agreement with the deployer or responsibility for copy traders. [14]

Marker: CQervCdE3WAUGRmaTj9NHdbNrNGVsxJb68t3QggcntM2

Zuki: 922VvmmYDHV9KMTJJ71Y5Yd3Vn7cfJuFasLNSsZPygrG

Letterbomb: BtMBMPkoNbnLF9Xn552guQq528KKXcsNBNNBre3oaQtr

Sting: 7TNYdvwDzuRKvquzn24grcGwvrtpsYK58GAWdRBnm3UT

None of these four entered during the audited first 26 seconds. Marker’s first buy was 97 seconds after creation. That ordering does not fit a claim that these labelled KOL wallets directly funded the deployer’s first 22-second exit. Their later participation could still supply attention and attract copy traders, but that causal link requires more than observing their presence.

Repeated KOL-following candidates are visible. 2zMj6wNqNKSa3dG8ioUDi71P2uijKiojLwEizVGKWRjG and DiJF3L3796seiwyjmwfTz9wHUCCP5kmeMQM6kDzzjXax each bought after four distinct labelled-KOL events: Zuki’s first buy, Letterbomb’s first and second buys, and Sting’s first buy. They used fixed sizes of 0.10 and 0.05 SOL, within the same timestamp second and the same or following slot. Their early history contains six matching buy/sell round trips with exits roughly 15-16 seconds later. This is strong evidence of an automated shared strategy or copying, but not proof of shared ownership.

A third wallet, 4KQGocKQW25nJ8xT9GPNW5Uqy2t7eFs2NzwcXqiyuY1X, repeatedly bought 0.14985 SOL within zero or one second of Marker, Letterbomb and Sting. The two smaller wallets also traded in Marker’s first-buy second, but their actual transaction positions precede Marker, so those purchases are explicitly excluded from the ordered-follower evidence. Full-block signature arrays independently confirmed that ordering and a later Letterbomb-following episode. Four tiny 0.001 SOL Zuki top-ups did not consistently attract followers, so they are not presented as a successful baiting scheme.

Public provider snapshots showed Marker spending about $161 and receiving about $833 across one buy and three sells; its labelled round-trip profit was about $672. Letterbomb showed six buys and two sells, Zuki five buys and one sell, and Sting five buys with no sales in that snapshot. USD figures are provider conversions and should not be substituted for the exact SOL cash-flow ledger. The on-chain join and surrounding buy windows are included separately.

6. Promotion and the market’s later success

The meme existed before the token. Gender-swapped Draco artwork circulated on X in September, with public view counts far exceeding this token’s holder base. Those posts establish an existing attention pool; they are not endorsements of this contract. The metadata linked a Dioss_Sol post timestamped at the same second as creation, discussing the viral character and encouraging feed engagement. The timing is consistent with rapid trend capture or a tweet-triggered launch, but does not establish that the X author controlled the deploying wallet. [15] [16]

The collected chronology contains 20 posts tied by exact mint, exact pool or an explicit reply chain, plus three associated ticker recaps. Mad Apes has a standing disclaimer describing posts as promotional advertisements. That is direct evidence of the channel’s promotional framing; it does not identify who paid for this token, how much was paid, or whether any payment occurred in this particular case. [25]

One social-infrastructure warning deserves attention: the X community URL used in early Malfoid updates had previously been promoted for an unrelated SIGEONPEX token. This establishes reuse or misattribution of a community link, not common wallet ownership. The later CTO account may represent a change in narrative stewardship, but the reviewed evidence does not date or authenticate a formal takeover. [26]

GeckoTerminal’s separately retrieved curve and PumpSwap hourly candles sum to approximately $595,298 in displayed volume across their available launch-to-4-October snapshots. This corroborates meaningful market activity but is not an organic-volume estimate. Its hourly snapshot boundaries differ slightly from the exact ledger cutoff, and historical USD conversions and market-cap supply bases vary between providers. The on-chain SOL ledger is the authoritative count used in this report. [27]

7. Protocol mechanics and distribution

The token was launched with holder rewards enabled, Mayhem disabled and cashback disabled. Holder-reward routing explains why a scanner’s creator field can point to a program-derived fee recipient rather than the deployer. It would be incorrect to attribute all displayed creator fees to the deployer. The launch metadata identifies J7Tracker, whose public documentation supports bundled buying and automated selling; a tool’s capabilities alone do not prove which options were used here. [28] [29] [30]

After graduation, 29 decoded BOOST buy-and-burn events ran from 11:15:59 to 11:21:30 UTC. They spent 17.584505612 SOL and burned 48,821,538.089345 tokens, equal to 4.882154% of the original billion-token supply. The spend reconciles to the initialization amount in InitBoost. This is mechanical buy pressure and supply reduction, not 29 new independent traders. BOOST contributes only 0.347% of all indexed principal volume; it explains a specific post-graduation component, not the entire multi-day volume.

The decoded history also contains 1,790 holder-reward distribution events paying 36.300878669 SOL across 24,995 recipient-events. Recipients can repeat, so that last number is not a holder count. Reward payments provide a holding incentive and redistribute fees; they are not additional token purchases.

The observed mint supply was 951,178,138.317563 tokens, a total reduction of 48,821,861.682437. BOOST accounts for almost all of that reduction; 323.593092 additional tokens lie outside that BOOST total and are not assigned a cause here without separate burn attribution.

The direct holder audit resolves a misleading counting ambiguity. A finalized Token-2022 account scan retrieved at 23:51:49 UTC returned 1,061 token accounts with 1,061 distinct owner addresses, but only 357 had a positive balance. The other 704 were empty. Excluding the identified main pool leaves 356 positive-balance addresses, still including possible custody/program accounts. Of all owner addresses, 350 held at least one token, 341 at least 100, and 336 at least 1,000. These are owner addresses, not verified people.

The complete account-balance sum exactly equals the mint supply of 951,178,138.317563 tokens, and both RPC responses share finalized slot 453409330. This is an independently reconciled later state snapshot, separate from the trade cutoff at slot 453401116. Its full positive-holder list is delivered as positive-holders.csv. The top-ten concentration is unchanged from the earlier Rugcheck snapshot; current main-pool inventory is slightly different.

Rugcheck reported 1,067 holders at 23:13:57 UTC, while other sites showed much smaller figures. Different timestamps and counting definitions prevent an exact provider reconciliation, but the direct scan shows why counting existing token accounts can greatly overstate funded holders. No holder number is used as the lifetime trader count. Splitting ownership among funded wallets can still make distribution appear broader than it is; the available evidence is insufficient to collapse all addresses into beneficial owners. [31]

The provider-labelled Sting wallet holds 32,354,757.764486 tokens, or 3.40% of current supply, making it the second-largest non-main-pool address in this snapshot. Its five buys and lack of indexed sales contrast with Marker, Zuki and Letterbomb, whose directly bought token quantities were fully sold during 1 October.

Rugcheck’s automated insider graph reported no detected insiders. That non-detection does not override the independently verified funding and co-signing evidence. Likewise, a provider’s bundler or organic-activity score is a heuristic with its own scope; it is not a proof of common ownership or a universal measure of genuine demand.

Two material token-transfer links complicate a purely wallet-by-wallet view of distribution. On 1 October at 11:47:14 UTC, HF2Lw2tYs4B3y1iqz6iw2f4wTjrn14KppvAezcm7TAT3 sent 14 million tokens to 2QxCR19KLLWHCvFvD8pymszwVqenHpdyF358fJKT1o3U. On 4 October at 15:25:47, uDYvqwgSxNDMKGPaMJ7JqyadEg1EhxkuCx9hbLSanHA sent seven million to 4jqB7UitFW1yKCw36KCtd2ktHJStGQdqN7dXwWonqn7D. In the later direct snapshot, the senders hold 2.15% and 3.35%; the recipients hold seven million and 7,027,368.727450 tokens respectively, about 0.736% and 0.739%. These are verified transfer relationships; gifts, sales, custody and self-transfers remain possible explanations. [32] [33]

If the uDY... sender and its recipient were under common control, their combined current holding would be 4.09%, exceeding the largest individual non-pool address’s 3.51%. The HF2L... transfer pair would combine to 2.89%. These conditional sums illustrate why transfer links merit review; they are not proven beneficial-owner holdings.

The reviewed metadata/security sources show no mint authority, freeze authority, transfer hook, transfer fee or permanent delegate. These controls reduce some contract-level risks, but they do not establish independent trading or prevent early holders from selling. Rugcheck’s detailed LP data and its summary disagree on the lock percentage; this report does not present that provider field as an independent liquidity-lock audit. [34]

8. The most plausible playbook, with confidence limits

First, a repeat launcher captured a live meme. The metadata, same-second social post and verified earlier launches support rapid trend selection and reusable deployment tooling. We have direct evidence of repeated coordination between two wallets. We do not have a complete lifetime census of the deployer’s launches, so the precise hundreds-of-launches claims shown by automated summaries are not adopted.

Second, the launch pair established early positions and the deployer sold into immediate demand. The deployer’s 15.33% allocation and complete 22-second exit from that wallet are confirmed. The following coordinated wallet added 2.55% initially and retained half. A zero current developer balance is therefore a poor measure of early coordinated participation or the group’s continuing exposure. Snipers, bot checks and failed attempts created a much larger transaction footprint than the number of executed trades; those nontrades do not inflate the executed-swap volume reported here. This is the strongest evidence of an aggressive launch-and-exit strategy.

Third, attention and market infrastructure sustained trading after that exit. A pre-existing meme, KOL-labelled participation, repeated Telegram performance posts, holder rewards and protocol buybacks all provide plausible mechanisms. The later CTO identity is consistent with subsequent community organization. These elements are observed; their precise causal contribution and any shared financing remain uncertain.

Fourth, automated followers multiplied activity. Repeated short-lag, proportional trades and synchronized entries/exits explain how a token can accumulate many transactions and a wide wallet distribution without an equal number of independent investment decisions. Some of that activity could be legitimate copying or arbitrage. Calling all of it wash volume would exceed the evidence.

Judgment: the strongest supported description is a coordinated, opportunistic launch followed by rapid deployer extraction, then a mixture of public promotion, independent participation and automation. It is less well supported to credit the deployer with engineering the entire later rise: its verified direct position was already closed before the first labelled KOL buy and the earliest exact-contract Telegram call.

Not established: a single controller behind all suspicious wallets; proof that the labelled KOLs were paid or agreed to coordinate; confirmed self-trading; the exact fraction of organic volume; a verified Jito bundle identifier; or a funding link between the deployer and the later promotional channels. Those distinctions are central to this report, not reasons to disregard the coordination that is directly proven.

9. Evidence package and reproducibility

The package includes the full trade ledger (CSV and JSONL), one-row-per-wallet aggregates, signature inventory, coverage and validation files, launch-window audit, direct coordination evidence, KOL joins, promotion chronology and public source snapshots. Each swap records its transaction signature, slot, transaction order where available, event/log position, venue, direction, quantities, fees and attribution rule. Explorer links allow independent spot-checking.

Raw transaction bodies and official IDLs are archived separately with the decoding scripts. A file-hash manifest accompanies the deliverables. The private RPC endpoint is excluded from the report and archives. The funding review is bounded to the nearest 100 prelaunch records for each launch-pair wallet, yielding 198 unique transactions; it is not an exhaustive analysis of every counterparty.

For future reanalysis, keep the same cutoff and scope when comparing results. Additional post-cutoff trades, different treatment of routers or protocol actors, and different historical USD prices will change apparent totals. Behavioral clusters should be upgraded to ownership claims only with additional direct funding, joint-signing, token-transfer or independently verified attribution evidence.

Sources

[1] Official Pump event schemas

[2] Malfoid creation

[3] Pump deployer profile

[4] Deployer final sale

[5] Joint funding: 30 September

[6] Joint funding: 1 October 05:37

[7] Joint funding: 1 October 07:48

[8] Prior launch: The Odyssean Seal

[9] Prior launch: immediately following buy

[10] Joint dual buy

[11] Joint dual sell

[12] Copy candidate: lead buy

[13] Copy candidate: following buy

[14] KOL Explorer: exact token

[15] Metadata-linked Dioss post

[16] Original token metadata

[17] First Wizzy call

[18] Wizzy 2x update

[19] Wizzy 3x update

[20] Anna exact-pool call

[21] Mad Apes first call

[22] Malfoid CTO public profile

[23] Pump token market page

[24] Mad Apes 6x update

[25] Mad Apes standing promotion disclaimer

[26] Earlier unrelated token using the same community

[27] GeckoTerminal main pool

[28] J7 launch documentation

[29] J7 bundle documentation

[30] Pump holder rewards

[31] Rugcheck detailed report

[32] 14-million-token distribution transfer

[33] 7-million-token distribution transfer

[34] GoPlus Solana token security