Blockchain security firm GoPlus has uncovered a second coordinated memecoin operation on Robinhood Chain that routed over $9 million across hundreds of tokens in 30 days. The discovery comes as the newly launched Ethereum Layer-2 network surpassed $1.5 billion in total value locked (TVL) in under 90 days.
Key Takeaways
- GoPlus identified a high-risk entity processing 3,589 ETH (worth $9.49 million) in gross flows across 400 transactions as of Sept. 28.
- The scheme relies on batch wallet creation and contracts like PonsV2Helper and UniversalRouter to disguise token supply concentration.
- This follows a previous investigation linking 53 Robinhood Chain launches to an $18.4M extraction scheme.
- Robinhood Chain generated approximately $50 million in cumulative revenue since its July 1 launch, including $40 million in September alone.
Mechanics of the GoPlus-Identified Operation
According to GoPlus data published on Sept. 28, the newly identified entity created batches of fresh wallets to accumulate and sell tokens tied to popular market narratives. The operators routed sales through smart contracts including PonsV2Helper and UniversalRouter, before sweeping proceeds into local wallets. Ultimately, the funds moved into a main consolidation wallet that logged 3,589 ETH ($9.49 million) in gross two-way flows over its latest 400 transactions.
Rather than executing traditional liquidity rug pulls where trading is abruptly frozen, the operation used dozens of seemingly unrelated addresses selling in staggered phases. Capital generated from one batch of memecoin launches was recycled to fund the creation and supply acquisition of subsequent tokens.
Mounting Security Risks Amid $1.5 Billion TVL Growth
This pattern mirrors a separate investigation by on-chain researcher Wazz, who previously linked 53 Robinhood Chain launches to an $18.4M extraction scheme. In that earlier cluster, wallet groups ranging from 70 to 200 addresses controlled over 70% of a token's supply shortly after launch. While GoPlus noted no direct evidence that both operations share the same handlers, both heavily utilize Pons V2 infrastructure and recycled launch capital.
The emergence of these serial operations coincides with rapid growth for the Layer-2 network since its July 1 debut. Robinhood Chain reached $1.5 billion in TVL in under 90 days, according to DeFiLlama. Token Terminal estimates the network generated $50 million in revenue over three months, driven by a $40 million performance in September.
Why It Matters
For Robinhood, which maintains 28.6 million funded brokerage accounts representing $384 billion in assets, high-volume scam factories present a significant reputation and customer safety challenge. While permissionless Layer-2 architecture allows open smart contract deployment, front-end trading interfaces and native wallets must implement aggressive wallet concentration analytics to protect retail traders. If fraudulent token syndicates continue to siphon capital, retail onboarding onto Robinhood Chain could suffer severe momentum losses before reaching mainstream adoption.
