Worked example · 2021-11

SQUID (Squid Game token) — BNB Chain — 2021-10 / 2021-11-01

Attribution: pseudonymous — no public actor attribution at OAK v0.1 cutoff.
Loss: ~$3.38M.
Cumulative cross-incident loss attributed to the same operator cluster: ~35,025 BNB (~$19.3M at the time of the events) across three related scams per TRM Labs attribution.
OAK Techniques observed: OAK-T1.001 (Modifiable Tax / Anti-sell), OAK-T2.001 (Single-Sided Liquidity Plant — the deployer seeded the SQUID side of the PancakeSwap pool with near-zero-cost tokens while buyers provided BNB; the single-sided provisioning structure concentrated all value-side liquidity in user deposits, enabling the subsequent drain), OAK-T5.001 (Hard LP Drain), OAK-T8.001 (Operator-Cluster Reuse).
Status: operator publicly identified as a recurring cluster; specific named individuals not publicly disclosed.
Key teaching point: SQUID is a useful didactic case because it bundles a static-detectable T1.001 pattern with a textbook T5.001 single-event drain, and because TRM's published cluster attribution makes it one of the few public examples where the OAK-T8.001 case is on the public record at the time of the incident rather than reconstructed years later. Contributors writing analogous post-2024 cases should note that more recent operator clusters tend to layer T6 (Defense Evasion) patterns — fragmented timing, multi-actor coordination — over the same underlying T1+T5 substrate.

Summary

The SQUID token launched in October 2021 on BNB Chain, marketed as the in-game currency for an unaffiliated "Squid Game"–themed play-to-earn project. The token's transfer logic embedded a transfer-restriction pattern (an "anti-dump" requirement that holders first earn a secondary "Marbles" token, which was never distributed to ordinary buyers). Buyers were able to acquire SQUID; effectively no third-party seller could exit a position. After the price spiked to a peak of approximately $2,861 per token on November 1, 2021, the operator removed pool liquidity in a single event, dropping the price effectively to zero within minutes. TRM Labs's subsequent attribution traced the same operator cluster to two earlier scams, with the cumulative recovery from the three-incident operator-cluster footprint estimated at ~35,025 BNB.

Timeline (UTC)

When	Event	OAK ref
2021-10 (mid-month)	Token contract deployed; transfer logic includes the Marbles-requirement transfer-restriction pattern	T1.001
2021-10 (late)	LP funded; price discovery driven by accumulating retail demand	T2 (setup)
2021-11-01 (peak)	Price reaches ~$2,861	T3 (capture endpoint)
2021-11-01 (within minutes)	Single LP-removal event drops price effectively to zero	T5.001
Post-event	TRM attribution links operator cluster to two earlier scams	T8.001

What defenders observed

Pre-event (T1): the contract's transfer logic was statically inspectable. The Marbles requirement is observable on-chain at deployment time and would not have passed a transfer-simulation check (a simulated sell from any non-deployer address would have failed).
Pre-event (T2): standard concentration-risk indicators applied; no claim of "locked liquidity" was the dominant misrepresentation here (compare SafeMoon for that pattern).
At-event (T5.001): single-transaction outflow, classical hard-rug shape.
Post-event (T8.001): funder-graph and deployment-fingerprint analysis linked SQUID to two earlier operator-cluster incidents; this is a published example of OAK-T8.001 attribution rather than a reconstructed-after-the-fact one.

What this example tells contributors writing future Technique pages

Static, simulation-detectable signals can flag T1.001 before any holder enters a position. The OAK-T1.001 page lists transfer-simulation as a primary detection signal precisely because cases like SQUID demonstrate the value of the simulation step.
Operator-cluster attribution at scale is high-leverage. The dollar-loss-prevented metric scales with how early in an operator's career the cluster is flagged; SQUID is a useful illustration of why T8.001 detection is included alongside the per-incident Techniques.
Bound the dollar-loss claim. "$3.38M" (this incident) and "$19.3M cumulative" (operator-cluster total) are different numbers; conflating them inflates the example. Per-event attribution is more rigorous than per-operator.

Public references

[trmsquid2021] — TRM Labs primary forensic write-up (transfer-restriction characterisation, operator-cluster attribution).

Discussion

SQUID is a useful didactic case because it bundles a static-detectable T1.001 pattern with a textbook T5.001 single-event drain, and because TRM's published cluster attribution makes it one of the few public examples where the OAK-T8.001 case is on the public record at the time of the incident rather than reconstructed years later. Contributors writing analogous post-2024 cases should note that more recent operator clusters tend to layer T6 (Defense Evasion) patterns — fragmented timing, multi-actor coordination — over the same underlying T1+T5 substrate.