Worked example · 2024-07

$NEIRO Solana memecoin bundled-launch concentration rug — Solana — 2024-07-27

Loss: approximately $4.5M realised by the insider cohort across the launch window (per Bubblemaps' July 2024 attribution), with the deployer wallet alone netting roughly $2.85M in profit on an initial ~3 SOL stake (~$550 at the time) — a >5,100x return per Cointelegraph and The Coin Republic reporting. Aggregate retail mark-to-market loss is undisclosed; the load-bearing structural fact is that 78% of supply was acquired by 80 deployer-funded addresses within seconds of launch, then re-spread across approximately 400 secondary addresses to obscure cohort control before sells were executed at an average market cap of ~$40M. The remaining ~22% of supply available to organic public buyers absorbed the cohort exit. The token is the canonical Solana T2.001 single-sided-equivalent / T3.001 sybil-bundled-launch worked example for July 2024.
OAK Techniques observed: OAK-T2.001 (Single-Sided Liquidity Plant, applied to the Solana bonding-curve-then-AMM context) — once NEIRO's bonding curve graduated and the token migrated to AMM trading, the cohort-controlled 78% concentration meant the public-side counter-liquidity was structurally insufficient to absorb the cohort's exit without the recorded ~96% drawdown. The case is the per-token instantiation of the cohort framing carried at scale by examples/2024-2025-pump-fun-bonding-curve-rug-cohort.md. OAK-T3.001 (Sybil-Bundled Launch) — 80 deployer-funded addresses acquiring 78% of supply within seconds of launch is the canonical T3.001 funder-graph cluster pattern, with the additional layered obfuscation of re-distribution across ~400 secondary addresses pre-sell. OAK-T6 (Defense Evasion) modifier — the supply-rebroadcast across 400 addresses is structurally a defense-evasion overlay on the underlying T3.001 pattern, designed to defeat naive top-holder-concentration heuristics by producing a deceptively flat holder distribution at the cohort-exit moment. OAK-T5.002 (Slow LP Trickle Removal) chains as the extraction mechanism; the cohort sold approximately 11.7% of supply (~$4.5M) over the launch window rather than executing a single-block hard rug.
Attribution: inferred-strong Bubblemaps published the on-chain wallet-cluster analysis publicly within hours of launch (2024-07-27 / 2024-07-28) and characterised the distribution as "insider trading" with the 78% / 80-address / 400-address-rebroadcast fingerprint documented on-chain. LookOnChain's parallel analysis attributed the $2.85M deployer profit on a 3-SOL initial stake. Cointelegraph, BitcoinWorld, and The Coin Republic published convergent forensic accounts citing both Bubblemaps and on-chain explorer data. The deployer / operator-cluster identity is not publicly named at v0.1 cutoff; no regulator action public; no civil litigation public; the operator-cluster fingerprint is on-chain conclusive at the wallet-cluster level.
OAK-Gnn: unattributed at v0.1; the cluster is a candidate seed for inclusion in a future Pump.fun-cohort or Solana-memecoin-cohort operator-cluster OAK-G entry alongside the examples/2024-2025-pump-fun-bonding-curve-rug-cohort.md "Rug Republic" twelve-cluster framing.
Key teaching point: NEIRO is the canonical July-2024 per-token T2.001 / T3.001 worked example anchored on Solana memecoin bonding-curve-then-AMM context. The case is structurally distinct from the Pump.fun bonding-curve cohort framing in examples/2024-2025-pump-fun-bonding-curve-rug-cohort.md along two axes: NEIRO is named-token, named-date, with named on-chain forensic attribution by Bubblemaps; the cohort writeup is platform-scale and cluster-aggregate. The two layers complement each other — the cohort writeup establishes the platform-scale extraction substrate; NEIRO is the per-token instantiation defenders can directly cite when explaining the pattern to less-technical retail audiences.

Summary

NEIRO launched on Solana on 2024-07-27, branded around the broader 2024 dog-themed memecoin cycle (a Solana-side counterpart to several similarly-named tokens on Ethereum and Base). Per Bubblemaps' on-chain analysis published the same day, 80 deployer-funded addresses acquired 78% of the token's supply within the launch window; those same 80 addresses subsequently re-distributed their holdings across approximately 400 secondary addresses before initiating coordinated sells. The re-distribution step is the defense-evasion overlay — naive top-holder-concentration screens would have read the post-distribution holder graph as comparatively flat, masking the underlying 80-cluster control.

The deployer wallet's recorded extraction was approximately $2.85M against an initial 3-SOL deployment stake (~$550), a >5,100x return per Cointelegraph reporting. Bubblemaps' aggregate cohort attribution placed the broader insider extraction at ~$4.5M (11.7% of supply sold) at an average exit market cap of ~$40M. The deployer also moved 10M NEIRO to a dead address after the realised-profit window, retaining an additional ~$1.8M in unrealised holdings against the remaining ~19.5M tokens at then-market.

For OAK's T2 / T3 framing, NEIRO is the canonical July-2024 per-token worked example demonstrating the bundled-launch + supply-rebroadcast + AMM-exit chain. Three structural features make the case load-bearing for defenders:

The 78% / 80-address acquisition window is on-chain conclusive at deploy-time. The funder-graph cluster pattern T3.001 / T2.001 enumerate is exercised here at named-token, named-launch-date scale within hours of mint. A defender running OAK-M04 (Funder-Graph Clustering) at deploy-time would surface the 80-address cohort as a deployer-cluster signature before the cohort exit.
The 400-address re-distribution is a textbook T6-class defense-evasion overlay. Naive holder-distribution heuristics ("top 10 wallets hold X%") read the post-rebroadcast graph as flat. Cluster-aware heuristics that resolve the 400-address re-distribution back to the 80-address upstream cluster (and further upstream to the deployer-funder graph) detect the underlying concentration. The case is the cleanest 2024 Solana worked example justifying cluster-resolution as a load-bearing requirement on top of headline holder-distribution metrics.
The cohort-exit was a slow-trickle T5.002 rather than a single-block hard rug. 11.7% of supply was sold over the launch window at average market cap ~$40M, generating ~$4.5M cohort profit. The slow-trickle exit is structurally harder to detect than a single-block LP removal because each individual sell looks like ordinary trading. The defender lesson is that exit-pattern detection in this cohort requires aggregating cluster-level outflow over hours rather than alerting on per-transaction anomalies.

Timeline (UTC)

When	Event	OAK ref
2024-07-27 (launch window)	NEIRO deployed on Solana; deployer funds 80 addresses; cohort acquires 78% of supply within seconds-to-minutes of launch	T3.001 (sybil-bundled launch)
2024-07-27 (immediately post-launch)	Cohort re-distributes holdings from 80 addresses across ~400 secondary addresses to obscure cohort control	T6 modifier on T3.001 (cluster-rebroadcast)
2024-07-27 (launch window onward)	Bubblemaps publishes on-chain wallet-cluster analysis identifying the 78% / 80-address / 400-address fingerprint	(community forensic surface)
2024-07-27 to 2024-07-28	Cohort executes coordinated sells at average market cap ~$40M; deployer wallet realises ~$2.85M; aggregate cohort realised ~$4.5M	T5.002 (slow LP trickle removal at cohort scale)
2024-07-28 onward	Cointelegraph, LookOnChain, BitcoinWorld, The Coin Republic publish convergent forensic write-ups; community discussion characterises the launch as a deliberate insider-coordination event	(forensic record)
Continuing	Token persists post-cohort-exit; no regulator action public; deployer / operator-cluster identity not publicly named at v0.1 cutoff	(attribution state)

What defenders observed

Cluster-resolution is the load-bearing detection requirement, not headline holder distribution. A deployer-funder-graph clustering pass at mint-time would have surfaced the 80-address cohort as a single deployer-controlled cluster. A naive "top N holders hold X%" check applied after the 400-address re-distribution would have read the holder graph as flat. The detection signal is cluster-resolved concentration, not raw concentration.
The launch-second acquisition pattern is the cohort fingerprint. 78% of supply acquired by 80 addresses within seconds-to-minutes of launch is the on-chain primary signal. This is a refinement of the broader Pump.fun-cohort / "Rug Republic" detection methodology applied at named-token granularity.
Slow-trickle exit detection requires cluster-level outflow aggregation. The cohort sold 11.7% of supply over the launch window rather than executing a single-block LP removal. Per-transaction anomaly detection would not flag the individual sells; cluster-aggregated outflow over time is the load-bearing signal.
Bubblemaps' visualisation surface is the canonical retail-defender entry point. The 80-address cluster + 400-address rebroadcast was identified within hours of launch by Bubblemaps' visualisation product. The case demonstrates that public on-chain visualisation tooling is operationally sufficient to surface this pattern at retail-defender granularity, when the visualisation is consulted before participating in a launch rather than after.

What this example tells contributors writing future Technique pages

T2.001 on Solana memecoin bonding-curve-then-AMM contexts requires the cohort-exit framing. The Solana memecoin cohort routinely launches via Pump.fun bonding curve, graduates to Raydium AMM, and then exits via cluster-coordinated AMM sells. The single-sided-liquidity-plant T2.001 pattern manifests on Solana not as a thin AMM seed at deploy-time (the bonding curve provides curve-defined initial liquidity) but as a cohort-controlled supply concentration that produces equivalent buyer-trap dynamics on the post-graduation AMM leg. Future Solana T2.001 worked examples should anchor on the cohort-exit pattern rather than on initial AMM depth.
T6 evasion overlays on T3.001 sybil-bundled launches need explicit naming. The 400-address re-distribution is a generalised pattern across the 2024-2025 Solana memecoin cohort: bundle at launch, re-spread before sell, exit through the post-distribution graph. This deserves explicit T3.001 / T6.x sub-Technique enumeration in v0.x updates rather than being conflated into the broader Sybil-Bundled-Launch framing. The detection-signal layer is materially different (cluster-resolution required) and the marketing-side claim ("look at our holder distribution") is the load-bearing victim-deception surface.
Cluster-aware tooling is the v0.x Mitigation requirement. Bubblemaps, Solanafloor, and Rugcheck-class visualisation surfaces are the canonical retail-defender tooling. M04 (Funder-Graph Clustering) is the OAK Mitigation that maps; v0.x guidance for retail-defender UX should treat cluster-resolved holder-distribution as a first-class field alongside raw holder-distribution.

Public references

[bubblemapsneiro2024] (proposed) — Bubblemaps on-chain wallet-cluster analysis of NEIRO launch, identifying 78% / 80-address / 400-address-rebroadcast cohort fingerprint.
[cryptonewsneiroinsider2024] (proposed) — Cryptonews coverage of NEIRO insider-trading allegations citing Bubblemaps. https://cryptonews.com/news/neiro-token-faces-insider-trading-allegations-as-bubblemaps-reports-78-pre-allocation.htm
[bitcoinworldneiro2024] (proposed) — BitcoinWorld convergent reporting. https://bitcoinworld.co.in/neiro-token-faces-insider-trading-allegations-as-bubblemaps-reports-78-pre-allocation/
[cointelegraphneirorug2024] (proposed) — Cointelegraph reporting on the deployer's $2.85M profit on an initial 3-SOL stake. https://cointelegraph.com/news/neiro-memecoin-developer-makes-2-85m-profit-after-apparent-rug-pull
[thecoinrepublicneiro2024] (proposed) — The Coin Republic reporting on Solana NEIRO developer profit. https://www.thecoinrepublic.com/2024/07/30/solanas-neiro-memecoin-developer-nets-2-85m-in-rug-pull/
[chainalysis2025rug] — broader 2024-2025 Solana memecoin rug-pull cohort context.
[soliduslabs2025rugreport] (proposed) — Solidus Labs 2025 Rug Pull Report cohort framing for the Pump.fun / Raydium ecosystem.

Discussion

NEIRO is the canonical July-2024 per-token T2.001 / T3.001 worked example anchored on Solana memecoin bonding-curve-then-AMM context. The case is structurally distinct from the Pump.fun bonding-curve cohort framing in examples/2024-2025-pump-fun-bonding-curve-rug-cohort.md along two axes: NEIRO is named-token, named-date, with named on-chain forensic attribution by Bubblemaps; the cohort writeup is platform-scale and cluster-aggregate. The two layers complement each other — the cohort writeup establishes the platform-scale extraction substrate; NEIRO is the per-token instantiation defenders can directly cite when explaining the pattern to less-technical retail audiences.

The 78% / 80-address / 400-address-rebroadcast fingerprint is the case's most defensively-actionable observation. The cluster-rebroadcast step is the canonical T6 evasion overlay on the T3.001 sybil-bundled-launch base pattern; it is not unique to NEIRO and recurs across the broader 2024-2025 Solana memecoin cohort, but NEIRO's same-day Bubblemaps publication is the cleanest worked-example demonstration in the public record at v0.1.

The deployer's $2.85M profit on a 3-SOL stake (~$550) is the magnitude-scaling reference for the cohort. Per-token deployer profits at this multiple are achievable when the cohort acquires majority supply at launch and the post-launch AMM leg attracts even modest organic buyer flow. The structural attribution-of-loss framing is the same as the broader cohort: organic buyers entering on the post-graduation AMM leg are the structural counter-party to the cohort exit.

For OAK's broader cohort coverage, NEIRO complements examples/2024-12-hawk-tuah-celebrity-memecoin.md (HAWK, December 2024 — celebrity-amplified pump-and-dump on the same Solana substrate) and the broader Hayden Davis / Kelsier cohort writeup examples/2025-01-hayden-davis-kelsier-cluster.md. NEIRO is the anonymous-operator per-token case; HAWK is the celebrity-amplified per-token case; the Davis / Kelsier writeup is the named-operator-cluster cohort case. Together they span the operator-attribution spectrum for the 2024-2025 Solana memecoin cohort at v0.1.