OAK — OnChain Attack Knowledge

Worked example · 2024-12

$HAWK / Hawk Tuah celebrity-memecoin sniper-distribution pump-and-dump — Solana — 2024-12

Loss
approximately $3.3M extracted by the team / sniper cohort per Bubblemaps' attribution to the immediate post-launch trading window; aggregate retail mark-to-market loss undisclosed but the token's market cap collapsed from a peak of ~$491M to ~$25M (a ~95% drop) within ~20 minutes of launch on 2024-12-04. The structural loss is the transfer of value from retail buyers entering through CEX-routed bonding-curve flow to the launch-time sniper cohort that controlled an estimated ~96% of token supply (per Bubblemaps), with only ~3-4% available to organic public buyers.
OAK Techniques observed
OAK-T3.004 (Influencer-Amplified Promotion-and-Dump — primary; the entertainment-celebrity podcast/social-media platform was the distribution surface) + OAK-T3.001 (Sybil-Bundled Launch — ~96% of supply acquired by sniper/insider wallets in the bonding-curve seconds-window per Bubblemaps) + OAK-T5.001 (Hard LP Drain — the coordinated insider sell-off extracted ~$3.3M within ~20 minutes of launch) + OAK-T1.004 (Blacklist / Pausable Weaponization — boundary case; the SPL token retained freeze authority at deployment as a non-renounced contract, structurally equivalent to the T1.004 surface on EVM chains) + OAK-T17.001 (Cross-Venue Arbitrage-Driven Price-Discovery Distortion — the T17 tactic page cross-references pump-and-dump coordination cohorts as T17↔T3.003/T3.004: the ~96% insider supply concentration, celebrity-amplified promotional pump, and coordinated ~20-minute dump collapsed the market cap from ~$491M to ~$25M, constituting a market-manipulation primitive that distorted price discovery across the token's trading venues; the case is the canonical 2024 T17↔T3.004 influencer-amplified pump-and-dump worked example). Note: the celebrity-endorsement-amplified sub-pattern and insider-allocation-via-sniping sub-pattern are proposed for formal v0.x sub-Technique treatment in TAXONOMY-GAPS.md; T3.004 is the closest v0.1 Technique for the influencer-amplification distribution surface.
Attribution
inferred-strong. Bubblemaps' on-chain analysis (publicly published 2024-12-04 / 2024-12-05) attributed ~96% of supply to insider / sniper wallets and characterised the launch as a "one-day pump and dump" extracting ~$3.3M. Multiple independent forensic accounts converged (Bubblemaps, on-chain reporters via X, BeInCrypto). Class-action lawsuits filed in the US over the failed launch; Welch (the celebrity figure) publicly stated she was "fully cooperating" with the lawyers' investigation. SEC inquiry and FBI inquiry were publicly reported; both subsequently closed without charges against Welch (per CCN / Yahoo May 2025). No regulatory action publicly resolved against the launch operators (OverHere launchpad, Tuah The Moon Foundation) at v0.1 cutoff.
OAK-Gnn
unattributed at v0.1; the launchpad operator (OverHere) and the Tuah The Moon Foundation operator cluster are candidates for a future OAK-G entry if a multi-incident cohort fingerprint emerges. The HAWK case is not attributed to the Hayden Davis / Kelsier cluster (the Davis cluster's named launches are LIBRA, MELANIA, M3M3, WOLF, HOOD, and others — HAWK pre-dates the Kelsier publicly-named cohort by approximately two months).
Key teaching point
HAWK is OAK's earliest clean 2024 worked example of an entertainment-celebrity-endorsement-amplified bonding-curve pump-and-dump. The case predates the Hayden Davis / Kelsier cohort (LIBRA, MELANIA, etc.) by approximately two months and establishes the structural pattern that the Kelsier cohort subsequently amplified and operationalised across multiple launches. The HAWK launch operators are not publicly attributed to the Davis cluster; the cohort fingerprint is therefore independent and points to the structural pattern (bonding-curve sniper-cohort genesis distribution + celebrity-marketing-fee promoter structure) being available to multiple operator clusters in late 2024.

Summary

On 2024-12-04 at 22:00 UTC, the HAWK token was launched on Solana through the OverHere launchpad and the Tuah The Moon Foundation, branded around the viral "Hawk Tuah" persona of Haliey Welch. Within minutes of launch, HAWK's market cap surged to a peak of approximately $491M; within approximately 20 minutes, the price collapsed by ~95% as sniper / insider wallets executed coordinated outflows.

Bubblemaps' on-chain analysis, published the same day, documented that approximately 96% of token supply was held in insider / sniper wallets at the post-launch state and that only approximately 3-4% of supply was available to organic public buyers. Bubblemaps CEO Nicolas Vaiman characterised the launch as a "one-day pump and dump," with the team / insiders extracting approximately $3.3M (£2.59M) in profits during the immediate post-launch trading window.

Welch, who had risen to viral internet fame in 2024 through the "Hawk Tuah" interview, publicly stated that she had no control over the token's launch or its distribution structure and that she had been paid only a flat marketing fee. SEC complaints were filed by retail buyers; class-action lawsuits were filed against Welch and the launchpad operators. In May 2025, CCN reported that both the SEC and FBI inquiries had concluded without charges against Welch personally. The launch operators (OverHere, Tuah The Moon Foundation) faced civil litigation but no regulatory resolution at v0.1 cutoff.

Why this is structurally novel

HAWK is the cohort's earliest 2024 worked example of an entertainment-celebrity-endorsement-amplified pump-and-dump with bonding-curve sniper-cohort genesis distribution. Three structural features distinguish HAWK from earlier celebrity-token incidents:

  1. The bonding-curve sniper signature is the genesis-distribution mechanism. Unlike earlier celebrity-token incidents where the operator was the deployer-author (CryptoZoo, OK token, etc.) or where token allocation followed a public-sale schedule, HAWK's distribution was a Solana-bonding-curve seconds-window. The 96% sniper-cohort acquisition is the structural signature; the celebrity is the demand-side amplifier, not the supply-side operator. This is the same structural pattern that subsequently recurs in LIBRA / MELANIA / WOLF and the broader Hayden Davis cohort.

  2. The endorsement-window-to-extraction-window throughput is single-digit minutes. HAWK's collapse was substantially faster than the LIBRA-class hours-window: the ~95% price drop occurred within ~20 minutes of launch. The compressed throughput is consistent with the bonding-curve mechanic — the demand surge funds the sniper-cohort exit faster than retail can adjust position. Defenders observing similar patterns should expect the extraction window to scale with the launchpad mechanic, not with the endorsement-source trust-tier alone.

  3. The celebrity is partially insulated by the contractual-marketing-fee framing. Welch's "I had no control over the launch / paid a flat fee" framing was preserved through the SEC and FBI inquiries and ultimately produced no charges against her personally. This is structurally different from the LIBRA case where President Milei was personally investigated by Argentine prosecutors. The HAWK precedent (celebrity-as-paid-promoter, not as launch-operator, escapes personal liability) is now part of the cohort's accountability landscape — and is part of why subsequent cohort cases routinely interpose a marketing-contract layer between the celebrity / political endorser and the launch operator.

Timeline (UTC)

When Event OAK ref
2024-12 (pre-launch) HAWK launch announced; Tuah The Moon Foundation and OverHere launchpad named as launch operators; Welch publicly endorses across her podcast and X (distribution-surface preparation)
2024-12-04 22:00 HAWK token deployed on Solana via OverHere launchpad with bonding-curve mechanics; sniper / insider wallets acquire ~96% of supply in seconds-window T1 (concentrated supply at launch via sniping)
2024-12-04 22:00 → 22:20 HAWK market cap peaks at ~$491M; price collapses ~95% within ~20 minutes as sniper cohort executes coordinated outflows T5.x candidate (extraction-window leg)
2024-12-04 / 12-05 Bubblemaps publishes on-chain analysis attributing ~96% of supply to sniper / insider wallets; characterises launch as "one-day pump and dump" with ~$3.3M extraction (community forensic surface)
2024-12 SEC complaints filed by retail buyers; class-action lawsuits filed against Welch and launch operators; Welch publicly states she is "fully cooperating" (regulator + civil response)
2025-05 CCN / Yahoo report SEC and FBI inquiries closed without charges against Welch personally (regulator outcome — celebrity)
Continuing Civil litigation against launch operators (OverHere, Tuah The Moon Foundation) ongoing; no regulatory resolution at v0.1 cutoff (attribution state)

What defenders observed

  • Pre-event: the OverHere launchpad and Tuah The Moon Foundation had no public allowlist or audit gating that would have surfaced the bonding-curve sniper-acquisition risk to retail buyers in advance. The "celebrity-marketed launch" was the public-facing framing; the pre-launch contractual structure (marketing-fee vs. token-allocation, vesting, lockup) was not publicly disclosed at launch time.
  • At-event: the bonding-curve sniper signature was visible in real-time on Solana mempool and post-launch wallet-cluster data. Bubblemaps' detection signal — N wallets acquiring M% of supply within K seconds of deploy, all funded from a clusterable upstream — was published within hours of the launch and is the defining at-event detection primitive for the cohort. The detection latency (Bubblemaps post-launch within hours; price-collapse within ~20 minutes) means the at-event detection surface alone cannot prevent retail loss; the detection has to operate at deploy-time to be load-bearing.
  • Post-event: the public-record forensic surface combined Bubblemaps' wallet-cluster analysis, BeInCrypto and Koinly investigative coverage, the SEC complaint-filings, and the eventual SEC / FBI inquiry-closure outcomes (May 2025). The accountability chain was bifurcated: the celebrity (Welch) was cleared without charges; the launch operators (OverHere, Tuah The Moon Foundation) faced civil litigation without regulatory resolution at v0.1 cutoff. The bifurcated outcome is structurally informative — celebrities-as-paid-promoters can preserve personal-liability insulation through the marketing-contract framing, but launch operators do not have the same insulation.

What this example tells contributors writing future Technique pages

  • The launchpad mechanic is part of the T1 detection surface. Bonding-curve launchpads (OverHere, Pump.fun, Meteora, etc.) compress the genesis-distribution event into seconds and produce sniper-cohort acquisition signatures that are detectable in real-time but require deploy-time monitoring to be load-bearing. Future T1.x examples should record the launchpad mechanic explicitly and the seconds-window-acquisition metric (% of supply acquired within K seconds of deploy by clusterable-upstream wallets) as the defining genesis-extraction signature.
  • The marketing-contract layer is part of the cohort's accountability landscape. The HAWK precedent demonstrates that celebrities-as-paid-promoters can preserve personal-liability insulation through the marketing-contract framing. Future cohort cases should record the celebrity / promoter contractual structure where the public record permits — flat-fee promoter (Welch / HAWK), revenue-share promoter, equity-stake promoter, undisclosed-allocation promoter. The personal-liability outcomes vary across these structures.
  • The endorsement-window-to-extraction-window throughput is launchpad-mechanic-dependent. HAWK's ~20-minute extraction window compares to LIBRA's hours-window and is consistent with the bonding-curve mechanic difference. Future T5.x examples should record the throughput metric explicitly; the metric is one of the cohort's most informative structural variables.
  • Pre-launch contractual disclosure regimes are the load-bearing mitigation. The HAWK case demonstrates that retroactive enforcement (SEC complaint, FBI inquiry, civil litigation) does not recover retail loss; the structural mitigation has to operate pre-launch. Required-disclosure regimes for celebrity-endorsed launches (allocation, vesting, lockup, sniper-protection) are the v0.x mitigation candidate; at v0.1, no major launchpad operates such a regime.

Public references

Discussion

HAWK is OAK's earliest clean 2024 worked example of an entertainment-celebrity-endorsement-amplified bonding-curve pump-and-dump. The case predates the Hayden Davis / Kelsier cohort (LIBRA, MELANIA, etc.) by approximately two months and establishes the structural pattern that the Kelsier cohort subsequently amplified and operationalised across multiple launches. The HAWK launch operators are not publicly attributed to the Davis cluster; the cohort fingerprint is therefore independent and points to the structural pattern (bonding-curve sniper-cohort genesis distribution + celebrity-marketing-fee promoter structure) being available to multiple operator clusters in late 2024.

The HAWK case is structurally important to OAK's broader cohort coverage because it establishes the bifurcated accountability outcome — celebrity cleared, launch operators in civil litigation — that subsequently recurs across the cohort. The marketing-contract framing that insulated Welch is part of why subsequent celebrity-endorsement cases (LIBRA / Milei being the structural exception, where the endorser was a sitting head of state subject to fraud-prosecution authority) routinely interpose a marketing-contract layer between the celebrity and the launch operator.

For OAK's v0.x Technique work, HAWK + LIBRA / MELANIA collectively motivate the T5.x sub-class for celebrity / sovereign-endorsement-amplified pump-and-dump and the T1.x sub-class for insider-allocation-via-sniping-at-launch. The HAWK case is the cleaner example of the launchpad-mechanic-dependent throughput sub-pattern; LIBRA is the cleaner example of the sovereign-endorsement-trust-tier sub-pattern. Together they establish the cohort's two main structural variables.

Techniques demonstrated (5)