OAK — OnChain Attack Knowledge

Worked example · 2024-12

Movement Network ($MOVE) market-maker insider dump — Binance / Coinbase — 2024-12

Loss
approximately $38M extracted by the market maker Web3Port via sale of 66M MOVE tokens (~5% of circulating supply at TGE) on 2024-12-09 within ~24 hours of MOVE's Binance listing. The "loss" is the structural transfer of value from open-market buyers on Binance and Coinbase listing day to the market-maker entity that received the 66M tokens under a market-making agreement subsequently characterised by Movement Foundation's own counsel as "possibly the worst agreement" they had ever reviewed. Subsequent fallout: Coinbase delisted MOVE on 2025-05-01 (effective 2025-05-15); the token fell to all-time low ~$0.18 (-73% over the period from the December dump through the delisting); Binance banned Web3Port; Movement Labs suspended (2025-05-02) and then terminated (2025-05-07) co-founder Rushi Manche.
OAK Techniques observed
OAK-T5.005 (Treasury-Management Exit — boundary case; the market-making contract was the OTC-distribution vehicle and the borrower Web3Port's first action upon listing was the dump of 66M MOVE (~$38M); the substantive misuse of a legitimate token-distribution instrument maps to T5.005's treasury-management authority surface) + OAK-T6.002 (Fake Audit-Claim — boundary case; the Rentech double-agency contract structure where Rentech appeared on both sides of the market-making agreement as Web3Port subsidiary and as Movement Foundation agent is structurally equivalent to the false-representation surface T6.002 documents, substituting contractual-counterparty deception for audit-claim deception) + OAK-T1.004 (Blacklist / Pausable Weaponization — boundary case; the structural defect was in the contract design itself, where the market-making agreement permitted immediate disposal of 66M tokens by a counterparty whose principal also occupied the foundation-agent side of the contract). Note: the market-making-contract-as-OTC-distribution-vehicle sub-pattern is proposed for formal v0.x sub-Technique treatment in TAXONOMY-GAPS.md; T5.005 covers the treasury-authority-substantive-misuse surface but the post-CEX-listing deposit-address-cluster detection methodology is a v0.x extension.
Attribution
confirmed The contractual structure (Web3Port lender-borrower agreement, Rentech double-agency, Movement Foundation's counsel flagging the contract as deeply problematic, Manche's central role in championing the deal) is documented in CoinDesk's investigation citing internal documents and three sources close to the situation. Corporate accountability followed: Manche suspended and terminated, Web3Port banned by Binance, MOVE delisted by Coinbase, Movement Labs hired Web3 intelligence firm Groom Lake for third-party review. No regulatory action public at v0.1 cutoff. Galen Law-Kun (Singapore-based financier identified by CoinDesk as Rentech's principal) named publicly but not legally adjudicated.
OAK-Gnn
unattributed at v0.1; the case sits in the same cohort as RaveDAO 2026-04 and Mantra OM 2025-04 but operator-cluster fingerprinting across the cohort is not yet established.
Key teaching point
Movement MOVE December 2024 is OAK's earliest clean cohort case for the insider-OTC-distribution → coordinated-dump exit pattern at v0.1. The MOVE case's analytical distinguishing feature within the cohort is the contractual paper trail: the Rentech / Web3Port double-agency contract structure is documented via CoinDesk's investigation citing internal documents, three sources close to the situation, and Movement Foundation's own counsel's characterisation of the contract as "possibly the worst agreement" they had ever reviewed. The paper trail is materially stronger than for RaveDAO 2026-04 (where the on-chain artefacts are clean but the off-chain contractual structure is opaque) or for Mantra OM 2025-04 (where the OTC discount allegations are partially confirmed by the team but the buyer cohort remains less documented).

Summary

Movement Network's MOVE token had its Token Generation Event (TGE) and Binance listing on 2024-12-09. On 2024-11-25 — two weeks before the listing — Rentech (a Singapore-based entity with no digital footprint, identified by CoinDesk as headed by financier Galen Law-Kun) signed a market-making agreement with Web3Port. In the contract, Rentech was the lender, Web3Port was the borrower, and Rentech was referred to as "Movement" in the document. Movement Foundation officials, per CoinDesk's reporting, did not realise that Web3Port had already entered into an agreement with "Movement" weeks before the December 8 deal Movement Foundation itself signed.

On 2024-12-08, Movement Foundation signed a modified version of the market-making contract (which had been flagged by Movement Foundation's own counsel as "possibly the worst agreement" they had ever reviewed). Within 24 hours of the December 9 listing, Web3Port sold the 66M MOVE tokens it had received under the agreement (~5% of circulating supply, ~2.64% of total) for approximately $38M, crashing the price.

CoinDesk's April 2025 investigation (Inside Movement's Token-Dump Scandal: Secret Contracts, Shadow Advisers and Hidden Middlemen) surfaced the contractual structure: Rentech appeared on both sides of the agreement, once as a Web3Port subsidiary and once as an agent of the Movement Foundation. The double-agency raised the structural question of whether this was misled-counterparty negligence or coordinated self-dealing.

Movement Labs hired Web3 intelligence firm Groom Lake to conduct a third-party review. Co-founder Rushi Manche, who CoinDesk reported was the one who initially forwarded the Rentech deal to the Movement Foundation and championed it internally, was placed on administrative leave in mid-April 2025, formally suspended on 2025-05-02, and terminated on 2025-05-07. Coinbase suspended MOVE trading on 2025-05-01 and announced delisting effective 2025-05-15, citing the token's failure to meet its listing standards. Binance banned Web3Port. The MOVE price fell to an all-time low of ~$0.18 (-73% from pre-delisting levels, far more from the immediate-post-TGE peak).

Why this is structurally novel

Movement MOVE December 2024 is the cohort's earliest clean worked example of the insider-OTC-distribution → coordinated-dump exit pattern, and it is the example with the strongest paper trail because Movement Labs' own internal reaction (third-party investigation, co-founder termination) and the major-CEX response (Coinbase delisting, Binance market-maker ban) created a public-record audit chain that the on-chain artefact alone does not produce.

Three structural features distinguish MOVE within the cohort:

  1. The market-making contract is the OTC-distribution vehicle. Unlike RaveDAO 2026-04 where the multisig outflows to Bitget deposit addresses look opaque on the surface, the MOVE case shows the contractual instrument explicitly: a lender-borrower market-making agreement under which 66M MOVE were transferred to the market maker, who then sold them within 24 hours of listing. The market-making contract is a legitimate financial instrument; its misuse as a dump-vehicle is the substantive defect. Token launches across 2024-2026 routinely use market-making contracts; the MOVE case is the canonical worked example of the structural risk this contract class carries when (a) the lender side of the contract is opaque, (b) the borrower's market-making obligation is structured to permit immediate disposal rather than constrained inventory provision, and (c) a single counterparty can occupy both lender and borrower sides simultaneously.

  2. Detection requires off-chain contractual disclosure, not just on-chain analysis. The 66M MOVE transfer to Web3Port was on-chain visible at TGE; what was not visible without the off-chain contractual disclosure was that the receiving entity was the lender-borrower agreement counterparty and that the receiving entity's principal (Galen Law-Kun via Rentech) also occupied the foundation-agent side of the contract. The on-chain artefact alone does not surface the double-agency; the contractual investigation surfaces it. This is structurally different from T5.001 (Hard LP Drain) or T5.005 (Treasury-Management Exit) detection, which can in principle be scored from on-chain data plus published treasury policy.

  3. The CEX-side response set the precedent for the cohort. Coinbase's 2025-05-01 delisting decision and Binance's Web3Port ban established that major-CEX listing-compliance teams can and will act post-event on insider-dump evidence. The precedent is structurally important because the cohort's mitigation surface (see TAXONOMY-GAPS.md proposal) includes CEX-side market-maker auditing — and the MOVE response is the canonical evidence that CEX-side auditing is a load-bearing mitigation rather than a theoretical one.

Timeline (UTC)

When Event OAK ref
2024-11-25 Rentech signs market-making agreement with Web3Port; Rentech is the lender, Web3Port is the borrower; Rentech is referred to as "Movement" in the document T5.x candidate (OTC-distribution-vehicle structuring leg)
2024-12-08 Movement Foundation signs modified version of the market-making contract; Movement Foundation's own counsel flags the contract as "possibly the worst agreement" they had ever reviewed T1 / T6 (structural-defect contract)
2024-12-09 MOVE TGE; Binance listing (genesis)
2024-12-10 (within 24h of listing) Web3Port sells 66M MOVE for ~$38M into the open market; price crashes T5.x candidate (coordinated-dump leg)
2025-04-30 CoinDesk publishes investigation: Inside Movement's Token-Dump Scandal: Secret Contracts, Shadow Advisers and Hidden Middlemen (community / journalism forensic surface)
~2025-04 (mid-month) Movement Labs places Rushi Manche on administrative leave; hires Groom Lake for third-party review (operator-side response)
2025-05-01 Coinbase suspends MOVE trading; announces delisting effective 2025-05-15 citing failure to meet listing standards (CEX-side response — listing-compliance)
2025-05-02 Movement Labs formally suspends Rushi Manche (operator-side response)
2025-05-07 Movement Labs terminates Rushi Manche (operator-side response)
Continuing Binance bans Web3Port as market maker; MOVE falls to ATL ~$0.18; no public regulatory action at v0.1 cutoff (attribution state)

What defenders observed

  • Pre-event (TGE-period): the contractual structure was not visible on-chain. The double-agency (Rentech on both sides of the contract) was surfaced only retroactively via CoinDesk's investigation citing internal documents. The pre-event detection surface for the MOVE-class pattern is therefore not on-chain — it is the listing-period contractual-disclosure regime. CEX listing-precondition checks could in principle require disclosure of all market-making agreements and their counterparty structure; at v0.1, this is not industry practice.
  • At-event: the 66M MOVE transfer to Web3Port at TGE and the subsequent sale within 24 hours were both on-chain visible in real time. The destination-cluster classification primitive that OAK's T5.005 detection methodology already names ("Destination-cluster classification on multisig outflows: flag outflows that terminate at CEX deposits ... within N hops") would have flagged the Web3Port → Binance deposit pattern; what it would not have surfaced, absent the contractual-disclosure primitive, is the significance of the transfer (i.e., that the Web3Port entity was the market-maker counterparty and that the foundation had not negotiated against an arms-length counterparty).
  • Post-event: CoinDesk's investigation ([coindeskmovementscandal2025]) was the load-bearing public-record forensic surface. The investigation triangulated three sources close to the situation, the internal contracts showing Rentech double-agency, and Movement Foundation's own counsel's "worst agreement" characterisation. The CEX-side response (Coinbase delisting, Binance Web3Port ban) followed the journalism. The operator-side response (Manche termination, third-party review) followed the journalism and the CEX response. The sequencing is structurally instructive — for cohort cases without a CoinDesk-class investigation, the public-record forensic surface is materially weaker.

What this example tells contributors writing future Technique pages

  • Market-making-contract structure is part of the T5.x detection surface. Future contributors writing T5.x examples involving market-maker counterparties should enumerate the contract structure where the public record permits: lender, borrower, term, inventory-disposal constraints, counterparty-overlap (if any). The MOVE case demonstrates that the contract structure can itself be the substantive defect; on-chain artefacts alone do not score the defect.
  • CoinDesk-class investigative journalism is part of the cohort's attribution chain. The MOVE case's strong attribution rests on CoinDesk's investigation surfacing the double-agency contract structure. Future cohort cases that lack a comparable journalistic investigation will score lower on attribution-strength, even when the on-chain artefacts are equally clean. Contributors should be explicit about the journalism dependency in the attribution chain — it is part of the public-record forensic surface and varies case to case.
  • CEX-side listing-compliance response is a load-bearing mitigation. Coinbase's delisting and Binance's Web3Port ban are not just consequences — they are the mitigations that operationalise the cohort's deterrence. Future T5.x examples should record the CEX-side response (delisting / market-maker ban / suspension) as a first-class observation; the response is what distinguishes a one-off operator from a market-maker the CEX listing-compliance regime treats as recurringly disqualifying.
  • The double-agency contract structure is a recurring structural defect to name. Rentech occupying both lender and borrower (proxied) sides of the market-making contract is the structural defect that produced the MOVE outcome. Future T5.x sub-Technique work should explicitly name counterparty-overlap-in-market-making-contracts as a sub-pattern within the OTC-distribution-vehicle leg.

Public references

Discussion

Movement MOVE December 2024 is OAK's earliest clean cohort case for the insider-OTC-distribution → coordinated-dump exit pattern at v0.1. The MOVE case's analytical distinguishing feature within the cohort is the contractual paper trail: the Rentech / Web3Port double-agency contract structure is documented via CoinDesk's investigation citing internal documents, three sources close to the situation, and Movement Foundation's own counsel's characterisation of the contract as "possibly the worst agreement" they had ever reviewed. The paper trail is materially stronger than for RaveDAO 2026-04 (where the on-chain artefacts are clean but the off-chain contractual structure is opaque) or for Mantra OM 2025-04 (where the OTC discount allegations are partially confirmed by the team but the buyer cohort remains less documented).

The MOVE case sits at the intersection of OAK-T1 (concentrated-supply / structural-defect contract design at genesis), OAK-T5.x (the coordinated-dump exit), and OAK-T6 (defense-evasion via the double-agency contractual structure that obscures counterparty identity). The v0.1 framework does not have a clean Technique slot for the market-making-contract-as-OTC-distribution-vehicle sub-pattern that MOVE establishes; the v0.x proposal in TAXONOMY-GAPS.md is motivated in significant part by the need to name this sub-pattern.

The major-CEX response (Coinbase delisting, Binance Web3Port ban) is the strongest public-record example in the cohort of CEX-side listing-compliance acting on insider-dump evidence. The response sets the precedent that CEX-side auditing of market-maker behaviour is a load-bearing mitigation surface for the cohort, and the precedent is structurally relevant to OAK's broader Mitigations layer — the "venue-side mitigation" class within OAK's M-NN taxonomy already covers listing-precondition checks; the MOVE precedent extends the coverage to post-listing market-maker behavioural auditing as a v0.x mitigation candidate.

For OAK's broader cohort coverage, MOVE December 2024 + Mantra OM April 2025 + RaveDAO April 2026 collectively establish that the insider-OTC-distribution → coordinated-dump exit pattern recurs across 2024-2026, across multiple chain ecosystems (EVM-L2, Cosmos-RWA, EVM-mainnet), and across multiple top-tier exchange venues (Binance, Coinbase, Bitget, OKX). The cohort is sufficient to motivate the v0.x sub-Technique proposal; the cohort's recurrence at the major-CEX-listing scale is structurally informative for defender-practice generalisation across the whole token-launch surface.

Techniques demonstrated (3)