OAK — OnChain Attack Knowledge

Worked example · 2025-01

Hayden Davis / Kelsier Ventures memecoin operator-cluster cohort — Solana — 2025-Q1

Loss
aggregate cohort losses across the 15+ alleged template-cloned launches named in the SDNY amended class-action complaint (October 2025) include: $251M (LIBRA, February 2025); ~$1.6B (MELANIA, January 2025 — per DL News); ~$69M (M3M3 / Meteora, December 2024); ~$40M peak market-cap collapse (WOLF, March 2025); plus HOOD, KACY, VIBES, TRUST, ENRON, and others. Crypto lawyer wassielawyer estimated total cohort losses across attributable launches at ~$286M against ~44,000-75,000 affected users (this figure does not include the LIBRA / MELANIA mass-loss windows, which are attributed individually). Cumulative cohort retail loss exceeds $1B by independent press estimates (Time, DL News, Fortune, KuCoin coverage).
OAK Techniques observed
OAK-T3.001 (Sybil-Bundled Launch), OAK-T3.004 (Influencer-Amplified Promotion-and-Dump) — the canonical named-operator T3.001 + T3.004 cohort at v0.1. Hayden Davis publicly admitted (CoinDesk, 2025-02-17) to "sniping" both the LIBRA and MELANIA launches; Bubblemaps published wallet-cluster analyses linking launch-time snipers across LIBRA, MELANIA, M3M3, WOLF, and HOOD to wallets clustered to Davis — the funder-graph cluster pattern T3.001 enumerates as its detection surface, exercised by a publicly-named operator across ≥15 template-cloned launches. OAK-T8.001 (Operator-Cluster Reuse) — cross-launch wallet-cluster continuity is the structural fingerprint linking the cohort. Proposed v0.x candidates: T5.x sub-class for celebrity / sovereign-endorsement-amplified pump-and-dump + a candidate OAK-Gnn entry for the Hayden Davis / Kelsier Ventures memecoin-launch operator cluster as an operator-cluster object. See TAXONOMY-GAPS.md. The cohort chains with OAK-T1.003 (Mint / ICO / NFT Exit — concentrated supply at genesis via bundled-sniper acquisition), OAK-T5.x (the coordinated-dump exit timed to the endorsement window), and OAK-T6 (defense evasion via the Kelsier / Meteora launch-infrastructure layer that obscures operator-cluster lineage at deploy-time).
Attribution
confirmed Hayden Davis publicly admitted (CoinDesk, 2025-02-17) to "sniping" both the LIBRA and MELANIA launches. Bubblemaps published wallet-cluster analyses linking the launch-time snipers across LIBRA, MELANIA, M3M3, WOLF, and HOOD to wallets clustered to Davis. The SDNY amended class-action complaint (October 2025; per Fortune coverage, Burwick Law / Hoppin Grinsell LLP plaintiffs) names Hayden Davis, Gideon Davis, Charles Thomas Davis, Kelsier Ventures (as Kelsier Labs), Benjamin Chow (Meteora co-founder), and at least 15 alleged template-cloned token launches. Argentine prosecutor Eduardo Taiano opened a fraud investigation against the LIBRA launch operators; in March 2025 Argentine prosecutors petitioned for an Interpol Red Notice for Davis. No US criminal charges public at v0.1 cutoff; SDNY civil litigation ongoing. The cluster's structural fingerprint is on-chain conclusive at the wallet-cluster level; legal adjudication remains in process.
OAK-Gnn
the Hayden Davis / Kelsier Ventures memecoin-launch operator cluster is a candidate seed for a future OAK-G entry. Cohort fingerprint at v0.1: at least 15 template-cloned launches (LIBRA, MELANIA, M3M3, WOLF, HOOD, KACY, VIBES, TRUST, ENRON, and others per the SDNY complaint); on-chain wallet-cluster fingerprint linking launch-time snipers across the cohort; Meteora launchpad as recurring distribution-infrastructure substrate (Benjamin Chow connection); LA-based Kelsier Ventures (Hayden, Gideon, Tom Davis) as the publicly-named operator entity. Argentine sovereign-side enforcement action (asset freeze, Interpol Red Notice request) is the strongest public-record action; SDNY civil litigation ongoing.
Key teaching point
The Hayden Davis / Kelsier Ventures cluster is OAK's canonical 2025 worked example of operator-cluster reuse across celebrity / sovereign-endorsement memecoin launches at named-operator scale. The case is structurally distinct from per-token celebrity-endorsement examples and from the platform-scale Pump.fun cohort: the operators are publicly named; the cohort spans 15+ launches across multiple endorsement-source trust-tiers; the multi-jurisdictional accountability chain (Argentine criminal + SDNY civil) is engaged but the operator-tempo continues.

Summary

Hayden Davis (CEO, Kelsier Ventures) and his immediate-family operator network (Gideon Davis, Charles Thomas Davis) emerged as the publicly-named operator cohort behind a recurring template of celebrity / sovereign-endorsement memecoin launches across late-2024 and 2025. The cluster's cohort-fingerprint includes:

  • LIBRA (February 2025) — sovereign-endorsement amplification by Argentine President Javier Milei; ~$251M retail loss; ~$87-107M insider extraction in first wave; ~$100M LP withdrawal attributed by Bubblemaps to Davis-clustered wallets. See examples/2025-02-libra-milei-presidential-pump-dump.md.
  • MELANIA (January 2025) — official-team-launch with first-spouse amplification; ~$1.6B vaporised at peak; ~89% supply attributed by Bubblemaps to clustered insider wallets; SDNY class-action defendant (October 2025 amended complaint). See examples/2025-01-trump-melania-presidential-memecoin.md.
  • M3M3 (December 2024) — Meteora launchpad token; lawsuit (April 2025) alleges Meteora CEO Benjamin Chow, Kelsier Labs, and Davis brothers conspired to acquire ~95% of supply during launch window and dump it; $69M alleged investor loss.
  • WOLF (March 2025) — Wolf-of-Wall-Street-themed launch heavily sniped at deploy with ~82% bundled-sniper acquisition; surged to ~$40M peak market cap before collapsing; on-chain analysis by Bubblemaps linked the WOLF deployer wallet to Davis's prior LIBRA / MELANIA wallets.
  • HOOD, KACY, VIBES, TRUST, ENRON, and others — additional template-cloned launches named in the SDNY amended complaint as part of the same operator-cluster pattern.

Davis's public-disclosure trajectory is structurally significant. In a Decrypt interview (February 2025), Davis acknowledged sitting on ~$100M in extracted value from the LIBRA launch and stated he "didn't know what to do with it." In a CoinDesk interview (2025-02-17), Davis admitted to "sniping" both the LIBRA and MELANIA tokens, characterising the practice as standard memecoin operator behaviour and using the framing "this isn't some random fucking scam." The self-disclosure is the cohort's strongest first-person attribution evidence and is structurally rare — most memecoin operators do not publicly admit to the underlying mechanism.

In March 2025, Argentine federal prosecutors petitioned for an Interpol Red Notice for Davis. CCN reporting (March 2025) documented that Davis subsequently launched additional memecoins after the Red Notice request, demonstrating that the cohort's operational-tempo was not interrupted by the sovereign-side enforcement action. The SDNY class-action proceedings have been the strongest US-side accountability surface; the consolidated amended complaint (October 2025) is the cohort's most comprehensive operator-cluster attribution document.

Why this is structurally novel

The Davis / Kelsier cohort is OAK's canonical worked example of operator-cluster reuse across celebrity / sovereign-endorsement memecoin launches at named-operator scale. Three structural features distinguish this cohort from per-token celebrity-endorsement examples and from the Pump.fun cohort:

  1. The operator-cluster is named, not anonymous. Unlike the Pump.fun "Rug Republic" twelve-cluster cohort (which is wallet-cluster-fingerprinted but not individually named at v0.1), the Davis / Kelsier cluster is named-operator across the cohort. Hayden Davis, Gideon Davis, and Charles Thomas Davis are publicly identified; Kelsier Ventures is publicly registered (Delaware / California); Benjamin Chow (Meteora co-founder) is publicly identified as the launchpad-side coordination party (per SDNY complaint). The named-operator status is structurally significant for attribution — the cluster's cohort-fingerprint can be tied to a legal entity and to specific individuals, which makes the cohort the strongest cohort-level OAK-Gnn candidate at v0.1.

  2. The launch-template is reusable across endorsement-source trust-tiers. The same operator-cluster executed launches across multiple endorsement-source trust-tiers: sovereign (LIBRA / Milei), official-team-launch (MELANIA / Trump-administration first-spouse), entertainment-celebrity-template (WOLF / Wolf-of-Wall-Street), launchpad-platform-launch (M3M3 / Meteora). The cohort therefore demonstrates that the structural pattern (bonding-curve sniping + endorsement amplification + extraction-window-aligned dump) is trust-tier-agnostic at the operator-cluster level. The endorsement source is interchangeable; the operator-cluster, the launchpad, and the structural pattern are constant.

  3. Sovereign-side enforcement and civil-litigation surfaces are both engaged but operator-tempo continues. The Argentine fraud prosecution + asset-freeze + Interpol Red Notice request (March 2025) and the SDNY civil class-action (initial February 2025; amended October 2025) are both engaged simultaneously. Yet Davis publicly launched additional memecoins (WOLF, March 2025) after the Red Notice request was filed. This is structurally important — the cohort demonstrates that single-jurisdiction sovereign-enforcement is insufficient to stop cohort-tempo at the named-operator level. The cohort's structural deterrence requires multi-jurisdictional coordination, exchange-side delisting / sanctioning, and platform-side allowlist gating, none of which were operating cohesively at v0.1 cutoff.

Timeline (UTC)

When Event OAK ref
2024-12-04 M3M3 launches on Meteora launchpad; alleged ~95% supply acquired by insider cohort during launch window per April 2025 lawsuit T1 (concentrated supply at launch via sniping)
2025-01-17 $TRUMP launches (not attributed to Kelsier per public record) (cohort-context anchor)
2025-01-19 $MELANIA launches; ~89% supply attributed to clustered insider wallets per Bubblemaps; ~$1.6B vaporised at peak T1.x candidate (insider-allocation leg)
2025-02-14 $LIBRA launches with President Milei endorsement; ~$251M retail loss; ~$87-107M insider extraction in first wave T5.x candidate (sovereign-endorsement-amplified extraction)
2025-02-17 Davis admits in CoinDesk interview to "sniping" both LIBRA and MELANIA (operator self-disclosure)
2025-02 (later) Decrypt interview: Davis acknowledges sitting on ~$100M extracted value from LIBRA (operator self-disclosure)
2025-03-08 $WOLF launches with Wolf-of-Wall-Street theming; ~82% bundled-sniper acquisition; on-chain wallet-cluster linked to Davis's prior LIBRA / MELANIA wallets T5.x candidate (entertainment-template reuse)
2025-03-13 Fortune reports Argentine prosecutors petition for Interpol Red Notice for Davis; Argentine asset-freeze order issued (sovereign-side enforcement action)
2025-03-16 Mitrade reports Davis launches additional memecoin after Red Notice request; cohort-tempo continues (continued operator activity)
2025-04 Bubblemaps publishes wallet-cluster analysis documenting ~$100M LIBRA LP withdrawal by Davis-clustered wallets (community forensic surface)
2025-04 Hoppin Grinsell LLP / Burwick Law file SDNY class-action against Meteora, Benjamin Chow, Kelsier Labs, Davis brothers re: M3M3 (US civil litigation initial)
2025-10-23 SDNY amended class-action complaint expands to name 15+ alleged template-cloned launches including LIBRA, MELANIA, M3M3, WOLF, HOOD, KACY, VIBES, TRUST, ENRON (US civil litigation expanded)
2025-12-10 CoinDesk publishes "Most Influential 2025" entry for Hayden Davis (cohort recognition surface)
Continuing SDNY civil litigation ongoing; Argentine criminal proceedings ongoing; no US criminal charges public; Interpol Red Notice request status not publicly resolved at v0.1 cutoff (attribution state)

What defenders observed

  • Pre-event: the Davis / Kelsier cluster's cohort-fingerprint was visible in retrospect after the LIBRA launch (Bubblemaps' wallet-cluster analysis). The pre-event detection signal for subsequent cohort launches was the deployer-wallet-funding-source — the WOLF launch in March 2025 was on-chain-linkable to Davis's prior LIBRA / MELANIA wallets at deploy-time, but no major launchpad operates a deployer-wallet-cluster-blacklist as a pre-launch gate. The operator-cluster cohort-fingerprint methodology is therefore the v0.x mitigation primitive — platform-side or third-party-aggregator allowlist / blacklist gating based on cohort-fingerprinted operator-cluster signatures.
  • At-event: the bundled-sniper signature (~82% of WOLF supply at deploy; ~96% of HAWK supply; ~89% of MELANIA supply; majority of LIBRA early float) is the recurring at-event detection signal. The signal — N wallets acquiring M% of supply within K seconds of deploy, all funded from a clusterable upstream that traces back to the named-operator cluster — is the cohort's structural fingerprint at the per-launch level. Bubblemaps, ZachXBT, and Lookonchain demonstrated the at-event detection surface across the cohort; the detection latency (analysis published within hours of launch) is incompatible with retail-protection but compatible with post-launch retail-warning and exchange-side listing-decision input.
  • Post-event: the public-record forensic surface combined Bubblemaps' wallet-cluster analyses, Davis's own self-disclosure (CoinDesk, Decrypt, multiple interviews), the SDNY litigation discovery process, the Argentine prosecutor's investigation, and a high-volume of investigative coverage (Fortune, DL News, Time, KuCoin, ChainCatcher, Buenos Aires Times, CoinDesk, Decrypt, BeInCrypto, Crypto Briefing, Lawyer Monthly, Bitget News, MEXC News, others). The cohort's post-event surface is uniquely strong for a memecoin operator cluster — Davis's self-disclosure is unusual, and the multi-jurisdictional accountability chain (Argentina + SDNY civil) is the cohort's strongest structural-deterrence anchor at v0.1.

What this example tells contributors writing future Technique pages

  • Operator-cluster-fingerprint at named-operator scale is a discrete OAK-Gnn class. Future OAK-G entries covering memecoin operator clusters should record: launch count (template-cloned launches across the cohort); aggregate cohort loss; named-operator entities (legal entities + individuals); recurring launchpad infrastructure (Meteora, Pump.fun, OverHere, etc.); recurring distribution-amplification surfaces (sovereign / celebrity / entertainment / launchpad-platform); cohort-fingerprint methodology (Bubblemaps wallet-cluster analysis or equivalent). The Davis / Kelsier cohort is the cleanest v0.x candidate; the Pump.fun "Rug Republic" cohort is the platform-scale unnamed-cluster analogue.
  • Self-disclosure is part of the cohort's attribution chain. Davis's public admissions (CoinDesk, Decrypt) are the cohort's strongest first-person attribution evidence and are structurally rare. Future cohort cases that include operator self-disclosure should record the disclosure as a primary attribution-source; the OAK attribution-strength language (inferred-strong / confirmed) should distinguish self-disclosure from third-party-cluster-attribution.
  • Multi-jurisdictional accountability chain is the cohort's structural-deterrence surface. The Argentine prosecution + SDNY civil litigation combination is the cohort's strongest structural-deterrence anchor at v0.1. Future cohort cases should record the jurisdictional layers explicitly: sovereign-of-endorser, sovereign-of-operator, US-securities-and-civil, exchange-of-listing. The cohort's structural-deterrence requires alignment across multiple layers; single-jurisdiction enforcement is insufficient at the named-operator level.
  • The SDNY M3M3 / MELANIA litigation is the cohort's strongest US-civil precedent. The SDNY amended complaint's framing of the cohort as a coordinated 15+ launch enterprise (Burwick Law / Hoppin Grinsell LLP plaintiffs) is the strongest US-civil-litigation articulation of operator-cluster reuse at v0.1. Future cohort cases that progress to US-civil litigation should integrate the discovery surface into the OAK record where the legal proceedings permit.

Public references

Discussion

The Hayden Davis / Kelsier Ventures cluster is OAK's canonical 2025 worked example of operator-cluster reuse across celebrity / sovereign-endorsement memecoin launches at named-operator scale. The case is structurally distinct from per-token celebrity-endorsement examples and from the platform-scale Pump.fun cohort: the operators are publicly named; the cohort spans 15+ launches across multiple endorsement-source trust-tiers; the multi-jurisdictional accountability chain (Argentine criminal + SDNY civil) is engaged but the operator-tempo continues.

The cluster's distinguishing analytical value is the named-operator-cluster fingerprint methodology and the Davis self-disclosure attribution chain. The methodology — Bubblemaps wallet-cluster analysis demonstrating cross-launch deployer-wallet linkage + on-chain forensic correlation across the cohort + named-operator publicly-disclosed entity (Kelsier Ventures) + multi-source corroboration (ZachXBT, Lookonchain, Arkham, SDNY discovery) — is the v0.x detection primitive for cohort-scale named-operator memecoin attribution. The cluster's structural-attribution rests on the cohort-fingerprint methodology and on Davis's own admissions; the legal-adjudication surface (criminal charges) is in process but unresolved at v0.1 cutoff.

For OAK's broader cohort coverage, the Davis / Kelsier cluster + the platform-scale Pump.fun cohort + the per-token celebrity-endorsement examples (LIBRA, HAWK, MELANIA / TRUMP) collectively establish the spectrum of structural attribution within the 2024-2026 memecoin cohort. The named-operator cluster is the strongest OAK-Gnn candidate; the platform-scale cohort is the strongest Mitigation-class anchor; the per-token examples are the strongest Technique-class anchors. The v0.x sub-Technique and OAK-G proposals in TAXONOMY-GAPS.md need to cover all three layers.

The cohort's multi-jurisdictional accountability chain has a structural lesson for OAK's broader Mitigation work: single-jurisdiction enforcement is insufficient to interrupt named-operator-cluster cohort-tempo. The cohort demonstrates that even with sovereign-side fraud prosecution + asset freeze + Interpol Red Notice request + US-civil class-action, the operator-cluster's launch-cadence continued. The structural-deterrence surface therefore requires alignment across multiple layers — sovereign-of-endorser, sovereign-of-operator, US-securities, exchange-of-listing, launchpad-of-deploy — none of which were aligned cohesively at v0.1 cutoff.

Techniques demonstrated (6)