OAK — OnChain Attack Knowledge

Worked example · 2025-02

$LIBRA / Milei presidential-endorsement pump-and-dump — Solana — 2025-02

Loss
approximately $251M extracted from retail across the LIBRA price-collapse window of 2025-02-14; insider extraction reported at ~$87M-$107M in the first hours, with subsequent on-chain analysis (Bubblemaps, April 2025) attributing ~$100M of LP withdrawal to wallets controlled by Hayden Davis. Peak fully-diluted valuation briefly exceeded $4.4B before collapsing ~85% within hours; the structural loss is the transfer of value from retail buyers who bought after the presidential endorsement on X to the insider snipers + LP-control cohort that exited the position concurrent with the endorsement window.
OAK Techniques observed
OAK-T3.004 (Influencer-Amplified Promotion-and-Dump — primary; the sitting head-of-state official X channel was the distribution surface, the highest-trust-tier endorsement observed in the cohort) + OAK-T3.001 (Sybil-Bundled Launch — bundled snipers acquired majority of early float in the bonding-curve seconds-window at near-zero cost basis) + OAK-T5.001 (Hard LP Drain — the Davis-clustered wallets withdrew ~$100M from LP within hours of the endorsement, aligning extraction timing to the endorsement window) + OAK-T1.004 (Blacklist / Pausable Weaponization — boundary case; the SPL token retained freeze authority at deployment as a non-renounced contract, structurally equivalent to the T1.004 surface on EVM chains). Note: the sovereign-endorsement-amplified sub-pattern is proposed for formal v0.x sub-Technique treatment in TAXONOMY-GAPS.md; T3.004 is the closest v0.1 Technique for the endorsement-amplification distribution surface.
Attribution
inferred-strong. Hayden Davis (CEO, Kelsier Ventures) publicly admitted "sniping" both LIBRA and MELANIA tokens in interviews following the collapse. Bubblemaps published wallet-cluster analysis linking the launch-time snipers to the team-controlled fund flow. ZachXBT and Lookonchain published independent on-chain forensics. Argentine federal prosecutor Eduardo Taiano opened a fraud investigation against President Javier Milei; an Argentine judge ordered the freezing of Davis-linked assets and prosecutors requested an Interpol Red Notice for Davis in March 2025. A US class-action suit was filed in the Southern District of New York; the SDNY suit names Davis, Kelsier Ventures, Meteora, Benjamin Chow (Meteora co-founder), and other associates. No US criminal charges public at v0.1 cutoff; Argentine criminal proceedings ongoing.
OAK-Gnn
unattributed at v0.1; the case is a candidate seed for an OAK-G entry covering the Hayden Davis / Kelsier Ventures memecoin-launch operator cluster (see also examples/2025-01-hayden-davis-kelsier-cluster.md). The cohort fingerprint is established across LIBRA, MELANIA, M3M3, WOLF, HOOD, KACY, VIBES, TRUST per the SDNY amended complaint (October 2025) naming at least 15 token launches.
Key teaching point
LIBRA is OAK's canonical 2025 worked example for the sovereign-endorsement-amplified pump-and-dump sub-pattern and is the cohort's first case where a sitting head of state's official channel was the distribution surface. The case sits at the intersection of T1 (concentrated supply via bonding-curve sniping at genesis), T5.x (the coordinated-dump exit timed to the endorsement window), and T6 (defense evasion via the Kelsier / Meteora launch-infrastructure layer). The strongest attribution rests on Hayden Davis's own admission to sniping and on Bubblemaps' wallet-cluster analysis; the Argentine prosecutor's investigation and asset-freeze order are the strongest public-record sovereign-side enforcement actions in the cohort.

Summary

On 2025-02-14, Argentine President Javier Milei posted on X (formerly Twitter) endorsing the LIBRA token under the framing "Viva La Libertad Project." The token had been deployed minutes earlier on Solana through the Meteora launchpad with bonding-curve mechanics that enabled bundled snipers to acquire the majority of the early float at near-zero cost basis. Within minutes of Milei's post, LIBRA's market cap rose toward a peak fully-diluted valuation of ~$4.4B; within hours, insider wallets executed coordinated outflows.

Hayden Davis (CEO, Kelsier Ventures) publicly admitted in subsequent interviews that he had "sniped" both the LIBRA and MELANIA launches, characterising the practice as standard memecoin operator behaviour. Bubblemaps published wallet-cluster analysis on 2025-04 documenting that ~$100M was withdrawn from LIBRA's LP via wallets clustered to Davis using a methodology paralleling the MELANIA extraction pattern. The aggregate retail loss across the LIBRA collapse window was reported by multiple outlets (CoinDesk, DL News, Fortune) as ~$251M; CoinDesk's first-day reporting cited insider extraction of ~$87M, which subsequent analysis revised upward as more LP-withdrawal flows were reconstructed.

Milei deleted his original endorsement post within hours of the collapse and disclaimed prior knowledge of the project. Argentine federal prosecutor Eduardo Taiano opened a fraud investigation; the Argentine Anti-Corruption Office's later report (cited by CCN) cleared Milei of personal corruption but did not exonerate the launch operators. A document recovered from the phone of crypto lobbyist Mauricio Novelli (per The Block) detailed an alleged $5M three-tranche payment structure ($1.5M advance, $1.5M on public announcement, $2M on formal contract) connecting the Milei endorsement to the launch promoters. In March 2025, Argentine prosecutors petitioned for an Interpol Red Notice for Davis. A US class-action suit was filed in SDNY in 2025 and was expanded in October 2025 to include 15 alleged Kelsier-template token launches.

Why this is structurally novel

LIBRA is the cohort's canonical worked example of sovereign-endorsement-amplified pump-and-dump — a sub-pattern in which the distribution surface is a head-of-state's official social-media channel and the extraction is structured to complete within the endorsement-attention window. Three structural features distinguish LIBRA within the broader celebrity-endorsement memecoin cohort:

  1. The endorsement source is a sitting head of state. Unlike celebrity-endorsement memecoins where the figure is an entertainer (Iggy Azalea / MOTHER, Caitlyn Jenner / JENNER, Hawk Tuah / HAWK), the LIBRA endorser was the elected President of Argentina. The endorsement therefore carried sovereign-channel credibility and reached a mass-retail audience extending beyond crypto-native participants. The post-endorsement attention window was correspondingly larger and the retail entry rate was correspondingly faster than for entertainment-celebrity endorsements. The structural significance for OAK is that the distribution-surface trust-tier — measured by the amplifier's institutional weight — modulates the extraction-window throughput.

  2. The extraction was structured around the endorsement window. The Bubblemaps wallet-cluster analysis showed that the LP-withdrawal pattern terminated within hours of the endorsement, before the retail-attention cycle would normally peak. This is structurally distinct from a slow LP trickle (T5.002) or a treasury-management exit (T5.005) — the cohort's signature is the deliberate alignment of extraction-timing to the endorsement-amplification window. Defenders observing a similar pattern in the future should expect the extraction to complete in single-digit hours, not days.

  3. The launch infrastructure (Kelsier + Meteora) is reusable. The Kelsier-template launch (subsequent SDNY amended complaint cites at least 15 token launches by the same operator cluster — including LIBRA, MELANIA, M3M3, WOLF, HOOD, KACY, VIBES, TRUST, ENRON) demonstrates that the infrastructure is operator-cluster reusable. The same wallet-cluster, the same LP-control authority, the same bonding-curve sniping methodology recurs across launches with different celebrity / political amplifiers. The operator cluster is therefore the OAK-Gnn fingerprint candidate — the celebrity / sovereign endorser is the campaign-specific lure, not the operator.

Timeline (UTC)

When Event OAK ref
2025-02-14 (early) LIBRA token deployed on Solana via Meteora launchpad; bonding-curve mechanics permit bundled snipers to acquire majority of early float T1 (concentrated supply at launch via sniping)
2025-02-14 (minutes later) President Javier Milei posts X endorsement of "Viva La Libertad Project" / LIBRA T5.x candidate (celebrity/sovereign-endorsement amplification leg)
2025-02-14 (within minutes) LIBRA market cap surges; FDV briefly exceeds ~$4.4B (extraction window opens)
2025-02-14 (within hours) Insider wallets execute coordinated LP withdrawals; price collapses ~85%; insider extraction reported at ~$87M-$107M in first wave T5.x candidate (coordinated-dump leg)
2025-02-14 (later) Milei deletes endorsement post; disclaims prior knowledge (operator-side denial)
2025-02-15 → 2025-02-18 CoinDesk, DL News, Fortune publish coverage; Argentine federal prosecutor Eduardo Taiano opens fraud investigation; opposition parties push for impeachment (industry / regulator response)
2025-02-17 Hayden Davis admits "sniping" both LIBRA and MELANIA in CoinDesk / Yahoo coverage (operator self-disclosure)
2025-03 Argentine prosecutors request Interpol Red Notice for Davis (regulator action — Argentina)
2025-04 Bubblemaps publishes wallet-cluster analysis documenting ~$100M LIBRA LP withdrawal by Davis-clustered wallets (community forensic surface)
2025-10 SDNY class-action complaint expanded to name at least 15 Kelsier-template launches including LIBRA (US civil litigation)
Continuing Argentine Anti-Corruption Office report (per CCN) clears Milei of personal corruption; Argentine criminal proceedings ongoing; no US criminal charges public at v0.1 cutoff (attribution state)

What defenders observed

  • Pre-event: the Kelsier / Meteora launch infrastructure had no public allowlist or audit gating that distinguished sovereign-endorsement-grade campaigns from rote memecoin launches. The endorsement-source trust-tier was not part of any pre-launch detection surface — Milei's post was treated by retail as official-channel signal, but the deployer wallet's prior-cohort fingerprint (Davis / Kelsier) was not surfaced through any platform-side disclosure regime. CEX-side listing-precondition checks were not applicable because LIBRA never reached major-CEX listing.
  • At-event: the bonding-curve sniping pattern was visible in real-time on Solana mempool data; Lookonchain and Bubblemaps both surfaced the bundled-sniper signature within hours. The detection signal — N wallets acquiring M% of early float within K seconds of deploy, all funded from a common upstream cluster — is the same signal that recurs across the Kelsier cohort and is now the defining fingerprint of the v0.x T1.x sub-class.
  • Post-event: the public-record forensic surface was load-bearing. Bubblemaps' wallet-cluster analysis (April 2025), ZachXBT's threads, Lookonchain's flow reconstructions, and the SDNY discovery process (October 2025 expanded complaint) collectively reconstructed the operator cluster across LIBRA, MELANIA, and 13+ other launches. The Argentine criminal proceeding (prosecutor Taiano) and the Argentine asset-freeze order were the strongest regulator-side responses; the Interpol Red Notice request was the cohort's first sovereign-level enforcement action against a memecoin operator.

What this example tells contributors writing future Technique pages

  • Sovereign / celebrity endorsement is a distribution-surface tier, not a Technique. Future T5.x examples should enumerate the endorsement-source trust-tier explicitly: sovereign (head of state, finance ministry), supranational (UN, IMF, etc. — none observed at v0.1), entertainment-celebrity (musician, athlete, influencer), crypto-native influencer (X / Telegram personality with ≥N followers), self-promotion. The extraction-window throughput scales with the trust-tier; the OAK detection surface should include monitoring of high-trust-tier accounts for token-endorsement posts as a real-time signal.
  • The bonding-curve seconds-window is the genesis-extraction surface. Bonding-curve launchpads (Pump.fun, Meteora, etc.) compress the genesis-distribution event into seconds rather than the hours / days of a typical token-sale or fair-launch pattern. The sniping cohort exploits this compression to acquire majority float at near-zero cost basis. Future T1.x examples should record the seconds-window throughput where the data permits; the K-seconds-acquisition metric is the clean signature.
  • Operator-cluster reuse is the cohort's defining property. The Kelsier / Davis cluster's reuse across 15+ launches is the strongest argument in the cohort for a discrete OAK-G entry. Future cohort cases should record the wallet-cluster lineage to existing operator clusters where the data permits; cumulative cohort-level loss across an operator cluster is a better risk metric than per-incident loss.
  • The post-event accountability chain depends on the endorser's jurisdiction. Argentina's prosecutor opened criminal proceedings within days; the SDNY civil suit followed months later; no US criminal proceedings at v0.1 cutoff. Future cohort cases should explicitly note the endorser's jurisdiction as a structural variable — sovereign endorsers in jurisdictions with active fraud-prosecution regimes produce faster public-record accountability than entertainment-celebrity endorsers in jurisdictions with weaker regimes.

Public references

Discussion

LIBRA is OAK's canonical 2025 worked example for the sovereign-endorsement-amplified pump-and-dump sub-pattern and is the cohort's first case where a sitting head of state's official channel was the distribution surface. The case sits at the intersection of T1 (concentrated supply via bonding-curve sniping at genesis), T5.x (the coordinated-dump exit timed to the endorsement window), and T6 (defense evasion via the Kelsier / Meteora launch-infrastructure layer). The strongest attribution rests on Hayden Davis's own admission to sniping and on Bubblemaps' wallet-cluster analysis; the Argentine prosecutor's investigation and asset-freeze order are the strongest public-record sovereign-side enforcement actions in the cohort.

For OAK's broader cohort coverage, LIBRA + MELANIA (examples/2025-01-trump-melania-presidential-memecoin.md) + HAWK (examples/2024-12-hawk-tuah-celebrity-memecoin.md) collectively establish that the celebrity / sovereign-endorsement memecoin pattern recurs across late-2024 and 2025 with consistent operator-cluster signatures (Kelsier in the Davis cohort cases) and consistent extraction-window throughput. The cohort is sufficient to motivate the v0.x T5.x and T1.x sub-Technique proposals; the cohort's recurrence across multiple endorsement-source trust-tiers is structurally informative for defender-practice generalisation across the broader memecoin-launch surface.

Techniques demonstrated (4)