OAK — OnChain Attack Knowledge

Worked example · 2025-04

Meteora M3M3 launch class-action and MET airdrop controversy — Solana — 2024-12 to 2025-10

Loss
approximately $69M in claimed class-action damages alleged against Meteora and Kelsier Labs in the M3M3-token-related litigation, per the amended complaint filed April 21, 2025 in the U.S. District Court for the Southern District of New York. Investor losses are claimed for the period December 2024 - February 2025. The M3M3 token was launched in December 2024 on Meteora's Dynamic Bonding Curve (DBC) infrastructure. Adjacent: the MET airdrop controversy (October 2025) — Meteora's MET-token airdrop distributed over $1.2M in MET tokens to two Solana wallets connected to the MELANIA memecoin operator-cluster on October 23, 2025, hours after Meteora co-founder Benjamin Chow had been served with legal process in the LIBRA / MELANIA-related class-action.
Recovery
none publicly confirmed at v0.1 cutoff; SDNY civil litigation ongoing. Meteora has continued to operate as a Solana DEX through the litigation period; Chow has resigned from his Meteora leadership position (cited as related to LIBRA-fallout insider-trading allegations).
OAK Techniques observed
OAK-T2.004 (Initial-Liquidity Backdoor — the Meteora Dynamic Bonding Curve (DBC) infrastructure embedded a "freeze and thaw" launch-pool mechanic that allowed the operator cluster to capture approximately 95% of the token supply within 20 minutes of launch via 150 insider wallets; the bonding-curve LP model retained creation-time LP-control retention by the deployer cluster, structurally equivalent to the Pump.fun bonding-curve backdoor pattern but exercised through the Meteora launchpad substrate rather than Pump.fun). The case sits within the existing Hayden Davis / Kelsier Ventures memecoin-launch operator-cluster cohort (examples/2025-01-hayden-davis-kelsier-cluster.md) but extends the cohort coverage to the Meteora-launchpad-side operational-substrate, distinct from the per-token endorsement-amplified launches (LIBRA, MELANIA) covered there. Proposed v0.x candidates apply: the same T5.x / T1.x sub-class proposals in TAXONOMY-GAPS.md for bonding-curve-launchpad-as-extraction-substrate + insider-allocation-via-sniping-at-launch + operator-cluster-launchpad-cooperation are the canonical Technique-class anchors. The case chains with OAK-T6 (defense evasion via the launchpad's freeze-and-thaw mechanic that dominated supply distribution during the launch window), OAK-T1.003 (Mint / ICO / NFT Exit — concentrated supply at genesis via insider wallet allocations), and OAK-T5.005 (operator-side / treasury-management-style exits by the launchpad's leadership during the 2024-12 → 2025-02 launch-and-exit window).
Attribution
inferred-strong. The amended SDNY complaint (filed April 21, 2025) names Benjamin Chow (Meteora co-founder), Meteora, Kelsier Labs / Ventures, and four current or former executives as defendants alleging that they "intentionally misrepresented" information in the December 2024 M3M3 launch and "jointly developed a scheme to defraud investors." The complaint alleges that the defendants used 150 insider wallets to dominate the token supply via a "freeze and thaw" launch-pool mechanic that gave the operator cluster "secret control of around 95% of the tokens within 20 minutes of the launch." Chow has resigned from Meteora amid the related LIBRA-insider-trading allegations. Hayden Davis (Kelsier Ventures) publicly admitted (CoinDesk, February 17, 2025) to "sniping" both LIBRA and MELANIA launches; the same operator-cluster fingerprint extends across M3M3 per Bubblemaps' wallet-cluster analyses. The MET airdrop controversy (October 23, 2025) added direct on-chain evidence linking Meteora's distribution mechanism to MELANIA-cluster-controlled wallets. No US criminal charges public at v0.1 cutoff; Argentine criminal proceedings against the LIBRA operators are ongoing (Interpol Red Notice requested for Davis in March 2025).
Key teaching point
**Bonding-curve launchpads where the launchpad operator is itself corporately overlapping with the launch-time insider operator-cluster are a structurally distinct cohort sub-pattern that defender-side intervention surfaces are not currently calibrated against.** The Meteora / Kelsier / M3M3 case is the canonical 2024-2025 example: the launchpad operator (Meteora, via Chow) and the launch operator (Kelsier, via Davis) are not at-arms-length; per the SDNY complaint, the corporate overlap and operational coordination were the load-bearing primitive that enabled the freeze-and-thaw 95%-supply-capture mechanic. Defender-side cohort-aggregate methodology (Solidus Labs cohort framing on Pump.fun, see examples/2024-2025-pump-fun-bonding-curve-rug-cohort.md) is calibrated against per-launch operator-cluster fingerprinting on top of neutral launchpad infrastructure; the Meteora case exposes a sub-pattern where the launchpad infrastructure is itself part of the operator cluster. T6 (defense evasion) at the launchpad-substrate-cooperation layer is the OAK-mapping framing; v0.x development should anticipate that defender-side intervention requires per-launchpad-operator-cluster analysis, not just per-launch-operator-cluster analysis.

Summary

Meteora is a Solana-native DEX and AMM-infrastructure operator that provides Dynamic Bonding Curve (DBC) and Dynamic Liquidity Market Maker (DLMM) launchpad mechanics for Solana tokens. Through 2024-2025, Meteora's launchpad infrastructure was the venue for several high-profile memecoin launches that subsequently produced cohort-scale retail losses, including LIBRA (February 2025; see examples/2025-02-libra-milei-presidential-pump-dump.md), MELANIA (January 2025; covered in examples/2025-01-trump-melania-presidential-memecoin.md), and M3M3 (December 2024).

The M3M3 token launched in December 2024 on Meteora's DBC infrastructure. Per the amended SDNY class-action complaint filed April 21, 2025 in the U.S. District Court for the Southern District of New York, the launch was structured to give the operator cluster (Meteora, Kelsier Ventures, and named executives) "secret control of around 95% of the tokens within 20 minutes of the launch" via a freeze-and-thaw mechanic: the launchpad mechanic permitted the operator cluster to freeze the launch pool, allow insider wallets to acquire supply at preferential prices, then thaw the pool for retail trading after the insider acquisition phase. The complaint alleges that 150 insider wallets dominated the M3M3 token supply during the launch window, and that the resulting concentrated supply was sold into retail demand between December 2024 and February 2025, producing ~$69M in claimed losses to non-insider buyers.

The M3M3 case is structurally connected to the broader Hayden Davis / Kelsier Ventures memecoin-launch operator-cluster cohort. Per Bubblemaps' wallet-cluster analyses, the launch-time snipers across M3M3 share a common operator-cluster fingerprint with LIBRA, MELANIA, WOLF, and other named launches in the cluster. Davis publicly admitted to "sniping" both LIBRA and MELANIA in a CoinDesk interview (February 17, 2025); the M3M3 launch precedes the LIBRA / MELANIA window by approximately one month and is the earliest-publicly-litigated case in the cohort. The amended SDNY complaint (filed April 21, 2025) was the first to name Meteora's Chow alongside the Davis-side defendants; a separate earlier filing in the same docket targeted Meteora and Kelsier Ventures over the LIBRA token launch.

In October 2025, a separate Meteora controversy emerged: Meteora's MET-token airdrop on October 23, 2025 distributed over $1.2M in MET tokens to two Solana wallets connected to the MELANIA memecoin operator-cluster. The airdrop occurred hours after Chow had been served with legal process in the LIBRA / MELANIA-related class-action and shortly after Chow had resigned from his Meteora leadership position. The MET-airdrop-to-MELANIA-cluster-wallets event added direct on-chain evidence to the SDNY complaint's structural framing — that Meteora's distribution mechanisms were not at-arms-length from the Kelsier-cluster's operator surface, even after the legal proceedings had begun.

The case is the canonical 2024-2025 worked example of bonding-curve-launchpad-and-launch-operator corporate overlap producing structurally exploitable token-launch dynamics. The structural pattern — launchpad operator and launch operator are not at-arms-length — is distinct from the broader Pump.fun cohort (where Pump.fun is alleged to operate as a fee-aligned but operationally-distinct platform substrate; see examples/2024-2025-pump-fun-bonding-curve-rug-cohort.md) because the Meteora case alleges direct operational coordination, not just downstream-fee-alignment.

Why this is structurally significant

The Meteora M3M3 case is structurally distinct from prior Solana memecoin-launch cohort coverage in three ways:

  1. The launchpad operator and launch operator are alleged to be operationally coordinated, not just fee-aligned. The Pump.fun cohort (examples/2024-2025-pump-fun-bonding-curve-rug-cohort.md) is alleged in the SDNY RICO litigation to operate a fee-aligned platform substrate with downstream Solana-Labs and Jito-Labs MEV-extraction integration — but the per-launch operator clusters ("Rug Republic" twelve-cluster cohort) are operationally distinct from the Pump.fun-platform leadership. The Meteora / M3M3 case alleges direct corporate overlap between Meteora's leadership (Chow) and the per-launch operator cluster (Davis / Kelsier). This is a structurally tighter coordination shape and produces structurally different defender-intervention surfaces: per-launch operator-cluster analysis is insufficient when the launchpad infrastructure itself is part of the operator cluster.

  2. The freeze-and-thaw mechanic is a launchpad-substrate-specific extraction primitive. Per the amended SDNY complaint, the M3M3 launch used a freeze-and-thaw mechanic that allowed the operator cluster to acquire 95% of supply during the freeze phase before retail had access to the pool. This is structurally distinct from the Pump.fun bonding-curve seconds-window-acquisition primitive (where the operator cluster acquires supply via fast bot-driven trading on the open bonding curve at deploy-time) — Meteora's mechanic does not require speed relative to retail because the pool is frozen against retail during the operator-acquisition phase. The defender-intervention surface for the Meteora primitive is at the launchpad-mechanic-design layer (freeze-and-thaw should not exist as a launchpad feature without external-trustee or audit-gated authorisation), not at the seconds-window-detection layer.

  3. The MET-airdrop-during-litigation event is a public-record-strong evidence anchor. The October 23, 2025 distribution of $1.2M+ in MET tokens to MELANIA-cluster wallets, hours after Chow had been served with legal process and shortly after he had resigned, is a structurally-public on-chain signal that the litigation surface had not produced operational separation between Meteora's distribution mechanisms and the alleged Kelsier-cluster operator surface. Defender-side cohort analysis should treat post-litigation on-chain coordination signals as a first-class structural-attribution observable; the Meteora case is the canonical 2024-2025 example.

The case generalises beyond Meteora: any Solana-native bonding-curve / DBC launchpad whose corporate leadership overlaps with the per-launch operator surface is exposed to the same structural shape. Future contributors writing similar worked examples should preserve the "launchpad operator and launch operator corporate-overlap" framing as a discrete sub-pattern within the broader bonding-curve-launchpad cohort.

Timeline (UTC)

When Event OAK ref
Pre-2024-12 Meteora operates Solana DEX with DBC and DLMM launchpad mechanics; Benjamin Chow is co-founder; corporate / operational relationships between Meteora and Kelsier Ventures (Hayden Davis) develop (genesis surface)
2024-12 M3M3 token launches on Meteora DBC infrastructure; per SDNY amended complaint, freeze-and-thaw mechanic permits operator cluster to acquire ~95% of supply via 150 insider wallets within 20 minutes of launch T6 launchpad-substrate-cooperation surface
2024-12 → 2025-02 M3M3 token sold into retail demand; investors claim ~$69M cumulative losses; M3M3 price collapses T5.005-class extraction (insider supply distribution)
2025-01 MELANIA launched (covered separately at examples/2025-01-trump-melania-presidential-memecoin.md); same operator-cluster fingerprint per Bubblemaps (cluster-cohort recurrence)
2025-02-14 LIBRA launched (covered separately at examples/2025-02-libra-milei-presidential-pump-dump.md); ~$251M retail extraction; same operator-cluster fingerprint (cluster-cohort recurrence)
2025-02-17 Hayden Davis publicly admits to CoinDesk "sniping" both LIBRA and MELANIA launches; Bubblemaps publishes wallet-cluster analyses linking M3M3, LIBRA, MELANIA, WOLF, and other named launches to a common cluster Operator-action attribution → inferred-strong
2025-Q1 (post-LIBRA) Burwick Law / Hoppin Grinsell LLP files initial SDNY class-action targeting Meteora and Kelsier Ventures over LIBRA token launch (litigation surface — initial)
2025-Q1 Chow resigns from Meteora leadership amid LIBRA-related insider-trading allegations (operator response)
2025-04-21 Amended SDNY complaint filed; names Chow, Meteora, Kelsier Labs, and four current or former executives; alleges 150 insider wallets and freeze-and-thaw 95%-supply-capture mechanic for M3M3 Litigation surface — RICO / fraud framing
2025-04 onward Cointelegraph, Cryptopotato, Decrypt, Crypto.news, AInvest publish litigation-cycle coverage (forensic surface — secondary)
2025-10-23 Meteora MET airdrop distributes $1.2M+ in MET tokens to two MELANIA-cluster-connected Solana wallets; airdrop occurs hours after Chow service of process and shortly after his resignation On-chain post-litigation coordination signal
2025-10 onward Fortune, Cryptonews publish coverage of the MET-airdrop-to-MELANIA-cluster event; structural framing of Meteora's distribution mechanisms as not at-arms-length from the Kelsier-cluster operator surface enters general crypto-press lexicon (forensic + journalism surface)
Continuing SDNY civil litigation ongoing; no US criminal charges public; Argentine criminal proceedings against LIBRA operators continue (continuing surface)

What defenders observed

  • Pre-event (launchpad-mechanic-design layer): the freeze-and-thaw mechanic was a published feature of Meteora's DBC launchpad infrastructure; the operational use of the mechanic during the M3M3 launch was visible to the operator cluster but opaque to retail. Defender lesson: launchpad-mechanic design that includes administrator-controlled freeze / thaw / pause primitives should require external-trustee or audit-gated authorisation to use these primitives; absence of external authorisation makes the primitives structurally exploitable for insider-supply-capture.
  • At-event (insider-wallet-cluster layer): the 150 insider wallets that captured ~95% of M3M3 supply during the freeze phase are observable on-chain. Bubblemaps published wallet-cluster analyses post-LIBRA / MELANIA that surfaced the cohort-cluster fingerprint across multiple named launches. Defender lesson: cohort-aggregate methodology (wallet-cluster analysis + LP-drain pattern correlation across launches) is the v0.x detection primitive; the methodology generalises across bonding-curve launchpads and is structurally aligned with the Solidus Labs Pump.fun analysis.
  • At-event (corporate-overlap layer): the alleged corporate / operational coordination between Meteora's leadership and Kelsier Ventures is documented in the SDNY complaint's allegations and supported by the post-litigation MET-airdrop event. Defender lesson: per-launchpad-operator-cluster analysis is a discrete defender-tooling layer that is currently underdeveloped; cohort analysts (Bubblemaps, Solidus Labs, Chainalysis-style) should add per-launchpad-operator-cluster fingerprinting to standard cohort-aggregate methodology.
  • Post-event (litigation-surface-and-on-chain-coordination layer): the October 2025 MET-airdrop-to-MELANIA-cluster-wallets event is structurally informative: post-litigation operational separation was not visible at the on-chain distribution mechanism level. Defender lesson: post-litigation on-chain signals should be treated as a first-class observable for assessing operator-cluster-and-launchpad-operator separation; the Meteora case is the canonical 2024-2025 example.
  • Post-event (cross-launch operator-cluster cohort layer): the M3M3 case sits within the broader Davis / Kelsier cohort (examples/2025-01-hayden-davis-kelsier-cluster.md); per-launch analysis is insufficient for cohort-attribution. Defender lesson: operator-cluster cohort coverage should be cross-launch by design; the cohort's 15+ named launches in the SDNY amended complaint demonstrate that per-launch attribution is structurally weaker than cross-launch cohort attribution.

What this example tells contributors writing future Technique pages

  • Bonding-curve launchpad operator-cooperation with launch operator is a structurally distinct sub-pattern. Future T5.x / T1.x worked examples should preserve the "launchpad operator and launch operator corporate-overlap" framing as discrete sub-pattern. The Meteora case is the canonical 2024-2025 worked example.
  • Freeze-and-thaw launchpad mechanics are a structurally exploitable primitive. Future bonding-curve-launchpad worked examples should record administrator-controlled pause / freeze / thaw primitives as a first-class observable; their presence is structurally exploitable for insider-supply-capture and warrants cohort-level cataloguing across launchpads.
  • Post-litigation on-chain coordination is a discrete attribution observable. The MET-airdrop-during-litigation event demonstrates that on-chain coordination signals during active litigation provide structurally-strong attribution evidence. Future attribution-strength documentation should preserve this observable as a discrete category.
  • Cross-launch operator-cluster cohort attribution is structurally stronger than per-launch attribution. The M3M3 case sits within the broader Davis / Kelsier cohort; per-launch attribution-strength is bounded; cross-launch attribution is structurally stronger. Future cohort worked examples should preserve cross-launch cohort framing where the public record permits.
  • The M3M3 / Meteora case extends the Pump.fun cohort framing to launchpad-operator-direct-coordination. The two cases — Pump.fun fee-aligned-but-operationally-distinct vs. Meteora alleged-direct-operational-coordination — establish two structurally distinct sub-patterns within the broader bonding-curve-launchpad cohort. v0.x Technique work should preserve both sub-patterns as discrete classes.

Public references

Discussion

The Meteora M3M3 case is OAK's canonical 2024-2025 worked example for bonding-curve launchpad-and-launch-operator corporate-overlap producing structurally exploitable token-launch dynamics. The case extends the broader Hayden Davis / Kelsier Ventures cohort coverage (examples/2025-01-hayden-davis-kelsier-cluster.md) to the launchpad-operator-substrate layer and pairs structurally with the Pump.fun cohort coverage (examples/2024-2025-pump-fun-bonding-curve-rug-cohort.md) to establish two distinct sub-patterns within the broader bonding-curve-launchpad cohort:

  • Pump.fun: fee-aligned platform substrate with operationally-distinct per-launch operator clusters. The platform-level fee-extraction is downstream-aligned with cohort throughput regardless of per-token outcome; operator-cluster analysis is per-launch.
  • Meteora: alleged direct corporate / operational coordination between launchpad operator and per-launch operator cluster. Per-launch operator-cluster analysis is insufficient because the launchpad infrastructure itself is part of the operator-cluster surface.

The two sub-patterns produce structurally different defender-intervention surfaces. Pump.fun-side intervention targets per-launch operator-cluster fingerprinting and platform-level fee-policy / KYC / allowlist gating. Meteora-side intervention requires per-launchpad-operator-cluster analysis as a discrete tooling layer; the cohort-aggregate methodology must extend to fingerprinting the launchpad's leadership and corporate relationships, not just the per-launch wallet clusters.

For OAK's broader cohort coverage, this case + the Davis / Kelsier cohort + the per-token celebrity-endorsement cases (LIBRA, MELANIA, HAWK, M3M3, WOLF) collectively establish the two-axis taxonomy of the 2024-2025 Solana memecoin extraction-cohort: one axis is the launch-amplification surface (celebrity, sovereign, influencer, launchpad-internal); the other axis is the launchpad-operator-cluster relationship (at-arms-length, fee-aligned, operationally-coordinated). The four-quadrant matrix produced by the two axes is the v0.x taxonomy framing that OAK should preserve for the broader memecoin-extraction-cohort coverage.

The litigation outcome will materially affect the structural-attribution language available to future OAK examples covering bonding-curve-launchpad cohorts. At v0.1 cutoff, the SDNY litigation is ongoing; no US criminal charges against the named defendants are public. The case will likely produce additional documentation through 2026-2027 as the litigation advances; OAK should track the case for promotion of the structural-attribution framing as the public-record forensic surface matures.

The MET-airdrop-during-litigation event (October 23, 2025) is the strongest single on-chain anchor in the case for the operational-coordination-not-broken-by-litigation claim. The structural shape — operator-cluster recipient wallets receive launchpad-distribution-mechanism-controlled assets hours after the launchpad operator is served with legal process — is structurally informative for future cases involving alleged operator-cluster / launchpad-operator coordination. Defender-side intervention surfaces (regulatory action, on-chain enforcement, platform-side delisting) should preserve post-litigation on-chain coordination signals as a first-class evidence anchor.

Techniques demonstrated (4)