OAK — OnChain Attack Knowledge

Worked example · 2026-04

RAVE Token — -95% Market Manipulation / CEX Intervention — 2026-04

Loss
RAVE token price crashed from $26 to $1 (-95%) within 24 hours on April 18, 2026. An additional -40% drop from $1 to $0.60 occurred on April 19 when multisig 0x53d7 (linked to RAVE initial distribution) deposited ~23M RAVE (~$23M) to two Bitget deposit addresses.
OAK Techniques observed
none — the file establishes the outflow but not the authority basis a Technique tag would need. A multisig linked to RAVE's initial distribution sent ~23M RAVE to two Bitget deposit addresses, with a -40% move within three hours; the entity that distributed the token to the market was the entity selling into it. T5.005 (Treasury-Management Exit) is the nearest home but its discriminator is a stated-purpose mismatch — outflows publicly framed as legitimate expenditure — and the file never establishes that the multisig is a treasury or that any purpose was stated. T5.006 is ruled out (no vesting cliff), T3.003 (no pump leg documented — only a crash), T3.006 (requires ≥4 simultaneous vectors; one is documented). The CEX deposit-address flow is a detection surface, not a mechanism. Note: the file's title claims market manipulation, but what its evidence establishes is an insider dump; the -95% first leg is unexplained.
Attribution
inferred-strong — multisig address 0x53d7 identified as linked to RAVE initial distribution. ZachXBT offered $10K bounty. Binance, Bitget, and Gate called to investigate. Bitget deposits from 0x53d7 directly observed.
Key teaching point
The RAVE crash demonstrates the CEX deposit address as manipulation detection surface pattern: the second leg of the crash ($1→$0.60, -40%) was directly observable when multisig 0x53d7 (linked to RAVE's initial token distribution) sent ~23M RAVE to Bitget deposit addresses. The CEX deposit address is a public on-chain artifact that reveals insider distribution BEFORE the sell executes on the exchange order book. Detection approach: monitor CEX deposit addresses for large token inflows from wallets linked to initial token distributions/team allocations; a multisig that distributed tokens at launch sending tokens to exchange deposit addresses is an imminent sell signal.

Summary

On April 18, 2026, the RAVE token experienced a -95% crash from $26 to $1 within 24 hours. ZachXBT posted a call to action at 7:26 AM UTC, offering a $10K bounty and directly appealing to Binance, Bitget, and Gate to investigate.

On April 19, ZachXBT identified the critical forensic artifact: multisig 0x53d7, linked to the RAVE initial distribution, sent 23M RAVE ($23M at current price) to two Bitget deposit addresses. The price dropped an additional 40% ($1→$0.60) within three hours of the Bitget deposits.

The detection sequence:

  1. Price anomaly detected: -95% in 24 hours is a >5-sigma outlier
  2. Community response triggered: Bounty + CEX appeals
  3. On-chain forensic follow-up: Trace token flows from initial distribution wallets
  4. CEX deposit address identification: Multisig 0x53d7 → Bitget deposit addresses
  5. Confirmation: Another -40% after the deposit confirms the sell pressure source

This is a two-phase detection: phase 1 (anomaly detection from price data) triggers phase 2 (on-chain tracing to CEX deposit addresses), which identifies the specific actor.

Timeline

When Event OAK ref
2026-04-18 ~00:00-07:00 UTC RAVE price crashes from $26 to $1 (-95%) T3 market manipulation
2026-04-18 07:26 UTC ZachXBT posts call to action, offers $10K bounty, names Binance/Bitget/Gate (community response)
2026-04-18 10:56 UTC ZachXBT posts follow-up with findings (investigation)
2026-04-19 ~20:43 UTC Multisig 0x53d7 (RAVE initial distribution) sends ~23M RAVE to two Bitget deposit addresses T12 CEX deposit forensics
2026-04-19 ~23:43 UTC Price drops another 40% ($1→$0.60). ZachXBT posts update identifying multisig (confirmation)

What defenders observed

  • CEX deposit address as the public forensic artifact: The multisig's token movement to Bitget deposit addresses was visible on-chain BEFORE the sell pressure hit the order book. CEX deposit addresses are a detection surface that precedes market impact — the deposit is observable, the sell is not (CEX order books are private), but the temporal correlation (deposit → price drop) is confirmatory.
  • Initial distribution multisig as threat actor: The wallet sending tokens to Bitget was 0x53d7 — linked to RAVE's initial token distribution. This means the entity that originally distributed the token to the market was the same entity dumping on retail. The initial distribution wallet is a high-value monitoring target for any token.
  • Two-phase crash = two detection surfaces: The first crash ($26→$1) was detected through price anomaly. The second crash ($1→$0.60) was detected through on-chain CEX deposit forensics. Two independent detection methods confirm the same manipulation pattern.
  • Multi-CEX deposit routing: The multisig used Bitget specifically, even though RAVE traded on Binance, Bitget, and Gate. This suggests CEX shopping — choosing the exchange perceived to have the weakest surveillance.

What this example tells contributors

  • CEX deposit addresses from initial distribution wallets are a T12 detection primitive. Any token's initial distribution wallets (multisigs, team allocation wallets, treasury) sending large amounts to CEX deposit addresses is a high-precision sell signal. This is on-chain observable and precedes market impact. OAK T12 specs should include "initial distribution → CEX deposit address flow monitoring."
  • -90%+ in 24 hours is a high-precision anomaly trigger. This is a detection rule with near-zero false positives. Automated monitoring for tokens with CEX listings experiencing -90%+ daily drawdowns is a low-cost, high-signal detection primitive.
  • Community-to-CEX escalation is a documented response workflow. The sequence: public alert → bounty → CEX investigation → on-chain forensics → specific wallet identification — is a repeatable pattern. OAK investigation methodology should codify this as a standard response procedure.

Public references