OAK — OnChain Attack Knowledge

Worked example · 2026-04

RaveDAO ($RAVE) insider OTC distribution and coordinated dump — Multi-CEX (Binance / Bitget / Gate) — 2026-04

Loss
approximately $5.7B in market-cap evaporated within ~48 hours (2026-04-17 → 2026-04-19). Peak market-cap briefly exceeded $6B at price ~$26-$28 per RAVE; price fell below $1 during the unwind. The "loss" here is the spread between insider distribution-cost basis and the post-dump retail mark — the structural pattern is transfer of value from late-buying retail on Binance / Bitget / Gate to the insider OTC cohort that received tokens from the team multisig prior to the surge.
OAK Techniques observed
OAK-T5.001 (Hard LP Drain — boundary case; the extraction was via CEX order-book sell pressure from multisig→Bitget deposit-cluster outflows rather than on-chain LP removal, but the structural pattern — operator-controlled supply concentration → coordinated dump into active market — is the T5.001 extraction surface adapted to the CEX-listing venue) + OAK-T1.004 (Blacklist / Pausable Weaponization — boundary case; ~90% of total supply concentrated in three Gnosis Safe multisigs with no public vesting-contract structure) + OAK-T2.001 (Single-Sided Liquidity — the token launch concentrated ~90% of supply in three operator-controlled multisigs with no vesting, creating a single-sided liquidity surface: insiders controlled the entire liquid supply and could coordinate the dump against retail buyers) + OAK-T3.004 (Influencer-Amplified Promotion-and-Dump — weaker fit; no named celebrity endorser but the ~6,000% vertical move had no proportionate news catalyst, consistent with coordinated insider demand-generation).
Attribution
inferred-strong. ZachXBT publicly identified concentrated wallet activity controlling ~95% of RAVE supply, traced multisig outflows to specific Bitget deposit addresses preceding the rally and the unwind, and offered a personal $10,000 bounty (later raised to $25,000 with community contributions) for whistleblower evidence. Binance and Bitget formally opened investigations on 2026-04-18. RaveDAO publicly denied insider involvement. No regulatory action public at the time of writing.
OAK-Gnn
unattributed at v0.1; the case is a candidate seed for a future OAK-G entry covering token-launch-insider operator patterns if a multi-incident operator-cohort fingerprint emerges.
Key teaching point
RaveDAO is OAK's canonical 2026 worked example for the insider-OTC-distribution → coordinated-dump exit pattern. The case is structurally distinct from the v0.1 T5 sub-Techniques because the proximate dumpers are one or more hops removed from the team multisig: the team multisig outflow looks like "OTC distribution" at the smart-contract level (a clean transfer to a non-flagged address), and the dumping happens through CEX deposit clusters that receive those tokens from the OTC cohort. The detection burden therefore lives in deposit-address fingerprinting and timing correlation rather than in LP-trajectory analysis or treasury-balance accounting.

Summary

RaveDAO launched its RAVE token on Binance Alpha in December 2025 with a 1B fixed total supply. For approximately four months the token traded quietly near $0.25. Between 2026-04-12 and 2026-04-17, RAVE surged ~6,000% from ~$0.25 to a peak between $26 and $28, briefly valuing the project at over $6B. The vertical move had no proportionate news catalyst, no comparable on-chain growth, and no fundamental driver consistent with the magnitude.

On 2026-04-18, on-chain investigator ZachXBT published findings on X documenting that RAVE supply was concentrated approximately 90% across three Gnosis Safe multisigs (75.2%, 9.87%, 4.67%) with the top-10 holders exceeding 98% of supply, and that wallets directly linked to the RaveDAO deployer / team multisig had transferred 18.58M RAVE ($19M notional at the time) to Bitget deposit addresses approximately 10 hours before the vertical move began. Approximately three hours before ZachXBT's post and concurrent with the unwind, the same multisig cluster sent another 23M RAVE ($23M) to two Bitget deposit addresses, accelerating the collapse.

ZachXBT also documented a separate ~$42M flow of RAVE to Bitget with ~$32M withdrawn back on-chain shortly after — a pattern consistent with bait-the-shorts-then-squeeze: order-book sell-pressure was withdrawn so that forced liquidations of short positions produced a mechanical buying cascade. Within 48 hours of the peak, RAVE had fallen below $1.

Binance co-CEO Richard Teng and Bitget CEO Gracy Chen publicly confirmed both exchanges had opened formal reviews on 2026-04-18. RaveDAO denied team involvement in the price action. Coverage came from CoinDesk, The Block, Disruption Banking, Crypto Times, Yahoo Finance, Yellow.com, KuCoin, Phemex, MEXC, and others.

Why this is structurally novel

The RaveDAO case is the cleanest 2026 worked example of a pattern OAK v0.1 does not cover cleanly: insider-OTC-distribution → coordinated-dump exit. Three structural properties distinguish it from the existing T5 sub-Techniques:

  1. The OTC layer launders the exit through a buyer cohort. Unlike T5.001 (Hard LP Drain) where the operator removes liquidity in a single observable on-chain event, and unlike T5.005 (Treasury-Management Exit) where the operator's own multisig drains its own treasury to founder cluster, the RaveDAO pattern interposes a buyer cohort: the team multisig transfers tokens (often at OTC discount) to recipients who then execute the visible dump. The team multisig outflows look like "OTC investor distribution" or "market-maker provisioning" — a stated-purpose framing T5.005 already names but does not exhaustively cover for the post-CEX-listing sub-pattern where the recipient is the proximate dumper.

  2. Detection lives in deposit-address clustering, not LP-trajectory analysis. T5.001 is detectable via single-event LP outflow watchers; T5.002 via cumulative LP-trajectory drift. The RaveDAO pattern requires deposit-address fingerprinting — clustering CEX deposit addresses that received outflows from the team multisig and correlating them with subsequent CEX sell-pressure. This is the methodology ZachXBT used and is the methodology Lookonchain / Arkham / Bubblemaps deploy on similar cohort cases. The detection primitives are different from the T5.001 / T5.002 LP-watcher stack.

  3. Attribution requires multi-counterparty tracing. T5.001 attribution is straightforward: the LP-control authority is the operator. T5.005 attribution is trickier but bounded: the multisig signers are the operators. The RaveDAO pattern adds intermediate counterparties — OTC buyers, market makers, deposit-address operators — each of whom may or may not be coordinated with the team. The attribution-strength language has to distinguish between (a) team-coordinated dump executed via OTC counterparties (the operator-driven case) vs (b) team-naive OTC distribution to bad-faith counterparties who then dumped (the negligence case). The on-chain artefact alone often cannot distinguish; the off-chain stated-purpose reference (was the OTC sale disclosed? at what discount? to whom?) is necessary to score.

The RaveDAO case is structurally adjacent to the Movement MOVE December 2024 case (examples/2024-12-movement-move-otc-dump.md) and the Mantra OM April 2025 case (examples/2025-04-mantra-om-otc-dump.md). The three together establish the cohort and motivate the v0.x Technique proposal in TAXONOMY-GAPS.md.

Timeline (UTC)

When Event OAK ref
2025-12 RAVE launches on Binance Alpha; 1B fixed total supply; 24% circulating float (~248M RAVE); ~90% of total supply held across three Gnosis Safe multisigs (75.2% / 9.87% / 4.67%) T1 (concentrated supply at genesis)
2025-12 → 2026-04-11 RAVE trades sideways near $0.25 with low volume (latent surface)
~2026-04-13 Wallets linked to RaveDAO deployer transfer 18.58M RAVE ($19M) to Bitget deposit addresses ~10 hours before the vertical move begins T5.x candidate (insider OTC distribution leg)
2026-04-12 → 2026-04-17 RAVE surges from ~$0.25 to peak $26-$28 (~6,000% in ~5 days); market-cap briefly > $6B; ~$42M RAVE flows to Bitget with ~$32M withdrawn back on-chain (bait-the-shorts pattern) T5.x candidate (coordinated-pump leg)
~2026-04-18 (~3 hours before ZachXBT post) Multisig cluster sends another 23M RAVE ($23M) to two Bitget deposit addresses T5.x candidate (coordinated-dump leg)
2026-04-18 ZachXBT publishes on-chain findings on X; offers $10K personal bounty for whistleblower evidence (raised to $25K with community contributions); RAVE begins precipitous decline (community forensic surface)
2026-04-18 Binance co-CEO Richard Teng confirms Binance opens formal review; Bitget CEO Gracy Chen confirms Bitget opens formal review (exchange-side response)
2026-04-19 → 2026-04-20 RAVE falls below $1; CoinDesk, The Block, Disruption Banking, Crypto Times publish coverage; RaveDAO publicly denies team involvement (industry coverage; operator-side denial)
Continuing Binance / Bitget investigations open as of v0.1 cutoff; no regulatory action public; no operator identification beyond the multisig clusters (attribution state)

What defenders observed

  • Pre-event: the structural risk profile was visible from genesis. Three Gnosis Safe multisigs holding ~90% of total supply with only 24% circulating float is a T1 concentrated-supply signature that is observable at listing. The pre-event signal is not the dump itself but the supply-concentration ratio combined with the absence of public vesting-contract structure for the multisig holdings. CEX listing-precondition checks could (and did not) flag this — Binance Alpha listed RAVE despite the concentration.
  • At-event: the deposit-address fingerprint was the load-bearing detection signal. The team multisig outflows to Bitget deposit addresses 10 hours before the vertical move are observable on-chain; clustering the recipient deposit addresses against subsequent CEX sell-pressure is the technique ZachXBT publicly demonstrated. The bait-the-shorts pattern ($42M in / ~$32M out within a short window) is observable in CEX flow data and in on-chain deposit / withdrawal records to / from Bitget hot wallets.
  • Post-event: the unwind acceleration was triggered by the observable 23M RAVE ($23M) transfer to Bitget approximately three hours before ZachXBT's post. The transfer was on-chain visible in real time; the on-chain deposit fingerprint was the trigger for the public-record investigation. The exchange-side response (Binance and Bitget formally investigating) is the canonical post-event response surface but did not constitute funds recovery — the value transfer to the OTC cohort had already settled.

What this example tells contributors writing future Technique pages

  • Insider OTC distribution is a load-bearing OAK gap. The team multisig outflow to a CEX deposit address is the clean on-chain artefact; the OTC buyer who receives those tokens is the proximate dumper but is one or more hops removed from the operator. The Technique class needs to name the structural pattern (OTC layer + coordinated dump) rather than the specific authority exercised (the multisig outflow looks legitimate at the smart-contract level). Future contributors should anchor on the deposit-address-cluster detection methodology: cluster CEX deposit addresses that received outflows from the team multisig within N blocks of a price move; correlate with CEX sell-pressure; surface the OTC layer as a structural object.
  • Multi-CEX coordination is part of the Technique signature. RaveDAO's pump traversed Binance, Bitget, and Gate concurrently. The cross-CEX coordination is part of the pattern (it raises the cost of any single CEX's defensive action). Future T5.x examples should enumerate the CEX surface explicitly and note where the deposit-cluster fingerprint spans multiple venues.
  • Attribution-strength language has to handle the "team denies, on-chain confirms" gap. RaveDAO publicly denied insider involvement; the on-chain evidence (multisig → Bitget deposit clusters, supply concentration, timing) is conclusive at the structural level. The OAK attribution-strength language has to score this as inferred-strong (on-chain evidence is conclusive, operator identity is not legally proven, no regulatory action) rather than confirmed. Contributors should preserve this distinction explicitly — the bar for confirmed is regulator action (SEC / DOJ / equivalent), not journalist consensus or community attribution.
  • The bait-the-shorts mechanical-cascade pattern is part of the value-extraction sub-pattern. The ~$42M-in / ~$32M-out flow to Bitget that produced the short-squeeze cascade is itself a sub-pattern within the broader OTC-dump cohort. Future examples involving similar mechanical-cascade-via-CEX-flow patterns should enumerate the per-leg flow accounting where the data permits — the per-leg accounting is what distinguishes a coordinated bait-the-shorts pattern from organic short-covering.

Public references

Discussion

RaveDAO is OAK's canonical 2026 worked example for the insider-OTC-distribution → coordinated-dump exit pattern. The case is structurally distinct from the v0.1 T5 sub-Techniques because the proximate dumpers are one or more hops removed from the team multisig: the team multisig outflow looks like "OTC distribution" at the smart-contract level (a clean transfer to a non-flagged address), and the dumping happens through CEX deposit clusters that receive those tokens from the OTC cohort. The detection burden therefore lives in deposit-address fingerprinting and timing correlation rather than in LP-trajectory analysis or treasury-balance accounting.

The case extends the v0.1 cohort that includes Movement MOVE (December 2024) and Mantra OM (April 2025) — together they establish that the pattern recurs across 2024-2026 across multiple chain ecosystems and exchange venues. The cohort framing is what motivates the v0.x sub-Technique candidate in TAXONOMY-GAPS.md. RaveDAO's distinguishing analytical value within the cohort is the clarity of the on-chain artefact: the ~95% supply concentration, the multisig → Bitget deposit-address fingerprints, and the bait-the-shorts mechanical cascade are each individually documentable and collectively conclusive at the structural level even though operator identity and intent remain in dispute.

For future OAK versions, the RaveDAO case is the strongest argument for a discrete T5.x sub-Technique because the existing T5 sub-Techniques each fail to capture a load-bearing element: T5.001 misses the OTC layer (no LP drain occurred), T5.002 misses the coordinated-cohort structure (no slow trickle, the dump was concentrated), T5.005 captures the multisig-substantive-misuse framing but not the post-CEX-listing sub-pattern where the deposit-address cluster is the load-bearing detection primitive. The v0.x proposal should preserve T5.005 as the umbrella for substantive misuse of legitimate authority and add a discrete sibling for the OTC-distribution-then-dump structural pattern.

Techniques demonstrated (4)