Worked example · 2026-05

LAB and the Bitget market-maker cohort — four launches where insiders held almost the whole supply and one venue sat in the middle of all of them — LAB / RAVE / RIVER / SIREN — 2026-03 → 2026-07

Loss: not a theft, a transfer. LAB ran from about $0.68 to over $4.00 in early May 2026 — an FDV above $6B — then fell more than 65% within hours, and by 2026-07-08 was down 85%, at $2. The measurable flows: LAB team wallets moved 96M tokens (~$63M) into Bitget ahead of the surge, and ten newly created wallets withdrew 100M LAB — 32% of circulating supply, ~$480M — from Bitget inside twelve hours (2026-05-11 → 05-12); investigators also traced 226M LAB deposited to Bitget addresses across March–April 2026 that sat dormant until that withdrawal window. RAVE, already documented in this corpus, fell 68% as the investigation opened and 95% from peak. Concentration in the other two named tokens is of the same order: RIVER — 94% across five wallets; SIREN — 95.93% held by whale wallets making up 0.46% of holders. The value moved from late retail buyers to a supply cohort that never bought at those prices.
OAK Techniques observed: OAK-T3.006 (Insider Multi-Vector Supply Extraction — primary. ZachXBT's investigation describes four simultaneous extraction channels around one token: OTC loans at 7.5% per month, vesting changes, unpaid marketing rewards, and an opaque market-making arrangement. No single channel looks like a rug; together they move supply out of insider control and value out of the order book. See techniques/T3.006-insider-multi-vector-supply-extraction.md). OAK-T1.004 and OAK-T2.001 are recorded as boundary cases, consistent with the mapping this corpus already applies to the sibling RaveDAO entry: roughly 95% of supply under insider control with no public vesting structure is a token-genesis distribution property, and an operator-controlled float against a thin public one is the single-sided-liquidity shape expressed through listings rather than an AMM pool. OAK-T5.001 (Hard LP Drain — same boundary as RaveDAO: extraction ran through CEX order books fed by deposit clusters, not on-chain LP removal).
Attribution: inferred-strong, and the distinction matters here more than usual. What is documented is on-chain: wallet clustering, the 96M-token deposit before the surge, the 100M-token withdrawal to ten fresh addresses inside twelve hours, and the March–April dormancy. What is alleged is intent and coordination — ZachXBT accuses Bitget of permitting "sketchy active market makers to defraud retail users with supply control manipulation schemes" across LAB, RAVE, RIVER and SIREN, names the Hong Kong market maker Heisenberg Guru (HSBG) over RIVER and Bitget founder Shawn Liu as an enabler, describes BVI shell-company structures and private loans around LAB, and posted $10,000 bounties — on LAB's founder, and for evidence against HSBG — while calling on Binance, Bitget and Gate to freeze insider profits or delist. Bitget said it would investigate and, per the reporting, gave affected communities no follow-up. RaveDAO denied insider involvement. No regulatory action is public. OAK records the flows as evidence and the coordination as an investigator's allegation, because that is what the record supports.
OAK-Gnn: not minted, and the reason is the interesting part. The sibling RaveDAO entry flagged this pattern as a candidate seed for a future Group "if a multi-incident operator-cohort fingerprint emerges." It emerged — but not as a token-team operator. No individual or team spans LAB, RAVE, RIVER and SIREN. What spans them is a venue and a named market maker: ZachXBT names the Hong Kong-based Heisenberg Guru (HSBG) in the RIVER manipulation and Bitget founder Shawn Liu as an enabler, and offered a $10,000 bounty for evidence against HSBG. That is a service provider common to otherwise unrelated launches — structurally the same object as the corpus's Drainer-as-a-Service Group, one layer up the stack. OAK does not mint the Group here because the allegations are an investigator's and carry no regulatory finding, no admission and no court record; the bar the Groups axis applies to G02 and its peers is not met by naming alone. Recorded as a venue-and-market-maker-mediated cohort with the named parties stated as allegations; see the Discussion.
Key teaching point: When the same venue appears in four otherwise unrelated launches, the venue is the cohort fingerprint — not the token, not the team, not the chain. Each token individually reads as its own story: a high-FDV launch, a sharp run, an ugly unwind, a team denying everything. What connects them is that the supply cohort deposits into the same exchange before the move and withdraws from it after, and that the market-making arrangement sits at the same address book. Two consequences for defenders. First, the detection surface is deposit and withdrawal clustering at the venue, not token analytics — the contracts here are unremarkable and on-chain supply concentration alone flags thousands of harmless tokens a week. Second, and harder: a centralised venue is the one participant that can see the whole pattern and the one with the weakest incentive to name it. A listing is revenue; the insider cohort is a client; the retail buyer is anonymous in aggregate. The control that would matter is not a better rug-checker but published, auditable disclosure of market-maker arrangements and of supply concentration at listing — which is a policy asking exchanges to price their own conflict.

Summary

LAB was an AI-terminal project whose token listed and traded on Bitget among other venues. In early May 2026 it moved from roughly $0.68 to over $4.00 in under 72 hours, briefly exceeding $6B fully-diluted valuation, then dropped more than 65% within hours.

The on-chain record investigators published around that move: LAB team wallets sent 96M tokens (~$63M) into Bitget before the surge; between March and April 2026 a further 226M LAB reached Bitget addresses and sat dormant; then over 2026-05-11 → 05-12, ten newly created wallets withdrew 100M LAB — about 32% of circulating supply, ~$480M — inside twelve hours. ZachXBT put insider control of LAB at approximately 95% of supply, which is a statement about price discovery: at that concentration, the visible market is a small float and the quoted valuation is an artefact of it.

The same investigation named RAVE, RIVER and SIREN as instances of the same pattern, accusing Bitget of allowing market makers to run supply-control schemes against retail users. RaveDAO — documented separately in this corpus — had already fallen 68% as scrutiny began and eventually 95% from peak. LAB itself was down 85%, at $2, by 2026-07-08.

Alongside the trading pattern, ZachXBT described the extraction structure around the token as four parallel channels: OTC loans priced at 7.5% per month, changes to vesting, unpaid marketing rewards, and an opaque market-making deal.

Timeline

When	Event	OAK ref
(at launch)	Supply concentrated at roughly 95% under insider control, with no public vesting structure holding it	T1.004 / T2.001 boundary condition
2026-03 → 2026-04	226M LAB moves to Bitget addresses and sits dormant	(positioning)
before the surge	Team wallets deposit 96M LAB (~$63M) into Bitget	T3.006 — supply staged at the venue
early 2026-05	Price runs $0.68 → $4.00+ in under 72 hours; FDV passes $6B; falls 65%+ within hours	T5.001 boundary — extraction through order books
2026-05-11 → 05-12	Ten newly created wallets withdraw 100M LAB — 32% of circulating supply, ~$480M — from Bitget within twelve hours	T3.006 — distribution
2026-05-12 → 05-14	ZachXBT publishes the clustering, puts insider control at ~95%, posts a $10,000 bounty, calls for freezes or delisting; names RAVE, RIVER, SIREN, LAB as one pattern	(external investigation)
—	Bitget says it will investigate; per the reporting, no follow-up to affected communities. RaveDAO denies involvement	(venue response)
2026-07-08	LAB down 85%, trading at $2	(unwind complete)

What defenders observed

Supply concentration is necessary and nowhere near sufficient as a signal. Thousands of tokens launch each week with most of the supply in a few wallets, and almost all of them are noise. What separated this cohort was the sequence: concentrated supply → deposited to one venue → dormant for weeks → a price move → withdrawal of a third of the circulating supply to fresh addresses inside twelve hours. The timing relationship between custody moves and price moves is the finding, not any single balance.
Ten fresh wallets withdrawing 32% of circulating supply in twelve hours is a single, cheap, observable alarm. No intent needs to be inferred to flag it, and any venue can compute it about its own withdrawals in real time. Whether it should have flagged it publicly is the question the case actually poses.
Four extraction channels running at once is what makes the class hard to name. An OTC loan at 7.5% a month is a financing arrangement; a vesting change is governance; unpaid marketing rewards are a dispute; a market-making deal is commercial confidentiality. Each has a legitimate version, and none of them is a rug on its own. T3.006 exists precisely because the aggregate is the mechanism, and this is now its clearest 2026 anchor.
The venue is the only party with the full picture and the least reason to publish it. Deposit-address clustering at an exchange is invisible from outside and trivial from inside. Investigators reconstructed it from the chain either side of the venue; the venue said it would look into it. That asymmetry is structural, not incidental, and it is why on-chain investigators remain load-bearing for this class.
Nothing here was a smart-contract defect, and the sums dwarf most of what is. The corpus's largest 2026 contract exploits are in the hundreds of millions; this pattern moved comparable value with unremarkable contracts, through listings, loans and a market-making agreement. OAK covers it because the money is real and the mechanism is repeatable, not because code failed.

Public references

[cryptotimeslabinsider2026] — The Crypto Times, "ZachXBT Alleges 95% LAB Token Are Controlled by Insiders" (2026-05-14): https://www.cryptotimes.io/2026/05/14/zachxbt-alleges-95-lab-token-are-controlled-by-insiders/
[cryptotimeslabexit2026] — The Crypto Times, "ZachXBT Calls Bitget Part of 'Chinese CEX Cartel' After 100M LAB Tokens Exit" (2026-05-12; ten newly created wallets, ~$480M, twelve-hour window): https://www.cryptotimes.io/2026/05/12/zachxbt-calls-bitget-part-of-chinese-cex-cartel-after-100m-lab-tokens-exit/
[bitcoinnewszachxbtcohort2026] — Bitcoin.com News, "ZachXBT Names RAVE, RIVER, SIREN, and LAB as Victims of Bitget-Enabled Market Maker Fraud" (the four-token pattern; 96M tokens / ~$63M deposited before the surge; 100M withdrawn = 32% of circulating supply; Bitget's response): https://news.bitcoin.com/zachxbt-bitget-supply-control-manipulation-rave-river-siren-lab-2026/
[bitcoinnewslabinsider2026] — Bitcoin.com News, "ZachXBT Says 95% of LAB Token Is Insider-Controlled as Investigation Exposes Multi-Front Retail Rug" (the four extraction channels: OTC loans at 7.5%/month, vesting changes, unpaid marketing rewards, opaque market-making deal): https://news.bitcoin.com/zachxbt-lab-token-insider-control-bitget-investigation-2026/
[cryptotimeslabcollapse2026] — The Crypto Times, "LAB Token Collapses 85% to $2, the Crash ZachXBT Warned About for Months" (2026-07-08): https://www.cryptotimes.io/2026/07/08/lab-token-collapses-85-to-2-the-crash-zachxbt-warned-about-for-months/

Discussion

The RaveDAO entry (2026-04) closed by saying the case was "a candidate seed for a future OAK-G entry covering token-launch-insider operator patterns if a multi-incident operator-cohort fingerprint emerges." It emerged four weeks later, and it is not shaped the way that note anticipated. The fingerprint is not a token operator — no individual or team spans LAB, RAVE, RIVER and SIREN, and each team denies the others' problems are theirs. It is a venue plus a named market maker, with HSBG alleged across RIVER and connected entities alleged across the rest. OAK files this as a cohort example rather than minting an OAK-Gnn because the naming rests entirely on one investigator's published analysis: no regulator has acted, no court has ruled, and neither Bitget nor HSBG has conceded anything. Minting a Group on that basis would put an accusation in the taxonomy's most durable and most quoted axis.

That distinction has teeth for the Groups axis. OAK's existing Groups are operator identities — DPRK clusters, ransomware brands, drainer-as-a-service providers. A service-mediated cohort is a different object: participants who need not know each other, connected by a shared intermediary and a shared commercial arrangement. the corpus's Drainer-as-a-Service entry is the nearest existing shape — a provider whose clients are unrelated — which suggests the axis can already express this once the evidentiary bar is met. The open question is the bar itself: what standard of evidence should let a market maker or an exchange enter the Groups axis, given that the conduct is commercial rather than technical and the record is investigative rather than judicial? Recorded here rather than in TAXONOMY-GAPS.md because it is a governance question about the Groups axis, not a missing Technique.

For contributors documenting the next one: record the custody sequence (which wallets deposited where, when, and how long the tokens sat) as a first-class field alongside the price series, and record what the venue said and when. Those two fields are what let a reader distinguish this pattern from an ordinary failed launch, and they are the two most likely to be missing from the coverage a year later.