r from the behavior of ordinary users.

behavior from normal user behavior, thereby improving the deceptiveness of the scam.

In addition, we also found that the infrastructure addresses used by the Rug Pull gang are not limited to the above two addresses. There are also some infrastructure addresses that are used less frequently and are not included in the above statistics. These infrastructure addresses are mainly used to cash out the proceeds of Rug Pull scams through centralized exchanges or flash exchange platforms.output: Web3 scams are rampant

In the Web3 world, new tokens are constantly emerging. Have you ever wondered how many new tokens are issued every day? Are these new tokens safe?

These questions are not without purpose. In the past few months, the CertiK security team has captured a large number of Rug Pull transaction cases. It is worth noting that the tokens involved in these cases are all new tokens that have just been listed on the chain.

Subsequently, CertiK conducted an in-depth investigation of these Rug Pull cases and found that there were organized criminal gangs behind them, and summarized the pattern characteristics of these scams. Through in-depth analysis of the modus operandi of these gangs, CertiK discovered a possible fraud promotion channel for Rug Pull gangs: Telegram groups. These gangs used the "New Token Tracer" function in groups such as Banana Gun and Unibot to attract users to buy fraudulent tokens and ultimately make profits through Rug Pull.

CertiK counted the token push information of these Telegram groups from November 2023 to early August 2024, and found that a total of 93,930 new tokens were pushed, of which 46,526 involved Rug Pull tokens, accounting for as high as 49.53%. According to statistics, the cumulative investment cost of the gang behind these Rug Pull tokens was 149,813.72 ETH, and they made a profit of 282,699.96 ETH with a return rate of up to 188.7%, equivalent to about US$800 million.

To assess the percentage of new tokens pushed by Telegram groups on the Ethereum mainnet, CertiK counted the new tokens issued on the Ethereum mainnet during the same time period. The data shows that a total of 100,260 new tokens were issued during this period, of which 89.99% were pushed through Telegram groups. On average, about 370 new tokens were born every day, far exceeding reasonable expectations. After continuous and in-depth investigation, we found the truth that was disturbing - at least 48,265 of them were involved in Rug Pull scams, accounting for as high as 48.14%. In other words, almost one in every two new tokens on the Ethereum mainnet is involved in a scam.

In addition, CertiK has found more Rug Pull cases in other blockchain networks. This means that the security situation of not only the Ethereum mainnet, but also the entire Web3 new token ecosystem is far more severe than expected. Therefore, CertiK wrote this research report, hoping to help all Web3 members raise their awareness of prevention, stay vigilant in the face of endless scams, and take necessary precautions in time to protect their assets.

ERC-20 Token

Before we officially start this report, let's first understand some basic concepts.

ERC-20 tokens are one of the most common token standards on the blockchain today. They define a set of specifications that allow tokens to interoperate between different smart contracts and decentralized applications (dApps). The ERC-20 standard specifies the basic functions of tokens, such as transfers, balance inquiries, and authorization of third parties to manage tokens. Thanks to this standardized protocol, developers can more easily issue and manage tokens, thus simplifying the creation and use of tokens. In fact, any individual or organization can issue their own tokens based on the ERC-20 standard and raise start-up funds for various financial projects through pre-sale tokens. Because of the widespread use of ERC-20 tokens, it has become the basis for many ICOs and decentralized financial projects.

USDT, PEPE, and DOGE, which we are familiar with, are all ERC-20 tokens, and users can buy these tokens through decentralized exchanges. However, some fraud gangs may also issue malicious ERC-20 tokens with code backdoors, list them on decentralized exchanges, and then induce users to buy them.

Typical scam cases of Rug Pull tokens

Here, we use a Rug Pull token scam case to gain a deeper understanding of the operation mode of malicious token scams. First of all, it should be noted that Rug Pull refers to a fraudulent act in which a project party suddenly withdraws funds or abandons a project in a decentralized financial project, causing investors to suffer huge losses. Rug Pull tokens are tokens issued specifically for the purpose of implementing such fraudulent acts.

The Rug Pull tokens mentioned in this article are sometimes also