MSc
Who Funds a Rug Pull
A reverse funding graph over 16,584 Ethereum accounts that created a liquidity pool and drained it within a day, built to ask whether the people behind them share a source of money.
A one-day exit scam is a specific and easily dated event: an account creates a liquidity pool, attracts deposits, and removes the liquidity within twenty-four hours. Starting from 21,788 of them, this walks the chain backwards to find who paid for the accounts that did it.
- Question
- Do separate scam accounts share a funder?
- Seed
- 21,788 one-day exit scams · 16,584 accounts
- Scan
- Blocks 0 – 14,339,974, in 14,340 chunks
- Method
- Reverse funding graph, one hop, temporally bounded
- Repository
- VincenzoImp/ethereum-address-clustering
The problem
Bitcoin’s common-input-ownership heuristic does not exist on Ethereum: the account model has no inputs to share. Most of the linkage techniques that work on a UTXO chain have no analogue here, which is why this does not attempt them.
What remains available is provenance. An account that deploys a scam had to be funded by something, and if many scam accounts trace back to the same funder, that is a relationship the chain states directly rather than one a heuristic infers.
What I built
A backwards collector and a graph.
The collector reads every block from genesis to 14,339,974 in chunks of a thousand, spread across
a pool of twenty-plus worker processes talking to a local Geth node over IPC, and keeps any
transaction whose recipient is one of the seed accounts. Each seed carries a use_untill bound –
the block at which it removed liquidity – so a transaction only counts if it arrived while that
account was still active. Progress is written to a chunk log, so a run that dies resumes rather
than restarts.
16,584
scam accounts
16,006
direct funders
7,929
components
The analysis then removes 485 labelled service accounts – centralised exchanges, DEXs, NFT platforms, gaming – before building the graph. The README states why: those are high-degree hubs, and left in they act as spurious bridges connecting addresses that have nothing to do with each other. Removing them dropped roughly 30% of all collected transactions, leaving 32,474 accounts and 35,643 funding edges, which fall into 7,929 connected components. The largest holds 6,219 accounts; the busiest single funder paid 110 distinct scam accounts.
Hard parts
The hubs are the whole difficulty. Almost every account on Ethereum has touched an exchange, so a funding graph that includes exchanges collapses into one component and says nothing. The filter is the analysis: what survives it is the set of relationships that do not route through a service everybody uses. The cost is that any scam funded through an exchange withdrawal becomes invisible, which is not a small exclusion.
Time has to bound the edge. An address that funded a scammer two years after the scam is not a funder of that scam. Carrying a per-account cut-off block through the collection makes the resulting edge mean something specific: money that arrived while the account was live.