Skip to content

MSc

Who Funds a Rug Pull

A reverse funding graph over 16,584 Ethereum accounts that created a liquidity pool and drained it within a day, built to ask whether the people behind them share a source of money.

Oct 2022Web3MeasurementPrivacy

A one-day exit scam is a specific and easily dated event: an account creates a liquidity pool, attracts deposits, and removes the liquidity within twenty-four hours. Starting from 21,788 of them, this walks the chain backwards to find who paid for the accounts that did it.

Question
Do separate scam accounts share a funder?
Seed
21,788 one-day exit scams · 16,584 accounts
Scan
Blocks 0 – 14,339,974, in 14,340 chunks
Method
Reverse funding graph, one hop, temporally bounded
Repository
VincenzoImp/ethereum-address-clustering
VincenzoImp/ethereum-address-clusteringReverse funding-graph study of one-day exit scams on Ethereum.Jupyter Notebook

The problem

Bitcoin’s common-input-ownership heuristic does not exist on Ethereum: the account model has no inputs to share. Most of the linkage techniques that work on a UTXO chain have no analogue here, which is why this does not attempt them.

What remains available is provenance. An account that deploys a scam had to be funded by something, and if many scam accounts trace back to the same funder, that is a relationship the chain states directly rather than one a heuristic infers.

What I built

A backwards collector and a graph.

The collector reads every block from genesis to 14,339,974 in chunks of a thousand, spread across a pool of twenty-plus worker processes talking to a local Geth node over IPC, and keeps any transaction whose recipient is one of the seed accounts. Each seed carries a use_untill bound – the block at which it removed liquidity – so a transaction only counts if it arrived while that account was still active. Progress is written to a chunk log, so a run that dies resumes rather than restarts.

16,584

scam accounts

16,006

direct funders

7,929

components

The analysis then removes 485 labelled service accounts – centralised exchanges, DEXs, NFT platforms, gaming – before building the graph. The README states why: those are high-degree hubs, and left in they act as spurious bridges connecting addresses that have nothing to do with each other. Removing them dropped roughly 30% of all collected transactions, leaving 32,474 accounts and 35,643 funding edges, which fall into 7,929 connected components. The largest holds 6,219 accounts; the busiest single funder paid 110 distinct scam accounts.

Hard parts

The hubs are the whole difficulty. Almost every account on Ethereum has touched an exchange, so a funding graph that includes exchanges collapses into one component and says nothing. The filter is the analysis: what survives it is the set of relationships that do not route through a service everybody uses. The cost is that any scam funded through an exchange withdrawal becomes invisible, which is not a small exclusion.

Time has to bound the edge. An address that funded a scammer two years after the scam is not a funder of that scam. Carrying a per-account cut-off block through the collection makes the resulting edge mean something specific: money that arrived while the account was live.