Original author: zachxbt, Chain Detective

Original translation: zhouzhou, BlockBeats

Editor's note: This article analyzes how hacker Serpent controlled 9 accounts including McDonald's and Kabosu on X and Instagram, launched a Meme coin scam, stole about $3.5 million, and used it for casino gambling. Serpent was a professional player (Fortnite) and was terminated for cheating. In 2022, the NFT project DAPE he co-founded had a rug pull, and the ERROR project launched in 2024 also suffered a rug pull and was eventually banned by X.

The following is the original content (for easier reading and understanding, the original content has been reorganized):

For the past few months, I have been tracking a series of related leak incidents involving McDonald's, Usher, Kabosu's owner, Andy Ayrey, Wiz Khalifa, SPX 6900, etc., which resulted in approximately $3.5 million in theft through the release of Pump Funmeme coins.

On August 21, 2024, McDonald's Instagram account was hacked and posted a promotional post for the bundled meme coin GRIMACE, after which the hacker began spoofing. More than $690,000 was funneled into two wallets from this pump and dump.

4RiNhTwBxYWgb4MSCtt9vXgVk2yuPhoQR3DR9pMVPU1W

2vjnmxwTYNJvTmFhtqxZkPiuCHkaKZK5rcxTLuoC2dPB

On September 3, 2024, the McDonald's attacker transferred 101.5 SOL to two addresses, which deployed and sniped SCHRADER after actor Dean Norris's X account was hacked.

4s9Uz9pTBXcEaEtcjs8eg98r2TVte3rq3JUm3rVTFMudfewGbNKmqNyYs9bSAMDUaTbTcuA1v39sWr7GRqkDJ6EM

1gxo1pjTqjbee7rHW4cGvuNffX1qP4F8fP17g6SSC5EYbQrnktDrKSFB1uh4ju7PxQjprWFin37WUsAe225b9c6

On September 6, 2024, funds from the McDonald's APT (Account Takeover) were transferred to a casino deposit address.

CuNzegC9DE4CxCMn31ZcYLvtDaYsLD9RX8eRvmtZQrnB

By conducting time analysis, follow-up withdrawals shortly after deposits can be identified.

B2fwZt5nTbdrnJ2CPsgrYMPuB4UnhN82EAM34dXDARLh

On September 12, 2024, B2fw transferred 110 SOL to two addresses involved in promoting the meme coin rush during the Usher leak incident.

4FUrwoHz1fuUf4eR6YEAYSG9d9rN5fzbowMXtbjwJAhTDtHXjpnTb1sz6aeF6T79JaiMFyT2xX2EuTxqT5UhFfKD

427zpHF1WWgYgKxcSiUzwXLg2UqsF6xq7K13PU3mh6Wr99mipiVA6GcDTwi7EY93RJeRuEUDZAK9BnoMeki7sU6C

Subsequently, B2fw transferred 4868 SOL to the casino deposit address ECb5v, which is also directly related to other APT (Account Takeover) incidents, including the leaks involving Andy Ayrey and Enoshima Aquarium.

Ecb5vsomUG3MEnLCgiFvkdnnqpggTEXtN17z62iDPuU3

On October 15, 2024, the X account of Enoshima Aquarium was hacked, promoting a bundled meme coin. On that day, 84 SOL obtained from the scam was transferred to ECb5v.

5PDjh74JTLMPW4dXr6fKm3Yue2j3vhbxLSK5dPbQ3oEGK4axE7fua1ngBMas4xpRY6dBr92Ccps7b1WwcLdnxXWL

On October 29, 2024, the X account of Andy Ayrey (founder of Truth Terminal) was hacked for several days, promoting six meme coin scams. 3GVUs was one of the addresses participating in the token rush.

3GVUs2gNr161ohqnVXjUeoNQmf3cELxKSiPrxyQu6pjd

On October 30, 2024, 3GVUs transferred 169 SOL to Ecb5vs.

67nwsLLE3aGua4VeH8p6qHc3SL3rpxi9omMxRnfpeyZVsBpZawnUHo4Pt4tdT5Vxny2uRNRDH3vSZ1fzvKkNCML4

Out of the $2.178 million gained from the Andy Ayrey ATO, $750,000 was deposited into the casino deposit address Apc3e.

Apc3eA9ScQksuZvfURQswZwVkusEYRaqeKEv4eXXbRZm

0.1 SOL in the Kabosu ATO funded an address participating in the Andy Ayrey ATO.

On October 17, 2024, the Instagram account of Kabosu's owner was hacked and promoted a meme coin scam.

On that day, 191 SOL from the scam was transferred to the casino deposit address:

6kwZ7tz8Xs7jaVqVJXZSRrZ2FtS2PPChEVuLXKrmMgCm

The APT (Account Takeover) incidents involving Kabosu and Andy Ayrey are directly related to the APT incident of Wiz Khalifa.

On November 3, 2023, the attacker posted a wallet address on Wiz Khalifa's account. 29 SOL was transferred to 6kwZ7, similar to what happened in the Kabosu ATO.

NFCs23ddXQc9Zff2VJotEn2zaSAh4tvw6U6kb7fdXovZ8YPQgJMGQkXmtWiTutqnoBf6wR2khaKvFpyEKNhHfjJ

WIZ's deployer funds came from the Andy Ayrey ATO. Other addresses involved in the rush transferred all the profits obtained through instant exchanges to the casino deposit address 0x83ee.

0x83ee6b53a0ae76b71bed0c32721a451776dbdb3a

On October 16, 2024, 0x83ee received 0.54 ETH from the deployer of the scam, while SPX 6900 was hacked on October 11, 2024.

On Solana, another scam promoted by the hacked SPX 6900 account was funded by the Ken Carson attacker.

To further demonstrate the relationship between the Kabosu owner, SPX 6900, Ken Carson, and Enoshima ATO, each meme coin deployer provided funds to the previous deployer address through instant exchanges, attempting to cover up the source of the funds.

Investigate how the threat actor Serpent transitioned from a professional Fortnite player to helping steal $3.5M through meme coin scams initiated from leaks across 9+ accounts on X and IG, using the profits for online casino gambling.

Serpent (SerpentAU) is a former professional Fortnite player from Australia who was released by the esports organization 'Overtime' after being found cheating in June 2020. He co-founded the NFT project DAPE in March 2022, which later rug pulled.

In March 2024, Serpent launched another project called ERROR, but the project rug pulled, leading to his ban from the X platform.

Deployer address:

0x8233873ee35547097ccb9098adbab955d7120ee8

On October 23, 2024, the ERROR deployer transferred a total of 29 ETH to two instant exchanges.

By conducting time analysis, it can be seen that these funds were received into Solana and transferred to the same casino deposit address.

Ecb5vsomUG3MEnLCgiFvkdnnqpggTEXtN17z62iDPuU3

Multiple ATOs (Aggressive Trading Activities) directly linked to the deposit address Ecb 5 vs include: McDonald's, Usher, Andy Ayrey, Dean Norris, and Enoshima Aquarium. (For detailed tracking, please refer to the beginning.)

Serpent gambles millions of dollars monthly on Roobet, Stake, BC Game, and Shuffle, and frequently shares his screen on Discord with friends.

I obtained recordings of him gambling, during which he inadvertently leaked multiple deposit and withdrawal addresses.

Discord ID: 1269557350486904945

During a screen share on November 1, 2024, Serpent shared a $100K deposit and a $200K withdrawal, transferred to the following address.

When plotting the transaction map, it was found that this address has high exposure to addresses related to McDonald's, Andy Ayrey, and Usher ATO.

0xb8c9c8a5756a7992df65f949b7c1423eeb435aa5

In the security breach incident involving Andy Ayrey, another threat actor participated in seizing these scam projects, using the alias 'Dex' (from Massachusetts, USA).

After I mentioned him in my Telegram channel last week, he began to panic and fabricated a story about being extorted, claiming he lost $700K.

Currently, the funds associated with these security vulnerabilities are stored at the following addresses:

0xeb60a5242c1c97eb54195ec83de43bb26813c0d1

0x2355ac2929bb7051814de3c48670fccbb515d8be

4jjWZ8RaXZBqntnhu2JFidXEQWXgfKRbJQZdTHrdaqbv

Today, after the publication of the first part of my investigation, Serpent began deleting all posts from his new X account. I suspect there are still some related ATOs (Aggressive Trading Activities) that I have not been able to directly trace on-chain. I have shared a detailed investigation report about one of the account breach incidents with a victim I am collaborating with.

Original link