I'm stalking a scammer and have watched them create and rugpull five projects in 24 hours.

I have been known to dip into the degen pool from time to time. I know the dangers. I'm aware of rugs and scams. But it's fun and can really, really pay off. But more than likely you are left with a pile of shit in your wallet.

But I've encountered something here that has me quite interested in what is happening on the blockchain itself.

This story starts with a random gamble on a brand new contract I saw on Dextools. I was bored so I swapped a tad with my junk wallet for a token called LIME just for funsies. I primed up to swap back at the slightest gain, approving to swap Lime back to eth. I waited several moments and wouldn't you know it, I had a slight gain. I was about to hit swap when the prompt changed to Approve Lime. Weird, I thought. I approved it just a moment ago. Well, I approve it again and wouldn't you know it: Not sufficient liquidity. Rugged. The creator's wallet had a cool 27 ETH sent to a new wallet.

Perturbed but not surprised, I follow the money to see where it goes. I was a bit hot at this point, so I did what any illogically upset crypto bro would do: buy what this scammer just bought. Scammer had swapped for a token called NUT (lol). So of course I swap some spare change for NUT. At this point my anger had subsided so I looked into what shitcoin I had just bought.

NUT had been created just minutes prior. I opened up the creator's wallet in a fresh tab and looked at the transaction history and noticed an initial deposit of 27 ETH. That's right. Didn't take long to notice I had a few Brave tabs open of the same wallet address. The LIME creator had just created NUT. Knowing full well that my nice and shiny NUT purchase was soon to be rugged, I went to swap back for ETH. And wouldn't you know it, it asks me to approve twice.

At this point I get legitimately worried about the security of my wallet, so I revoke almost every allowance I had on there. Here's where I'm curious, and need an ETH expert to answer it:

​

https://preview.redd.it/og8jh77agh0b1.jpg?1691&format=pjpg&auto=webp&s=ff15f52ba707ce3b5648ddffe6b3598f9b8b2393

I noticed that when I approved LIME and NUT the second time, it triggered a multicall transaction, visible in the screenshot. Approving it the second time never charged ME, it charged the scammer. We're talking like 9 bucks a pop when people trade it. What exactly is happening here? My ETH knowledge is kind of maxed out at this point.

In the meantime, I went back and followed the footsteps of this scammer. Before they created LIME, they made CAP. Before that, PEPPA. Before that, RIHANNA. Creation to rugging took less than two hours for each token. Their initial funds came from Bybit, and exchange not legal in the USA.

​

https://preview.redd.it/tj5d3znhgh0b1.jpg?1681&format=pjpg&auto=webp&s=0a29e2e00169a250b8bdaf04d84d91b00119d7ec

So, this shithead started just yesterday with 24 ETH, and now has 27 ETH locked into NUT. Not bad, but seems like a ton of work. FYI NUT has yet to rug. I'm still watching. Debating contacting Bybit.

EDIT: I'm going to contact Bybit and see what happens. I'll update with more edits.

EDIT: NUT HAS JUST RUGGED. Scammer siphoned off 4 ETH to a wallet that is a few hours old. 23 ETH sent to a new address that just created LEY.

EDIT: LEY has just rugged, 4 ETH sent to a new wallet which in turn split it up further into multiple wallets. 23 ETH sent to new wallet used to create PIKACHU

EDIT: PIKACHU just rugged. Funds sent to new wallet, created new shitcoin QWERTY. Emailed Bybit, made a post on their subreddit as well. Stay tuned.

EDIT: PIKACHU rugged. New address, newest coin is SHREK. Scammer appeared to slow down over night (night where I am). Will update further after work today.

EDIT: SHREK has rugged. SHREK creator address: 0x4725184D39d10E72e461C6d64dB53bbc7012Dd4e. Scammer has yet to send the funds off and create another shitcoin. Off to work, will continue the saga in the evening.

EDIT: After Shrek, scammer created PRINCE. Prince has since rugged, but the funds remain in the wallet: 0x692Ea4415BE092fbeC687cA533452fD6db02eFC5