Investigation Report: FomoWELL SNS Sale and Its Connections with ICPex and Yuku AI
The investigation has been divided into 3 messages due to the 32k character limit per message
Investigation Objective
The objective of this investigation is to analyze the anomalies observed in the FomoWELL SNS sale (January 2025), identify potential manipulations, and establish possible links with ICPEx SNS Sale and Yuku AI Team.
Part 1. FomoWELL SNS SALE
1. Analysis of Direct Participants Fund Sources (Contributions Over 1000 ICP)
For the analysis, only participants contributing over 1000 ICP were selected. The participant @borovan (22β168 ICP) is excluded from this analysis as his participation is not linked to the detected anomalies.
FomoWELL SNS Direct Commitments Overview
No. | Address | Amount (ICP) | Source | Comments |
---|---|---|---|---|
1 | lqg4j-β¦ | 9β478 | MEXC | |
2 | 2ilme-β¦ | 8β701 | MEXC | |
3 | jxagt-β¦ | 8β444 | Gate | |
4 | wbgeu-β¦ | 7β296 | MEXC | |
5 | 4uuwq-β¦ | 5β201 | OKX | |
6 | aympm-β¦ | 5β064 | MEXC | |
7 | ygge7-β¦ | 4β937 | OKX | |
8 | r2gx5-β¦ | 4β687 | Binance | |
9 | j45sz-β¦ | 3β642 | Binance | |
10 | nta2n-β¦ | 3β207 | Binance | |
11 | 32opp-β¦ | 2β209 | OKX | |
12 | 4zaho-β¦ | 2β167 | OKX | |
13 | mvkka-β¦ | 1β660 | Various | Linking Wallet* |
14 | 7jnbz-β¦ | 1β000 | Various | Linked with Address 13 |
*Linking Wallet is a wallet that connects many aspects of the investigation.
Summary:
- 67.7% of funds (67,693 ICP) originated from 14 wallets, 12 of which are linked to exchanges (MEXC, Gate, OKX, Binance).
- 2 addresses (No. 13 and 14) show funds from various sources. These are critical wallets in this investigation, especially Linking Wallet (Address 13).
2. Temporal Analysis of Direct Participants Transactions
Transactions were grouped by time to identify coordination patterns. The key temporal groups are summarized below:
1. Temporal Group 1
- Address 13 (Linking Wallet):
2025/01/12 09:51 AM
β 982 ICP - Address 1:
2025/01/12 10:05 AM
β 236 ICP (MEXC)
Note: A 14-minute gap between transactions.
2. Temporal Group 2
- Address 1:
2025/01/14 04:22 AM
β 1β024 ICP - Address 5:
2025/01/14 04:25 AM
β 5β201 ICP - Address 13 (Linking Wallet):
2025/01/14 04:41 AM
β 330 ICP
Note: Transactions occurred within a 19-minute window.
3. Temporal Group 3
- Address 13 (Linking Wallet):
2025/01/14 07:37 PM
β 24 ICP - Address 3:
2025/01/14 07:59 PM
β 1β995 ICP
Note: Transactions occurred within a 22-minute window.
4. Temporal Group 4
- Address 3:
2025/01/15 07:48 AM
β 6β040 ICP - Address 13 (Linking Wallet):
2025/01/15 08:15 AM
β 323 ICP
Note: Transactions occurred within a 27-minute window.
5. Temporal Group 5
- Address 3:
2025/01/17 04:20 PM
β 159 ICP - Address 6:
2025/01/17 04:22 PM
β 5β064 ICP
Note: Transactions within a 2-minute window from distinct exchanges (Gate and MEXC) strongly indicate coordinated activity.
Transaction Times by Wallet (Bubble Chart)
The pale blue diagram in the background is the Distribution of Transactions by Time (based on the number of transactions; a section on this will 4. Temporal Analysis of Participants Spam Transactions)
Additional Address Groups with Temporal Gaps of 4-7 hours
-
Group 6:
-
Group 7:
- Address 10 (Binance)
- Address 12 (OKX)
Time Difference: ~7 hours.
-
Group 8:
- Address 8 (Binance)
- Address 10 (Binance)
Time Difference: ~6 hours.
-
Group 9:
- Address 1 (MEXC)
- Address 11 (OKX)
Time Difference: ~4 hours.
Conclusion
Temporal Groups 1, 2, 3, 4, 5 exhibit suspiciously tight timeframes (β€30 minutes) between transactions involving Addresses 1 (MEXC), 3 (Gate), 5 (OKX), 6 (MEXC), and the Linking Wallet (Address 13).
3. Analysis of Direct Participants Non-ICP Transactions
WELL Token Transfers
Address | Transaction Time (UTC) | Amount (WELL) | Destination Address | Notes |
---|---|---|---|---|
Address 2 | 2025/03/19 02:33 |
3β281β252 WELL | FomoWELL Liquidity Wallet | Team-controlled Destination address for WELL/ICP liquidity pool on ICPSwap |
Address 9 | 2025/03/19 02:33 |
1β373β607 WELL | FomoWELL Liquidity Wallet | Same liquidity pool operation |
Address 1 | 2025/03/24 18:50 |
787β362 WELL | Destination Wallet | Unverified external address |
Address 12 | 2025/03/24 18:55 |
3β574β364 WELL | Destination Wallet | Same destination, 5-minute interval |
Key Observations
- Addresses 2 and 9 sent 4.65M WELL to the FomoWELL teamβs official liquidity wallet.
- Addresses 1 and 12 transferred 4.36M WELL to an unverified external wallet within 5 minutes.
4. Temporal Analysis of Participants Spam Transactions
1. Distribution of Transactions by Time
Key Observations:
- 725 transactions with small participation amounts (1β1.99 ICP) were recorded.
- Most transactions are time-clustered, suggesting automated execution (e.g., via scripts).
2. Notable Wallets Involved in Time-Clustered Transactions
β | Wallet Address | Source | Notes |
---|---|---|---|
1 | 121196d | Binance | 158 spam transactions |
2 | ac897ea | Binance | 173 spam transactions |
3 | b9bd39 | Binance | 161 spam transactions |
4 | ue3vv-β¦ | Binance, Various | 160 spam transactions. Flagged as Spam Wallet |
The data indicates coordinated automation (e.g., scripted transactions). Time clustering of small contributions differing sharply from organic participation seen in another SNS launches like Alice or KongSwap:
3. Spam wallet ue3vv-β¦
Spam wallet was also a spam wallet in the SNS Yuku AI sale and has a direct transfer to Yuku AI team wallet:
The first transaction received from another spam wallet fc77dβ¦ (through a sub-wallet) that participated in the SNS Yuku AI sale. Letβs note the source of funds for this wallet:
note: it will be referred to as The Key in the investigation
5. Analysis of Team FomoWELL Wallet
Two proposals were submitted by the FomoWELL team to transfer funds from the FomoWELL DAO Treasury:
Proposal Title | Amount (ICP) | Target Principal |
---|---|---|
Pay for Development and Marketing Expenses in Q4 2024 | 36β000 | i25k3-β¦ |
The Fomowell development team is seeking 20,000 ICP funding from the Fomowell SNS DAO for liquidity on dex | 20β000 | i25k3-β¦ |
After each proposal was approved, the funds were transferred to the team address a3b09a with all funds subsequently moved to Bybit (note: no liquidity was added on Dex).
The first transaction received by the team address a3b09a:
note: it will be referred to as The Key in the investigation