FomoWell SNS Sale Investigation: ICPEx, Yuku AI Ties, Linked Wallets, Temporal Clusters

General
,
2
6. In-Depth Analysis of Address 14

1. Address 14 and Its Link to Address 13 (Linking Wallet)

from to tokenSymbol amount timestampUTC
dmkqr-… 05a60a… ICP 999 2023/01/14 03:24 pm
220c3a… dmkqr-… ICP 1’001.539773 2023/01/14 03:23 pm
from to tokenSymbol amount timestampUTC
dmkqr-… mvkka-… CHAT 0.15278872 2025/03/25 03:58 pm
dmkqr-… mvkka-… CHAT 327.5687851 2024/10/04 02:13 pm
dmkqr-… mvkka-… ICS 138’888.98 2024/10/04 02:13 pm
dmkqr-… mvkka-… ICL 44’999.98 2024/10/04 02:13 pm
dmkqr-… mvkka-… GLDGov 1’275.96431 2024/10/04 02:08 pm
dmkqr-… mvkka-… ICL 681.9878178 2024/10/04 02:07 pm
dmkqr-… mvkka-… CHAT 3.78189255 2024/07/16 10:12 am
dmkqr-… mvkka-… ICL 88’999.96 2024/07/16 10:12 am
dmkqr-… mvkka-… SNEED 3.33326333 2024/04/14 02:35 pm
dmkqr-… mvkka-… GHOST 299 2024/04/14 02:35 pm
dmkqr-… mvkka-… CHAT 155 2024/04/14 02:34 pm
dmkqr-… mvkka-… CHAT 5 2024/04/14 02:28 pm
4c679e… dmkqr-… ICP 0.53 2024/03/28 04:22 pm
4c679e… dmkqr-… ICP 1 2024/01/22 12:57 pm

2. Address 14 and Its Link to Yuku AI Team Wallet (c3ea21)

from to tokenSymbol amount timestampUTC
dmkqr-… c3ea21… ICP 85.91815465 2024/01/27 05:18 pm
from to tokenSymbol amount timestampUTC
dmkqr-… n2fg3-… YUKU 79’045.12318 2025/03/22 04:41 pm
dmkqr-… ska5h-… ICS 138’888.98 2025/01/04 01:20 am
dmkqr-… ska5h-… CHAT 163.7838926 2025/01/04 01:18 am
dmkqr-… ska5h-… YUKU 158’821.5633 2025/01/04 01:17 am
dmkqr-… ska5h-… ICL 1’353.832018 2025/01/04 01:17 am
dmkqr-… ska5h-… GLDGov 637.981655 2025/01/04 01:17 am
dmkqr-… gufw6-… ICL 1000 2024/05/16 10:37 am
c8309b… dmkqr-… ICP 6.87 2024/03/28 04:24 pm
c9b5a6… dmkqr-… ICP 41 2024/03/28 04:23 pm
xftwq-… dmkqr-… ICP 22.65 2024/03/13 02:45 pm
xftwq-… dmkqr-… ICP 85.90173 2024/01/26 02:04 pm
xftwq-… dmkqr-… ICP 94 2024/01/26 02:04 pm
dmkqr-… xftwq-… GLDGov 637.981655 2023/12/28 11:43 am
dmkqr-… 1912d7… ICP 77.2919739 2023/12/24 11:05 am
dmkqr-… 1912d7… ICP 10.601205 2023/10/31 09:42 am
ska5h-… dmkqr-… ICP 0.1 2023/07/27 11:57 am
ska5h-… dmkqr-… ICP 0.1 2023/07/27 11:56 am
dmkqr-… 44a3b5… ICP 1 2023/06/25 08:29 am
dmkqr-… cer66-… SNS-1 0.49997 2023/06/11 02:31 pm
cer66-… dmkqr-… ICP 1 2023/01/14 03:01 pm
dmkqr-… cer66-… SNS-1 0.48996 2023/01/14 02:32 pm
dmkqr-… cer66-… SNS-1 0.01 2023/01/14 02:30 pm

4. Owner of dmkqr-… wallet

This address is listed in the sns_init_ic.yaml file of EMC (EdgeMatrixChain) as belonging to a developer named Ping (please correct me if the name is inaccurate)

from sns_init_ic.yaml
from sns_init_ic.yaml728×469 13.8 KB

7. In-Depth Analysis of Address 13

Number of transfer transactions (excluding ...-cai) received/sent to other addresses: 582 transactions (2025/03/27)

1. Airdrop hub

Address 13 (Linking Wallet) has been, and continues to be, used as a wallet for collecting airdrops from sub-wallets. For example:

  1. ckBTC Airdrop (July 5, 2024): Distributed by the Plug Wallet team:

two days after distribution
two days after distribution1604×908 73.9 KB

  1. OGY Airdrop (September 12, 2024): Distributed by Origyn to Plug Wallet users:

three months after distribution
three months after distribution1628×669 57.1 KB

2. The Key That Opens All Doors in This Investigation

Address 13 (Linking Wallet) exhibits cross-transactions on its sub-wallets for collecting airdrops, in conjunction with transfers to The Key:

  • Address hixho-… (this address is easily identifiable due to the presence of an ICNaming: igf.ic):

677×171 6.82 KB

Address 13 is marked is green; so-called "The Key" is marked in red
Address 13 is marked is green; so-called "The Key" is marked in red1399×714 174 KB

Such a transfer scheme is evident in at least 7 sub-addresses:

  1. ni7ef-…
  2. nngtl-…
  3. xofiw-…
  4. p3hqc-…
  5. rjir4-…
  6. meavt-…
  7. q5cqr-…

Out of these 7 addresses, 3 are of particular interest:
5. rjir4-…
6. meavt-…
7. q5cqr-…

image
image1074×930 232 KB

3. Unique participation pattern across both the FomoWELL and ICPex sales

image
image1682×594 133 KB

8. Interim Conclusions: Part 1 Findings

  1. Coordinated Wallet Network

    • Addresses 1, 2, 3, 5, 6, 9, 12, 13, 14 exhibit transactional and temporal links, strongly suggesting they are controlled by a single entity associated with FomoWELL and Yuku AI.
    • Critical evidence:
      • Address 14 (7jnbz-…) connects to Address 13 (Linking Wallet), Yuku AI team wallet and EMC (EdgeMatrixChain) team via wallet dmkqr-..., whose owner “Ping” is listed in EMC’s official SNS configuration.

  2. Spam Transaction Campaign

    • 725 small transactions (1–1.99 ICP) were executed in clustered time windows, deviating from organic participation patterns observed in projects like Alice/KongSwap.
    • Spam wallet: ue3vv-... (160 spam transactions) participated in the ICPEX sale, also participated in the Yuku AI sale as a Spam Wallet, has a direct transaction to the Yuku AI team wallet and has a link to The Key.

  3. Gateway to ICPEx Investigation

    • Critical overlap discovered:
      • Linking Wallet - Address 13 (mvkka-…) acts as a hub for airdrops.
      • Address 13 (Linking Wallet) received ckBTC (Plug Wallet) and OGY (Origyn) airdrops from 7 sub-wallets from which transactions were sent to The Key hixho-… (ICNaming: igf.ic).

  4. Connection Matrix

Address Direct Link with Address 13 Direct Link with Address 14 Direct Link with Yuku AI Direct Link with The Key
Address 13 :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark:
Address 14 :white_check_mark: :white_check_mark: :white_check_mark: :cross_mark:
n2fg3-… :white_check_mark: :white_check_mark: :white_check_mark: :cross_mark:
ska5h-… :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark:
gufw6-… :cross_mark: :white_check_mark: :white_check_mark: :cross_mark:
c8309b… :white_check_mark: :white_check_mark: :white_check_mark: :cross_mark:
c9b5a6… :white_check_mark: :white_check_mark: :white_check_mark: :cross_mark:
xftwq-… :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark:
44a3b5… :white_check_mark: :white_check_mark: :white_check_mark: :cross_mark:
cer66-… :white_check_mark: :white_check_mark: :white_check_mark: :cross_mark:
SPAM WALLET ue3vv-… :cross_mark: :cross_mark: :white_check_mark: :cross_mark:
Team FomoWELL wallet :cross_mark: :cross_mark: :cross_mark: :white_check_mark:

Part 2. ICPEx SNS SALE

1. Analysis of Direct Participants

The participants egiuz-… (6’000 ICP), zvnvx-… (1’158 ICP) and ao54i-… (1’058 ICP) is excluded from this analysis.

ICPEx SNS Direct Commitments Overview

No. Address Amount (ICP) Source Time
1 fznfr… 30’005 Bitget 2025/03/20 09:12 am
2 meavt… 17’541 Binance 2025/03/16 03:57 pm
3 e4s3u… 12’681 Bitget 2025/03/25 08:29 am
4 jusdz… 11’131 Bitget 2025/03/25 10:45 am
5 w6ezf… 10’253 Bitget 2025/03/17 04:28 pm
6 q5cqr… 10’018 Bybit 2025/03/17 07:59 am
7 kyluj… 8’157 Binance 2025/03/25 01:44 pm
8 fobuy… 7’086 Binance 2025/03/25 01:17 pm
9 nhv77… 5’653 Bitget 2025/03/24 01:43 pm
10 dgdjx… 5’250 Bitget 2025/03/24 03:14 pm
11 dkv74… 4’472 Bitget 2025/03/25 11:27 am
12 m3tvu… 3’996 Binance 2025/03/23 12:45 pm
13 rlyzr… 3’123 Binance 2025/03/23 12:21 pm
14 khb7m… 2’386 Binance 2025/03/23 03:54 pm
15 seu7e… 2’034 Binance 2025/03/23 12:02 pm
16 7bom4… 2’012 Binance 2025/03/23 11:48 am
17 63ypc… 1’892 Binance 2025/03/23 11:47 am
18 rjir4… 1’100 OKX 2025/03/16 02:09 pm
19 cnltd… 1’079 Binance 2025/03/25 06:55 pm
20 h77xz… 1’000 Binance 2025/03/25 07:43 am
21 Address 8* 507 Binance 2025/03/23 04:22 pm
22 Address 13** 339 Various 2025/03/23 03:40 pm

*Address 8 from FomoWELL SNS Sale
**Address 13 from FomoWELL SNS Sale

Summary:

  • 87.2% of funds (142’715 ICP) originated from 22 wallets, 21 of which are linked to exchanges (Bitget, Binance, Bybit, OKX).
  • 2 addresses from FomoWELL SNS Sale (Address 13 (Linking Wallet) and Address 8) participated in the sale.
4 Likes