Investigation 1: Coordinated sniping at the VULT launch

What buyers were told before the sale

Vultisig said its launch was intended to distribute the token widely. The official announcement described a buying limit of 1,000 USDC in the first round and 10,000 USDC total after the second round opened. It used both “per wallet” and “per user” when describing the limit.

A single wallet could fill the limit in two purchases. The question is what connected the 26 wallets that did exactly that. Their common payment route, shown below, gives an independent way to test that connection. The launch rules allowed immediate selling.

The whitelist administrator opened the route for the test buy

Three addresses had different roles. The token owner activated the whitelist. The whitelist administrator operated it. The VULT TEAM WALLET made the test purchase.

Before the scheduled rounds, the VULT contract permitted transfers between addresses already on the list. Adding the trading pool to that list meant the pool could deliver VULT to an approved buyer. The administrator added the pool first and the VULT TEAM WALLET in a batch of 500 addresses. The table follows what happened in order.

All 27 wallets appear in the 1,149-address list in the signed project code. They also appear on the earlier WEWE whitelist. That shows earlier eligibility. The coordinated VULT trades and payments are established separately below. See the list sources and address comparison.

The test buy was 1 hour, 3 minutes and 36 seconds before the administrator advanced the contract to round one. Another approved wallet used the early route twice, and a replay using a third funded and approved wallet also succeeded. The team wallet’s later 20% transfer is what links this test to the coordinated buying group.

Round one enabled at 11:59:23 UTC · Other early buy 1 · Other early buy 2

Signed project list · Preserved pinned source

The team’s own screenshot identifies the VULT TEAM WALLET

JP shared an image of an Ethereum transaction in the Vultisig Telegram group. Eight minutes later, the same image appeared in his public launch post acknowledging that the team had tested the contracts. The preserved image and the transaction can be compared without relying on anyone’s recollection.

The image shows six fee and gas fields. Together they match exactly one of the 211 transactions in the block, the 1,000 USDC purchase sent by 0xaf084252945b6a71a7ef5579c187de9c436041d5. That is the basis for the VULT TEAM WALLET label.

The same 26 wallets filled both rounds

At 11:59:47 UTC on 27 October 2025, 26 wallets each bought 1,000 USDC of VULT in the same Ethereum block. At 13:01:11 UTC, the same 26 wallets each bought another 9,000 USDC in another single block. Each reached the advertised 10,000 USDC limit. Together they spent 260,000 USDC.

The 26 are the exact addresses in the table. The team wallet’s earlier purchase is separate from these 52 swaps. The next step compares what all 27 did with their purchased tokens.

First purchase block · Second purchase block

All 27 sent one fifth of what they bought

At 12:00:47 UTC on 28 October, the VULT TEAM WALLET and the 26 launch buyers each sent 20% of the VULT they bought in a separate token transfer. Their 27 transactions sit back to back in one block and use identical fee settings. The team wallet’s payment is at transaction index 54, inside the run.

For example, the team wallet received 32,438.067221737680597966 VULT in the test and later sent 6,487.613444347536119593 VULT to 0x9f82582fc038673921f4b46528d2bde55375ac97. Divide the purchased amount by five and round down to the smallest VULT unit. The result is the exact amount sent. The same calculation works for every row.

These transfers took place the day after buying. The team wallet’s receipt shows a standalone token transfer directly to the receiving address. The 26 others sent their shares to 26 intermediate addresses, which forwarded the exact amounts to that same recipient.

The VULT TEAM WALLET paid 0x9f8258…75ac97 directly. The other 26 used forwarding wallets. The address received 314,186.22 VULT in total.

Earlier launch phases restricted wallet-to-wallet transfers.

Complete payment block

The receiving wallet paid for the 26 forwarding routes in advance

At 10:51:23 UTC on 28 October, the wallet that would receive the 20% shares sent ETH to precisely the 26 forwarding addresses. It did this 69 minutes and 24 seconds before the buyers made their payments. The ETH covered the fees for forwarding the VULT.

This places the common recipient on both sides of the arrangement. It prepared the routes before the buyers paid, then received the exact shares through the routes it had funded. The VULT TEAM WALLET paid that recipient directly.

Follow the purchase money, the remaining tokens and the sales

On 26 October, the 26 buyers moved 232,978 USDC to other wallets between 12:11:47 and 12:30:11 UTC. On launch day those counterparties returned the exact amounts between 11:35:35 and 11:44:11 UTC, before round one. In 15 of the 26 routes, the counterparty later received the buyer’s remaining VULT after the 20% payment. The same address pairs recur before the buys and after settlement.

In March 2024, the VULT TEAM WALLET sent ETH to a wallet that later funded two of the 26 buyers. All three used the same Binance deposit address for AEVO. The intermediary also held other funds.

Team wallet → intermediary (ETH) · Intermediary → buyer 1 (ETH) · Intermediary → buyer 2 (ETH)

The 20% payment preceded Paaao’s public assurance

The VULT TEAM WALLET paid its share at 12:00:47 UTC. Paaao posted the assurance at 16:07:31 UTC, just over four hours later. The transaction record shows that the wallet the team had identified through its test had already participated in the same payment arrangement as the 26 coordinated buyers.

Team wallet’s 20% transfer · Preserved assurance and timestamp

What the records establish

The project’s whitelist administrator enabled the early purchase. The team’s post and the exact gas figures tie that purchase to the VULT TEAM WALLET. The wallet then paid 20% of its VULT to the same address that arranged and received the 26 other buyers’ 20% payments.

The team wallet’s separate transfer is the link: exact amount, same block of payments, same ultimate recipient. The recipient’s advance funding of all 26 forwarding wallets shows the collection was prepared before the buyers paid.

Check a wallet’s transactions · See the original and preserved lists · Inspect the common receiving wallet

The four source workbooks