{"investigation":{"slug":"andy","entity_name":"ANDY","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"ANDY is a meme token launched on the Base (Ethereum L2) network in 2024, built around the 'boy's club' internet meme character. Blockchain investigator ZachXBT documented a theft of approximately $2 million in ANDY tokens from a victim's wallet in June 2024, with the perpetrator converting roughly half the stolen funds to Ethereum. CertiK's Skynet platform assigned the token a score of 2.7 out of 100, indicating serious security and governance deficiencies. Allegations that individuals associated with the token conducted SIM-swap attacks targeting Korean-American crypto holders have been attributed to ZachXBT's flagging but remain unconfirmed by independently verifiable Tier 1 or Tier 2 sources.","sections":[{"content":"ANDY is a meme-centric ERC-20 token deployed on the Base network (Coinbase's Ethereum Layer 2 chain) at contract address 0x18a8bd1fe17a1bb9ffb39ecd83e9489cfd17a022. The token's total and circulating supply is fixed at 1,000,000,000 ANDY. It draws its branding from the 'boy's club' internet meme genre, which also encompasses the Pepe and Matt tokens. ANDY reached an all-time high of approximately $0.04575 on June 7, 2024, corresponding to a peak market capitalization in the tens of millions of dollars. As of mid-2026, the token trades approximately 98% below that peak, with daily trading volume under $500 and a market capitalization below $1 million. The project has no disclosed development team, no published whitepaper, and no formal utility. Source code is verified on BaseScan but no third-party audit was submitted by the project team.","heading":"Token Overview","sources":[],"severity":"medium"},{"content":"On or around June 8, 2024, blockchain investigator ZachXBT published findings on his Telegram channel (t.me/investigations) documenting a theft of approximately $2 million in cryptocurrency from a victim's wallet, a significant portion of which was held in ANDY tokens. The attacker drained the victim's wallet in three transactions executed within one minute. Stolen assets were consolidated into a single address — identified in ZachXBT's transaction diagram — before being dispersed across five new addresses within 30 minutes. At the time of reporting, the attacker retained approximately 4.2 billion ANDY tokens valued at roughly $1 million, having already converted the remaining stolen assets to Ethereum (ETH), including a transfer of 8.38 ETH to a new address. ZachXBT advised ANDY holders to monitor the attacker's address closely. The attacker address cited in ZachXBT's post was 0x68BbEd6A47194EFf1CF514B50Ea91895597fc91E. The identity of the victim and the attacker were not publicly disclosed in reporting based on ZachXBT's findings. No arrests or law enforcement actions tied specifically to this incident have been confirmed in open sources.","heading":"ZachXBT-Documented $2M Theft Targeting ANDY Holders","sources":[],"severity":"medium"},{"content":"Source tags associated with the AVOID.NET intake for this entity include 'sim-swap' and 'korean-american-victims', indicating that ZachXBT or community sources have alleged that individuals connected to the ANDY token conducted SIM-swap attacks specifically targeting Korean-American cryptocurrency holders. SIM-swap fraud involves socially engineering a mobile carrier's customer service into porting a victim's phone number to a SIM controlled by an attacker, thereby bypassing SMS-based two-factor authentication and enabling unauthorized access to exchange and wallet accounts. ZachXBT has documented the broader SIM-swap threat ecosystem extensively, including a report noting that over $13.3 million was stolen via 54 SIM-swap incidents over a four-month window targeting US-based crypto holders across carriers including T-Mobile, Verizon, and AT&T. However, no Tier 1 or Tier 2 source independently verifying that ANDY token team members specifically conducted SIM-swap attacks targeting Korean-American individuals was located during this investigation. This allegation should be treated as low-confidence until confirmed by regulatory filings, court records, or major news outlet reporting.","heading":"Alleged SIM-Swap Attacks Targeting Korean-American Crypto Holders","sources":[],"severity":"medium"},{"content":"CertiK's Skynet platform assigned ANDY a security score of 2.7 out of 100, which is classified as critically low. CertiK Skynet scores evaluate over 20 on-chain and off-chain signals across six categories: code security, fundamentals, operations, market behavior, governance, and community. A score of 2.7 indicates significant deficiencies across multiple categories. No formal smart contract audit was submitted to CertiK or any other major auditor by the ANDY team. The contract was deployed without optimization enabled under Solidity compiler v0.8.22, and source code is verified on BaseScan as an exact match. The absence of an audit, the anonymous team, and the lack of disclosed tokenomics governance mechanisms contribute to the low Skynet score.","heading":"CertiK Security Assessment","sources":[],"severity":"medium"},{"content":"ANDY launched in 2024 as a pure meme token with a fixed supply of 1 billion tokens and no stated utility, revenue model, or roadmap. The token reached its all-time high of approximately $0.04575 in early June 2024, coinciding with the period when ZachXBT documented the large-scale theft involving ANDY holdings. By mid-2026, the token had declined approximately 98.3% from that peak and recorded daily trading volumes under $500, indicating severely impaired liquidity. With a sub-$1 million market capitalization and fewer than 64 transfers in a recent 24-hour window despite holding over 150,000 unique addresses, the token exhibits characteristics consistent with a dormant or abandoned project. The dramatic price decline and liquidity erosion present significant risks for any remaining holders attempting to exit positions.","heading":"Market Risk and Token Structure","sources":[],"severity":"medium"}],"timeline":[{"date":"2024-05","event":"ANDY token records its all-time high price of approximately $18.85 (CoinMarketCap) or $0.04575 (CoinGecko) on Base network, reflecting peak speculative interest.","source":"","source_url":"https://coinmarketcap.com/currencies/andy-token/","date_original":"2024-05-01"},{"date":"2024-06-07","event":"ANDY reaches a second ATH peak per CoinGecko data at $0.04575, shortly before ZachXBT documents the $2M theft incident.","source":"","source_url":"https://www.coingecko.com/en/coins/andy-on-base"},{"date":"2024-06-08","event":"ZachXBT publishes findings on his Telegram channel documenting a theft of approximately $2 million in memecoins targeting an ANDY holder. The attacker drains the victim's wallet in three transactions within one minute, holds 4.2 billion ANDY (~$1M), and converts remaining assets to ETH. Attacker address 0x68BbEd6A47194EFf1CF514B50Ea91895597fc91E flagged for monitoring.","source":"","source_url":"https://coinedition.com/zachxbt-exposes-2m-memecoin-heist-targets-andy-holders/"},{"date":"2024-06-08","event":"CoinEdition and BitcoinWorld report ZachXBT's findings, advising ANDY holders to monitor the attacker's address due to the attacker's remaining large token position.","source":"","source_url":"https://bitcoinworld.co.in/zachxbt-exposes-2m-meme-coin-heist-targets-andy-holders/"},{"date":"2026-02-06","event":"ANDY token reaches its all-time low of approximately $0.000425, down over 99% from peak. Daily trading volume falls to negligible levels.","source":"","source_url":"https://www.coingecko.com/en/coins/andy-on-base"}],"sources_used":[],"source_tags":["zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:04:58.190567+00:00","updated_at":"2026-08-29T01:34:54.198+00:00"}}