{"investigation":{"slug":"aqua","entity_name":"Aqua","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Aqua (also known as AquaBot) was a Solana-based Telegram trading bot that conducted a presale in September 2025, raising approximately 21,770 SOL ($4.65 million) from retail investors before executing an apparent exit scam. On-chain investigator ZachXBT flagged the project after presale funds were split into four tranches, routed through intermediary wallets, and sent to instant exchanges hours before the scheduled token generation event. The project had secured endorsements from multiple established Solana ecosystem participants — including Meteora, Helius, Dialect, SYMMIO — and had received a near-perfect audit score from QuillAudits just days before the alleged rug pull.","sections":[{"content":"Aqua, operating under the handle @Aquabot_io on X (formerly Twitter) and at the domain aquabot.io, launched on Telegram on approximately August 12, 2025 as a Solana-native trading bot. The project marketed itself as infrastructure designed to democratize access to on-chain trading beyond 'insiders or whales,' claiming execution speeds in milliseconds and cumulative trading volume exceeding $90 million. DeFiLlama data indicated the bot generated approximately $2.83 million in product revenue in its final 30-day operational period, with a trading volume of roughly $137 million, lending apparent legitimacy to the platform's activity metrics. The project planned to launch a native AQUA token with revenue-sharing mechanics including buy-and-burn and staking rewards.","heading":"Project Overview","sources":[],"severity":"medium"},{"content":"Aqua conducted a public token presale by sharing a Solana wallet address — identified on-chain as 4Ea23VxEGAgfbtauQZz11aKNtzHJwb84ppsg3Cz14u6q — where investors could send SOL in exchange for AQUA tokens at the scheduled launch. The presale reportedly raised $1 million within 30 minutes of opening. In total, approximately 21,770 SOL (valued at roughly $4.65 million at the time) was accumulated. Shortly before the token generation event on or around September 8, 2025, ZachXBT flagged on his Telegram investigations channel that the presale wallet had split funds into four tranches, which were then transferred through intermediary addresses before being routed to multiple instant exchanges — a pattern consistent with obfuscating fund flows to prevent recovery. An additional $77,000 was allegedly manipulated from Meteora liquidity pools during the attempted token launch. Following the fund movements, the Aqua team disabled replies on all X posts, deleted Telegram messages with collaborators, and ceased all communications. Ethos Network CEO Serpin Taxt later confirmed the team had briefly contacted his organization about potential collaboration before disappearing entirely.","heading":"The Presale and Exit Scam","sources":[],"severity":"medium"},{"content":"On August 31, 2025 — approximately one week before the alleged exit — QuillAudits publicly congratulated the Aqua team for achieving a '99.7% score' in their security assessment and praised the team's commitment to security. This near-perfect audit result was actively used by the Aqua team as a credibility signal in their marketing. The Aqua incident illustrates a well-documented limitation of smart contract audits: they assess code for technical vulnerabilities but do not and cannot detect the intent of a project's operators to misappropriate funds. The presale funds were held in a wallet controlled by the team and were never subject to smart contract custody; accordingly, a clean audit of the contract code offered no protection to presale investors against a discretionary exit by the team.","heading":"QuillAudits Audit Failure","sources":[],"severity":"medium"},{"content":"Aqua secured promotional support from several prominent Solana ecosystem entities before the alleged exit, which substantially enhanced its perceived legitimacy among retail investors. Meteora, a Solana DEX and liquidity protocol, shared an endorsement post for Aqua after observing what its co-lead Soju described as 'an innovative liquidity design' using Meteora's DLMM (Dynamic Liquidity Market Maker) pools. Following the incident, Soju acknowledged that Meteora 'could have managed expectations better' and committed to tightening internal vetting processes. Dialect, a Solana messaging and notifications infrastructure provider, confirmed that Aqua had integrated its Alerts Stack; founder Chris Osborn stated no compensation changed hands and expressed regret for supporting the team. Helius, a Solana RPC infrastructure provider, was characterized as having provided standard infrastructure services rather than an explicit endorsement. SYMMIO was also listed among promotional partners. Multiple unnamed crypto influencers (KOLs) additionally promoted the presale. The project's ability to obtain these endorsements before executing an apparent exit scam has been cited as illustrative of the increasing sophistication of rug-pull schemes.","heading":"Ecosystem Endorsements and Partner Liability","sources":[],"severity":"medium"},{"content":"On-chain investigator ZachXBT published his findings via his Telegram channel (@investigations) on or around September 8–9, 2025. His investigation traced the movement of presale funds from wallet 4Ea23VxEGAgfbtauQZz11aKNtzHJwb84ppsg3Cz14u6q through a four-way split into intermediary addresses and subsequently to multiple instant exchanges. ZachXBT noted that the deployment and fund-movement techniques bore similarities to patterns observed in other previously identified fraudulent launches. He stated publicly: 'There can be no tolerance for such behavior. What we need — at the very least — is radical transparency.' ZachXBT's flag preceded or coincided with the team's disabling of social media replies, which corroborated the exit timeline.","heading":"ZachXBT Investigation","sources":[],"severity":"medium"},{"content":"After ZachXBT's report surfaced, the Aqua team disabled replies on all posts on X and deleted Telegram messages previously exchanged with collaborators and partners. The team subsequently published a new smart contract address, allegedly citing a Medium account suspension as the reason they could not provide a detailed public explanation. No formal acknowledgment, refund mechanism, or communication with investors was made. As of the date of this investigation, no law enforcement action or civil litigation has been publicly reported in connection with the Aqua exit.","heading":"Post-Exit Behavior","sources":[],"severity":"medium"}],"timeline":[{"date":"2025-08-12","event":"Aqua trading bot launches on Telegram as a Solana-native trading infrastructure product.","source":"","source_url":"https://solanafloor.com/news/aqua-bot-leverages-promotion-ecosystem-partners-rug-4m-presale"},{"date":"2025-08-31","event":"QuillAudits publicly congratulates Aqua team for achieving a 99.7% security audit score.","source":"","source_url":"https://cryptoslate.com/solana-trading-bot-aqua-allegedly-rug-pulls-4-65-million-after-major-ecosystem-endorsements/"},{"date":"2025-09-03","event":"Aqua posts its last active update on X (@Aquabot_io); project was reportedly active on social media building presale hype.","source":"","source_url":"https://cryptobriefing.com/aquabot-rug-pull-22k-sol-presale/"},{"date":"2025-09-08","event":"Aqua presale concludes; 21,770 SOL (~$4.65M) is held in presale wallet 4Ea23VxEGAgfbtauQZz11aKNtzHJwb84ppsg3Cz14u6q. Funds are split into four tranches and routed through intermediary wallets to instant exchanges. An additional ~$77K is allegedly manipulated from Meteora liquidity pools. The team disables replies on all X posts.","source":"","source_url":"https://finance.yahoo.com/news/solana-project-aquabot-vanishes-4-221301862.html"},{"date":"2025-09-08","event":"ZachXBT flags Aqua on his Telegram investigations channel, publishing on-chain evidence of the fund movement and noting similarities to prior fraudulent launches.","source":"","source_url":"https://cryptobriefing.com/aquabot-rug-pull-22k-sol-presale/"},{"date":"2025-09-09","event":"Multiple crypto news outlets report the alleged rug pull. Meteora co-lead Soju states the team will tighten internal vetting processes. Dialect founder Chris Osborn expresses regret for supporting the project. Ethos Network CEO confirms Aqua had briefly been in contact before going silent.","source":"","source_url":"https://cryptoslate.com/solana-trading-bot-aqua-allegedly-rug-pulls-4-65-million-after-major-ecosystem-endorsements/"},{"date":"2025-09-09","event":"Aqua team publishes a new smart contract address, citing Medium suspension as reason for lack of public explanation. No investor restitution announced.","source":"","source_url":"https://cryptoslate.com/solana-trading-bot-aqua-allegedly-rug-pulls-4-65-million-after-major-ecosystem-endorsements/"}],"sources_used":[],"source_tags":["helius","zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:04:56.041618+00:00","updated_at":"2026-08-29T01:35:50.958+00:00"}}