{"investigation":{"slug":"siren","entity_name":"Siren (SIREN)","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"SIREN is a BNB Chain-based token launched in early 2025, marketed as an on-chain AI agent analyst. In March 2026, blockchain investigator ZachXBT and analytics firm Bubblemaps identified that a single wallet cluster controlled nearly 50% of the circulating supply and linked those wallets on-chain to DWF Labs, alleging coordinated market manipulation. The token subsequently crashed over 70% from its all-time high within 24 hours. The SIREN name is also shared by a separate, earlier Ethereum-based DeFi options protocol (Siren Markets) that suffered a $3.5 million reentrancy exploit in September 2021.","sections":[{"content":"On or around March 23–24, 2026, on-chain investigator ZachXBT publicly flagged SIREN as a victim of supply control manipulation, naming it alongside RAVE, RIVER, and LAB in a broader investigation into what he described as a pattern of market maker fraud enabled by the exchange Bitget. ZachXBT alleged that a single wallet cluster — comprising over 200 addresses, with 52 of the top 54 holder addresses belonging to one entity — controlled approximately 644 million of the 728 million circulating SIREN tokens, equivalent to roughly 88.5% of supply and valued near $1.44 billion at peak price. He connected the cluster on-chain to DWF Labs by tracing wallet interactions with DWF-affiliated tokens including LADYS, RACA, and TOMO. DWF Labs had previously publicly acknowledged holding 3 million SIREN tokens acquired for approximately $541,000. The cluster allegedly accumulated tokens in two major phases (June and February 2025) via PancakeSwap, then distributed holdings across approximately 47 addresses to obscure the concentration. ZachXBT also accused Bitget's founder Shawn Liu of enabling market maker schemes across multiple tokens and posted a $10,000 bounty for supporting evidence. Neither DWF Labs nor Bitget has been formally charged in connection with these allegations as of the investigation date. DWF Labs has consistently denied past market manipulation allegations.","heading":"ZachXBT Supply Manipulation Allegations (2026)","sources":[{"url":"https://news.bitcoin.com/zachxbt-bitget-supply-control-manipulation-rave-river-siren-lab-2026/","name":"news.bitcoin.com","type":"other","credibility":3},{"url":"https://cryptopotato.com/siren-tanks-70-in-a-single-day-as-zachxbt-and-bubblemaps-sound-the-alarm/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://yellow.com/news/siren-token-price-crash-supply-risk","name":"yellow.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/03/24/binance-listed-siren-token-rallies-30x-heres-why-you-should-stay-away/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain analytics firm Bubblemaps published findings in late March 2026 warning that 'one entity controls ~50% of $SIREN,' identifying a cluster of over 200 wallets holding more than $1 billion worth of tokens at peak valuation. The cluster's accumulation pattern — coordinated buys in two distinct phases followed by dispersal across dozens of addresses — was flagged as consistent with supply control tactics designed to mask beneficial ownership while maintaining effective price control. Bubblemaps noted this pattern mirrors previous pump-and-dump schemes seen in tokens including BULLA and RIVER. Separately, on-chain analyst Yu Jin reported that 52 of the top 54 holder addresses traced to a single entity controlling 644 million tokens. Smart-money wallets were found to have reduced exposure by over 81% during the late rally phase while retail wallets simultaneously increased positions, a pattern described as 'classic late-stage distribution.'","heading":"Bubblemaps On-Chain Analysis","sources":[{"url":"https://news.bitcoin.com/bubblemaps-flags-heavy-token-concentration-as-siren-rally-draws-scrutiny/","name":"news.bitcoin.com","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/siren-token-plummets-70-cluster-controls-supply-2603/","name":"ainvest.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/caf53-siren-token-plunge-centralized-supply","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://phemex.com/news/article/siren-token-supply-dominated-by-single-entity-suspected-to-be-dwf-labs-68351","name":"phemex.com","type":"other","credibility":3}],"severity":"medium"},{"content":"SIREN's token price staged a rapid appreciation from approximately $0.08 in early February 2026 to an all-time high above $3.65 on March 22, 2026 — a rise of roughly 45x — briefly pushing its market capitalization past $2.2 billion and making it a top-40 altcoin. Within 24 hours of the peak, following the publication of supply concentration findings by Bubblemaps and ZachXBT, the token fell more than 70%, dropping below $1.00. The total market capitalization shrank from $2.2 billion to approximately $740 million in that period. Market manipulation mechanics observed included short-squeeze dynamics: negative funding rates on Binance and Bybit persisted from March 14, with short sellers effectively subsidizing leveraged long positions. When the reversal came, over $7 million in forced liquidations occurred across both exchanges ($2.4 million on Binance, $4.7 million on Bybit). SIREN fell from a top-40 ranking to outside the top 80 by market capitalization.","heading":"Price Collapse and Market Impact (March 2026)","sources":[{"url":"https://cryptopotato.com/siren-tanks-70-in-a-single-day-as-zachxbt-and-bubblemaps-sound-the-alarm/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/03/24/binance-listed-siren-token-rallies-30x-heres-why-you-should-stay-away/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://www.banklesstimes.com/articles/2026/03/25/siren-coin-price-doubles-overnight-but-risks-loom-large/","name":"banklesstimes.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Note: Siren Markets is a separate, earlier project from the 2026 BNB Chain SIREN AI token. It is an Ethereum and Polygon-based DeFi options protocol. On September 3, 2021, at approximately 12:17 AM UTC, the Siren Markets protocol was exploited via a classical reentrancy attack, resulting in the theft of approximately $3.5 million in tokens from multiple AMM liquidity pools on the Polygon network. The exploit targeted a vulnerability in MinterAmm.withdrawCapital interacting with MinterAmm._sellOrWithdrawActiveTokens and the ERC1155.safeTransferAcceptanceCheck callback. The contract failed to update the collateralTokenBalance state variable before executing external calls, allowing an attacker's fallback function to re-enter the vulnerable code and drain collateral repeatedly before state updates occurred. Affected pools included KNC, SUSHI, USDC, WETH, WMATIC, and UNI. Twenty-six LP addresses on Polygon suffered losses. The exploit was notable because a Quantstamp security audit completed on August 2, 2021 — less than five weeks prior — had flagged reentrancy concerns but dismissed them as false positives affecting only trusted contracts. The SIREN team froze token movements following discovery and announced plans to issue IOU redemption tokens proportional to affected addresses' losses and offered a 10% bounty for fund recovery. No subsequent public updates confirmed successful recovery or full compensation. The vulnerability had existed in the codebase since the project's December 2020 GitHub release and persisted through the v2 upgrade.","heading":"Siren Markets Options Protocol — 2021 Reentrancy Exploit","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-siren-protocol-hack-september-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/sirenmarketreentrancybug.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://medium.com/siren-markets/siren-incident-report-264e57f16d7","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 2, 2021, Quantstamp published a security audit of Siren Markets V2. The audit identified two high severity issues and four medium severity issues relating to options mechanics and pricing. Quantstamp's report advised against deploying the contracts 'as is.' Despite this warning, the protocol deployed and concentrated funds in smart contract hot wallets based on the team's assessment of the audit results. The reentrancy vulnerability that led to the September 2021 exploit was located in an 'unusual spot' not covered by the audit's reentrancy analysis, which had focused on more conventional attack surfaces. This incident is frequently cited as a case study for the limitations of single-firm audits on complex DeFi protocols.","heading":"Quantstamp Audit and Security Failures (Siren Markets)","sources":[{"url":"https://uploads-ssl.webflow.com/610fc6a1e961affb229320ba/61342a98afe965652f0fcb5b_Siren%20Markets.pdf","name":"uploads-ssl.webflow.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-siren-protocol-hack-september-2021","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The 2026 BNB Chain SIREN token was launched in early 2025 and marketed as 'the first on-chain AI agent analyst on BNB Chain,' featuring dual AI personas ('Golden' for conservative strategies, 'Crimson' for high-risk approaches) intended to provide real-time trading signals and on-chain analysis. In early 2026, Siren was included in Binance's Meme Liquidity Support Plan, which contributed to heightened retail attention ahead of the March 2026 price surge. The deployer identity and team behind the 2026 SIREN token remained largely anonymous as of the crash. The separate Siren Markets options protocol (sirenmarkets.com / siren.xyz) was founded and operated as a legitimate DeFi options infrastructure project on Ethereum and Polygon; beyond the 2021 hack, no fraud or team misconduct allegations have been identified for that entity. The two projects share a name and ticker but have no known organizational relationship.","heading":"Project Background and Identity","sources":[{"url":"https://bingx.com/en/learn/article/what-is-siren-ai-siren-on-bnb-chain-how-to-buy","name":"bingx.com","type":"other","credibility":3},{"url":"https://phemex.com/academy/siren-crypto-two-tokens-siren-protocol-vs-siren-token","name":"phemex.com","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/siren-siren-chain-ai-agent-launches-dual-personas-bnb-chain-2603/","name":"ainvest.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-12","event":"Siren Markets options protocol code first published on GitHub.","source":""},{"date":"2021-08-02","event":"Quantstamp completes security audit of Siren Markets V2, flagging two high severity issues; team proceeds with deployment.","source":""},{"date":"2021-09-03","event":"Siren Markets AMM pools exploited via reentrancy attack; approximately $3.5 million in KNC, SUSHI, USDC, WETH, WMATIC, and UNI drained from Polygon pools. 26 LP addresses affected.","source":""},{"date":"2025-02","event":"2026 BNB Chain SIREN AI agent token launched; major wallet cluster begins accumulating supply via PancakeSwap.","source":""},{"date":"2025-06","event":"Second major accumulation phase by suspected controlling wallet cluster.","source":""},{"date":"2026-02","event":"SIREN listed and gains attention as Binance Meme Liquidity Support Plan project.","source":""},{"date":"2026-03-10","event":"SIREN token trading at approximately $0.40 on BNB Chain.","source":""},{"date":"2026-03-14","event":"Persistent negative funding rates observed on Binance and Bybit, indicating short sellers subsidizing leveraged longs.","source":""},{"date":"2026-03-22","event":"SIREN reaches all-time high of $3.65, pushing market cap above $2.2 billion; token ranks in top 40 by market cap.","source":""},{"date":"2026-03-23","event":"Bubblemaps publishes warning that a single cluster controls nearly 50% of SIREN supply (~$1.5B at peak). On-chain analyst Yu Jin reports 52 of top 54 holder addresses belong to one entity. ZachXBT links cluster wallets to DWF Labs.","source":""},{"date":"2026-03-24","event":"SIREN crashes over 70% to below $1.00 within 24 hours. Over $7 million in forced liquidations across Binance ($2.4M) and Bybit ($4.7M). Token falls outside top-80 by market cap.","source":""},{"date":"2026-05","event":"ZachXBT names SIREN alongside RAVE, RIVER, and LAB in broader investigation into Bitget-enabled market maker supply manipulation, accusing Bitget founder Shawn Liu of enabling the scheme.","source":""}],"sources_used":[{"url":"https://news.bitcoin.com/zachxbt-bitget-supply-control-manipulation-rave-river-siren-lab-2026/","name":"ZachXBT Names RAVE, RIVER, SIREN, and LAB as Victims of Bitget-Enabled Market Maker Fraud — Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260528044355/https://news.bitcoin.com/zachxbt-bitget-supply-control-manipulation-rave-river-siren-lab-2026/","credibility":2,"archive_timestamp":"2026-05-28T04:43:55+00:00"},{"url":"https://cryptopotato.com/siren-tanks-70-in-a-single-day-as-zachxbt-and-bubblemaps-sound-the-alarm/","name":"SIREN Tanks 70% in a Single Day as ZachXBT and Bubblemaps Sound the Alarm — CryptoPotato","type":"news_article","archive_url":"http://web.archive.org/web/20260411103833/https://cryptopotato.com/siren-tanks-70-in-a-single-day-as-zachxbt-and-bubblemaps-sound-the-alarm/","credibility":2,"archive_timestamp":"2026-04-11T10:38:33+00:00"},{"url":"https://yellow.com/news/siren-token-price-crash-supply-risk","name":"SIREN Loses 70% After Investigators Flag Wallet Cluster — Yellow.com","type":"news_article","archive_url":"https://web.archive.org/web/20260724215333/https://yellow.com/news/siren-token-price-crash-supply-risk","credibility":2,"archive_timestamp":"2026-07-24T21:53:33+00:00"},{"url":"https://www.cryptotimes.io/2026/03/24/binance-listed-siren-token-rallies-30x-heres-why-you-should-stay-away/","name":"Warning: Binance-Listed Siren Token Rallies 30X — Here's Why You Should Stay Away — CryptoTimes","type":"news_article","archive_url":"https://web.archive.org/web/20260725041202/https://www.cryptotimes.io/2026/03/24/binance-listed-siren-token-rallies-30x-heres-why-you-should-stay-away/","credibility":2,"archive_timestamp":"2026-07-25T04:12:02+00:00"},{"url":"https://news.bitcoin.com/bubblemaps-flags-heavy-token-concentration-as-siren-rally-draws-scrutiny/","name":"Bubblemaps Flags Heavy Token Concentration as SIREN Rally Draws Scrutiny — Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260324191840/https://news.bitcoin.com/bubblemaps-flags-heavy-token-concentration-as-siren-rally-draws-scrutiny/","credibility":2,"archive_timestamp":"2026-03-24T19:18:40+00:00"},{"url":"https://phemex.com/news/article/siren-token-supply-dominated-by-single-entity-suspected-to-be-dwf-labs-68351","name":"SIREN Token Supply Dominated by Single Entity Suspected to be DWF Labs — Phemex News","type":"on_chain","archive_url":"https://web.archive.org/web/20260724212529/https://phemex.com/news/article/siren-token-supply-dominated-by-single-entity-suspected-to-be-dwf-labs-68351","credibility":2,"archive_timestamp":"2026-07-24T21:25:29+00:00"},{"url":"https://www.ainvest.com/news/siren-token-plummets-70-cluster-controls-supply-2603/","name":"SIREN Token Plummets 70% As Cluster Controls Nearly Half Of Supply — Ainvest","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptorank.io/news/feed/caf53-siren-token-plunge-centralized-supply","name":"SIREN Token Plummets 70% In Shocking Centralization Allegations on BNB Chain — CryptoRank","type":"news_article","archive_url":"https://web.archive.org/web/20260725084939/https://cryptorank.io/news/feed/caf53-siren-token-plunge-centralized-supply","credibility":2,"archive_timestamp":"2026-07-25T08:49:39+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-siren-protocol-hack-september-2021","name":"Explained: The SIREN Protocol Hack (September 2021) — Halborn Security","type":"research","archive_url":"http://web.archive.org/web/20260516234000/https://www.halborn.com/blog/post/explained-the-siren-protocol-hack-september-2021","credibility":2,"archive_timestamp":"2026-05-16T23:40:00+00:00"},{"url":"https://quadrigainitiative.com/casestudy/sirenmarketreentrancybug.php","name":"Sep 2021 - Siren Market Reentrancy Bug - $3.5m — Quadriga Initiative Case Study","type":"research","archive_url":"http://web.archive.org/web/20251217084118/https://quadrigainitiative.com/casestudy/sirenmarketreentrancybug.php","credibility":2,"archive_timestamp":"2025-12-17T08:41:18+00:00"},{"url":"https://medium.com/siren-markets/siren-incident-report-264e57f16d7","name":"SIREN Incident Report — Siren Markets Official (Medium/Blog)","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://uploads-ssl.webflow.com/610fc6a1e961affb229320ba/61342a98afe965652f0fcb5b_Siren%20Markets.pdf","name":"August 2021 Quantstamp Security Audit of Siren Markets V2 — Quantstamp","type":"research","archive_url":"https://web.archive.org/web/20260725040120/https://uploads-ssl.webflow.com/610fc6a1e961affb229320ba/61342a98afe965652f0fcb5b_Siren%20Markets.pdf","credibility":1,"archive_timestamp":"2026-07-25T04:01:20+00:00"},{"url":"https://www.gncrypto.news/news/zachxbt-accuses-bitget-token-supply-manipulation/","name":"ZachXBT Accuses Bitget of Token Supply Manipulation — GNCrypto News","type":"news_article","archive_url":"http://web.archive.org/web/20260725005408/https://www.gncrypto.news/news/zachxbt-accuses-bitget-token-supply-manipulation/","credibility":2,"archive_timestamp":"2026-07-25T00:54:08+00:00"},{"url":"https://www.gate.com/news/detail/10794741","name":"DWF Labs invested $541,000 to acquire 3 million SIREN Tokens — Gate.com News","type":"news_article","archive_url":"https://web.archive.org/web/20260724214340/https://www.gate.com/news/detail/10794741","credibility":2,"archive_timestamp":"2026-07-24T21:43:40+00:00"},{"url":"https://phemex.com/academy/siren-crypto-two-tokens-siren-protocol-vs-siren-token","name":"Siren Crypto: SI Token vs SIREN Token Crash Explained — Phemex Academy","type":"research","archive_url":"https://web.archive.org/web/20260724180446/https://phemex.com/academy/siren-crypto-two-tokens-siren-protocol-vs-siren-token","credibility":2,"archive_timestamp":"2026-07-24T18:04:46+00:00"},{"url":"https://www.theblock.co/post/401290/zachxbt-alleges-95-insider-control-of-lab-token-in-investigation-into-ai-terminals-6-billion-fdv-project","name":"ZachXBT Alleges 95% LAB Token Insider Control (contextual, names SIREN as related) — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260528032642/https://www.theblock.co/post/401290/zachxbt-alleges-95-insider-control-of-lab-token-in-investigation-into-ai-terminals-6-billion-fdv-project","credibility":1,"archive_timestamp":"2026-05-28T03:26:42+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:54.518799+00:00","updated_at":"2026-08-29T01:34:46.262+00:00"}}