DogWifTools
Summary
DogWifTools is a Solana-based memecoin tooling platform that markets features explicitly designed to simulate artificial trading volume, conceal supply concentration across hundreds of wallets, and inflate engagement metrics on pump.fun — capabilities that security researchers and blockchain analysts characterize as enabling wash trading and coordinated pump-and-dump schemes. In January 2025, the platform suffered a supply-chain attack in which threat actors trojaned versions 1.6.3 through 1.6.6 with a Remote Access Trojan, draining an estimated $10 million from users' wallets; the attacker group framed the theft as vigilante justice against scammers. No known regulatory action has been taken against DogWifTools operators, who remain anonymous.
Connected Entities
1 entitiesTimeline(10 events)
2024-07-12
DogWifTools v1.0 officially released on X, advertising volume bot, bundler, anti-detection bypass, and comment bot features for pump.fun token launches.
2024-07-01
Platform begins selling lifetime licenses at approximately 15 SOL, establishing a paid subscription base of memecoin operators.
2025-01-01
Threat actors reverse-engineer DogWifTools software and extract a GitHub authentication token, gaining covert access to the private repository.
2025-01-27
Threat actors trojanize DogWifTools versions 1.6.3 through 1.6.6, embedding a Remote Access Trojan (RAT) that downloads 'updater.exe' to harvest private keys, exchange credentials, and KYC identity documents from Windows users.
2025-01-29
DogWifTools users begin reporting mass wallet draining across hot and cold wallets; loss of Binance and Coinbase account access reported. Community estimates of losses reach $10 million.
2025-01-29
DogWifTools operators publicly attribute the compromise to a third-party actor who gained access via GitHub token; deny it is an internal rug pull.
2025-01-30
A group calling itself 'Jizzy Group' publishes a manifesto on a dark web onion site claiming responsibility for the attack, framing it as vigilante justice against scammers and calling Solana 'a fucking joke designed by criminals for criminals.'
2025-01-30
Major crypto security outlets including BleepingComputer, Halborn, Rekt News, CryptoTimes, and The Defiant publish coverage of the incident, widely characterizing DogWifTools as a 'fake liquidity generator.'
2025-02-01
Halborn Security publishes post-mortem analysis confirming supply-chain attack vector, RAT injection mechanism, and characterizing DogWifTools as infrastructure for wash trading and fake liquidity generation.
2025-02-01
Wiz Cloud Threat Landscape database catalogues the DogWifTool supply-chain attack as a notable 2025 security incident.
Decision Log
- hash: EuY2R8aWv2nBNMFTcy7kaFVvbXZoMF7MNvvuJPiLyRNP
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:25 AM
last updated: 5/19/2026, 8:13:21 PM
avoid.net — verified advice for a post-truth world