← DogWifToolsreviewed 2026-10-28 · 15 claims checked
Fact-check findings
What an automated fact-checker found when it re-read DogWifTools against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
4 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #7[unverifiable][awaiting moderator]in the timeline
“Threat actors trojanize DogWifTools versions 1.6.3 through 1.6.6, embedding a Remote Access Trojan (RAT) that downloads 'updater.exe' to harvest private keys, exchange credentials, and KYC identity documents from Windows users.”
reviewerThreat actors trojanized the versions on 2025-01-27The 2025-01-27 date was not found in the sources fetched. The KYC-document harvesting is alleged, not established. - #13[unverifiable][awaiting moderator]in section: Background
“Licenses were sold for approximately 15 SOL (roughly $1,500–$2,500 depending on market price) for a lifetime plan.”
reviewerLicenses sold for about 15 SOL lifetimeNo cited source gives the price. The dollar range at 15 SOL is also unsourced. - #14[unverifiable][awaiting moderator]in the timeline
“DogWifTools v1.0 officially released on X, advertising volume bot, bundler, anti-detection bypass, and comment bot features for pump.fun token launches.”
reviewerv1.0 released on X on 2024-07-12Primary source is on X and could not be read. - #15[unverifiable][awaiting moderator]in section: Team & Anonymity
“DogWifTools operators issued communications attributing the compromise to a third-party actor and continued operating the service.”
reviewerOperators continued operating the service after the attack, and the platform remains activeContinued operation after Jan 2025 is not shown by the sources I read. My search for current status returned nothing.
partially supported
5 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Risk Assessment
“a catastrophic supply-chain security failure resulting in $10M in documented losses”
reviewerThe $10M loss is described as documentedSources call it an estimate. The page's own On-Chain Evidence section says wallet addresses and hashes were not published, so 'documented' overstates. - #3[partially supported][awaiting moderator]in section: Risk Assessment
“The January 2025 attackers used stolen KYC documents and credentials to allegedly open Binance accounts in victims' names”
reviewerAttackers used stolen KYC documents to open Binance accounts in victims' namesThe hedge 'allegedly' is present, but the cited Rekt article says accounts were opened in the attackers' own names. The identity-fraud inference that follows rests on this and is a risk, not a reported outcome. The Victim Losses section says attackers 'impersonate[d]' users to take over accounts, which is also not clearly sourced. - #4[partially supported][awaiting moderator]in section: On-Chain Evidence
“characterized DogWifTools as 'designed to automatically generate fake trading activity on-chain to create the illusion of liquidity.'”
reviewerHalborn post-mortem characterized DogWifTools as designed to automatically generate fake trading activity to create the illusion of liquidity (direct quote)The page presents a quotation that is not verbatim in Halborn and attributes it as Halborn's characterization of the tool rather than of its use by rug pullers. - #5[partially supported][awaiting moderator]in the timeline
“Major crypto security outlets including BleepingComputer, Halborn, Rekt News, CryptoTimes, and The Defiant publish coverage of the incident, widely characterizing DogWifTools as a 'fake liquidity generator.'”
reviewerMajor outlets including Halborn published coverage on 2025-01-30Outlets published across Jan 29 to Feb 5, not on a single day. Halborn's post is dated Feb 2025, which the page itself records in a later entry. The 'fake liquidity generator' wording is not confirmed as widespread. - #10[partially supported][awaiting moderator]in section: Victim Losses
“Solidus Labs research found that 98.6% of tokens launched on pump.fun eventually fail or become scams”
reviewerSolidus Labs found 98.6% of pump.fun tokens fail or become scamsThe 98.6% figure matches. 'Eventually' and 'become scams' loosen the report's wording. Note this section does not cite the Solidus URL.
confirmed
6 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“In January 2025, the platform suffered a supply-chain attack in which threat actors trojaned versions 1.6.3 through 1.6.6 with a Remote Access Trojan, draining an estimated $10 million from users' wallets”
reviewerVersions 1.6.3 through 1.6.6 were trojaned with a RAT in a January 2025 supply-chain attack, with an estimated $10 million drainedVersions and RAT are confirmed. The $10M figure is a community estimate, which the page hedges with 'estimated'. - #6[confirmed][no action needed]in the timeline
“Halborn Security publishes post-mortem analysis confirming supply-chain attack vector, RAT injection mechanism, and characterizing DogWifTools as infrastructure for wash trading and fake liquidity generation.”
reviewerHalborn publishes post-mortem in Feb 2025Date and content are broadly consistent. - #8[confirmed][no action needed]in the timeline
“DogWifTools operators publicly attribute the compromise to a third-party actor who gained access via GitHub token; deny it is an internal rug pull.”
reviewerOperators attributed the compromise to a third party via a GitHub token and denied an internal rug pullConsistent with BleepingComputer, published 2025-01-29. - #9[confirmed][no action needed]in the timeline
“A group calling itself 'Jizzy Group' publishes a manifesto on a dark web onion site claiming responsibility for the attack”
reviewerJizzy Group published a manifesto on an onion site framing the attack as vigilante justice against scammersManifesto confirmed. Rekt names Jizzy as 'one alleged perpetrator', which suggests attribution is not settled. - #11[confirmed][no action needed]in section: Manipulation Tactics
“'hides your sub wallets from appearing on the Photon graph'”
reviewerBundler documentation describes Experimental mode hiding sub wallets from Photon, Dump All, and holder count inflationDocumentation features match. The page's characterization as wash trading and pump-and-dump tooling is the page's own interpretation, though ZachXBT and Halborn support the general view. - #12[confirmed][no action needed]in section: Manipulation Tactics
“Blockchain investigator ZachXBT noted that the bundler 'discreetly holds a large quantity of the launched coin'”
reviewerZachXBT said the bundler 'discreetly holds a large quantity of the launched coin' and the volume bot inflates activityThe 'fake liquidity generator' label attributed to ZachXBT in the On-Chain Evidence section was not seen in the fetched text and is unverified.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.