Verify a decision

{"actor":"system:backfill","investigation_id":"303d00d8-9a1f-4eed-808a-e55ec6fdc9b2","kind":"publish","page_slug":"5clyzcra2e8p3nhnrrss2w5nkhzj5wgmqcf8zyd3prd7","published_at":"2026-05-28T08:10:40.007Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"5CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7","sections":[{"content":"The address 5CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7 is owned by the Solana System Program (11111111111111111111111111111111), confirming it is a standard externally-owned wallet account (EOA), not an SPL token mint, program account, or smart contract. The address holds a current balance of 0.001 SOL (1,000,000 lamports) as of May 2026. It is not listed on DexScreener, Jupiter's token list, Raydium, or CoinGecko, and no token mint metadata has been associated with it. The wallet was first active on 2024-05-04 and last seen active on 2025-11-28, spanning approximately 572 days.","heading":"Address Type and On-Chain Identity","severity":"low","sources":[{"credibility":1,"name":"Solana mainnet RPC — getAccountInfo response confirming System Program owner","type":"on_chain","url":"https://api.mainnet-beta.solana.com"},{"credibility":2,"name":"DexScreener API — empty pairs response for address","type":"on_chain","url":"https://api.dexscreener.com/latest/dex/tokens/5CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7"},{"credibility":2,"name":"Jupiter Tokens API — 404 not found for address","type":"on_chain","url":"https://api.jup.ag/tokens/v1/token/5CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7"}]},{"content":"The dominant activity pattern observed across this wallet's 643 on-chain transactions is receipt of 1-lamport (0.000000001 SOL) transfers. These micro-transfers originate from batch-sending wallets that distribute tiny amounts to 15-20 addresses simultaneously in a single transaction. The primary identified sender is 5Hr7wZg7oBpVhH5nngRqzr5W7ZFUfCsfEhbziZJak7fr, which repeatedly fan-out-transfers 1 lamport to large groups of wallets. A second batch sender, fLiPgg2yTvmgfhiPkKriAHkDmmXGP6CdeFX9UF5o7Zc, follows the same pattern. This behavior is consistent with blockchain dusting attacks — a technique used to de-anonymize wallet holders by sending negligible amounts that, when combined with future on-chain activity, can be used to cluster wallet identities. The wallet itself is the recipient of this activity, not the perpetrator. The peak dusting period was October–November 2024 (399 transactions combined), with a secondary cluster in August 2024 (83 transactions).","heading":"Dust Attack Pattern — Inbound 1-Lamport Transfers","severity":"medium","sources":[{"credibility":1,"name":"Solana RPC getTransaction — 2024-11-22 batch dust transfer from 5Hr7wZg7... to 20 wallets","type":"on_chain","url":"https://solscan.io/tx/5N6CW4XcGjvZuR7WkT3TduymcW2KbhvJgzRM7oLQuVZDciT7y4h1b5EPeExcH9LstzWtkgydwuCSoVJHvtboHiwa"},{"credibility":1,"name":"Solana RPC getTransaction — 2025-03-25 batch dust from fLiPgg2y... to 19 wallets","type":"on_chain","url":"https://solscan.io/tx/456MgkFEUL2vNG5EADcj7VBhRfaaEDrjuqhuodiqUD1BGY4jouYQLy5JGtaNZqkbjccPBVCiT9Tu3iT14nXJyWoy"},{"credibility":2,"name":"Trezor — Dusting attacks and airdrop scam tokens explained","type":"research","url":"https://trezor.io/support/troubleshooting/coins-tokens/dusting-attacks-airdrop-scam-tokens"}]},{"content":"During October and November 2024, the wallet received unsolicited SPL token transfers from the address dropscrGqxKZjMh9amnHYwL9qmu4FhEQdC1cSRgz7My, which created token accounts on behalf of the wallet and deposited quantities of token BmhzXVpRX6nyF4fjBKZiaxrGybtcRHxCpg5d2NjdvBwr (3,353 units, 7 decimals, total supply of approximately 491 trillion units, with no active freeze or mint authority). This token has no retrievable Metaplex name metadata via standard on-chain lookup, no DEX trading pairs on DexScreener, and no listing on major price aggregators. The airdropping wallet's vanity-style prefix 'dropscr' is consistent with mass airdrop distributor tooling. Unsolicited token airdrops of this type are a documented vector for social engineering, where recipients are lured to visit malicious websites to 'claim' or 'sell' the tokens, potentially exposing private keys or approving malicious transactions. The wallet subsequently closed its token accounts holding these airdropped tokens in March 2025 using a sweep program (F6fmDVCQfvnEq2KR8hhfZSEczfM9JK9fWbCsYJNbTGn7), reclaiming rent and transferring reclaimed SOL to the system burn address.","heading":"Unsolicited SPL Token Airdrops","severity":"high","sources":[{"credibility":1,"name":"Solana RPC getTransaction — Oct 2024 token transferChecked from dropscrG... airdropper","type":"on_chain","url":"https://solscan.io/tx/2bHre4KK1gr8GM54hUK57Tcajfpakzvwvdiz7AZnW4Zz9q4PJPPuwk4ULLhq1cUBxaGcrFykBvsb7LCpe3N6xJH2"},{"credibility":1,"name":"Solana RPC getAccountInfo — Token BmhzXVpRX6nyF4fjBKZiaxrGybtcRHxCpg5d2NjdvBwr: mint with no authority, ~491T supply","type":"on_chain","url":"https://api.mainnet-beta.solana.com"},{"credibility":1,"name":"FBI — Warning on cryptocurrency token impersonation scams","type":"regulatory","url":"https://www.fbi.gov/contact-us/field-offices/denver/news/fbi-warns-of-cryptocurrency-token-impersonation-scam"},{"credibility":2,"name":"Uniswap Labs — Unsellable token scams explainer","type":"research","url":"https://support.uniswap.org/hc/en-us/articles/17523088290573-Unsellable-token-scams"}]},{"content":"The wallet's own outbound activity consists of several modest SOL transfers. On 2024-05-04 it received an initial funding of 50,000,000 lamports (0.05 SOL) from 8jg1zLWDrut8jqkkP5movomeorucCCd4rf2MbzddT3di. On 2024-08-30, the wallet itself signed a transaction sending 40,000,000 lamports (0.04 SOL) to AVE8uY1ES3RF5thrYvirnjGcmRB62xdDEKF4Yf8CiQDc. On 2025-08-30, it sent 4,920,002 lamports to LVQ2G6AzBP1sjg1h4Fjgq83P6bRHP39jMJxWMvQ1dxm, and on 2025-10-09 it sent 4,000,000 lamports to EVpVZ5gnr6UfEn8ZzMvYSDChth5GZGaUXZRgV6S6TgPi. These amounts are small (under 0.05 SOL each), consistent with a low-value operational wallet rather than a high-value fund or exchange wallet. No large-volume SOL movements have been identified.","heading":"Outbound SOL Transfers and Wallet Funding","severity":"low","sources":[{"credibility":1,"name":"Solana RPC getTransaction — 2024-05-04 funding tx (50M lamports inbound)","type":"on_chain","url":"https://solscan.io/tx/A2TZJBKvkfTshUKEETkUn7zCtxwEz2q4sPtKfLSJHkGEJpDQ9jHUHdJKYAkx5M3KUhqUVJKMA8HUZnm1wDArVpw"},{"credibility":1,"name":"Solana RPC getTransaction — 2024-08-30 outbound transfer (40M lamports)","type":"on_chain","url":"https://solscan.io/tx/ZLDMY1DYX4VioyxxkxwtYPGvQT9rTsXXQGBLgVJArppMdpXBBx4qcHebyQ7zq5KD4pqm4AxWkmQeAai8XtcakHd"}]},{"content":"On 2025-11-28, the wallet received an unsolicited compressed NFT (cNFT) minted via the Metaplex Bubblegum program (BGUMAp9Gq7iTEuizy4pqaxsTyUCBK68MDfK752saRPUY) and the Solana State Compression Merkle tree program (cmtDvXumGCrqC1Age74AVPhSRVXJMd8PJS91L8KbNCK). The Leaf asset ID was Bf6BVRnEMArT6igfJQuALQhwXEqyzeGz9aYAyYq7Eitk. The minting was paid for by HnT5KVAywGgQDhmh6Usk4bxRg4RwKxCK4jmECyaDth5R. Unsolicited cNFT airdrops have been used in phishing campaigns where the NFT image or metadata contains a malicious URL enticing recipients to connect their wallet to a drainer site. The identity and intent of the minter cannot be confirmed from on-chain data alone.","heading":"Compressed NFT Airdrop","severity":"medium","sources":[{"credibility":1,"name":"Solana RPC getTransaction — 2025-11-28 cNFT MintV1 via Bubblegum","type":"on_chain","url":"https://solscan.io/tx/2o6eNfJdXfTrrvRaLSPVYbjch41rqhNJM7z7winQsWfuKK5CDZjpf84VdyGcLPPHyji1X1Xr3FJigog4eaKDPcyz"}]},{"content":"No public mention of address 5CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7 was found in web search results, crypto news outlets (CoinDesk, The Block, Decrypt), SEC EDGAR, CFTC enforcement records, DOJ press releases, or community fraud databases such as ChainAbuse or ScamAlert at the time of this investigation. The address does not appear to be associated with any named protocol, token project, exchange, or individual. Its absence from indexing databases (DexScreener, Jupiter, Raydium, CoinGecko) is consistent with it being an ordinary wallet rather than a project-affiliated address.","heading":"Absence of Public Fraud Reports or Regulatory Records","severity":"low","sources":[{"credibility":3,"name":"Web search — no results for quoted address string","type":"other","url":"https://www.google.com/search?q=%225CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7%22"}]}],"sources_used":[{"credibility":1,"name":"Solana mainnet public RPC — getAccountInfo, getSignaturesForAddress, getTransaction, getBalance","type":"on_chain","url":"https://api.mainnet-beta.solana.com"},{"credibility":2,"name":"DexScreener API — token search returned no pairs","type":"on_chain","url":"https://api.dexscreener.com/latest/dex/tokens/5CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7"},{"credibility":2,"name":"Jupiter Tokens API v1 — 404 not found","type":"on_chain","url":"https://api.jup.ag/tokens/v1/token/5CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7"},{"credibility":2,"name":"Raydium mint IDs API — null data returned","type":"on_chain","url":"https://api-v3.raydium.io/mint/ids?mints=5CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7"},{"credibility":2,"name":"Trezor Support — Dusting attacks and airdrop scam tokens","type":"research","url":"https://trezor.io/support/troubleshooting/coins-tokens/dusting-attacks-airdrop-scam-tokens"},{"credibility":1,"name":"FBI — Cryptocurrency Token Impersonation Scam Warning","type":"regulatory","url":"https://www.fbi.gov/contact-us/field-offices/denver/news/fbi-warns-of-cryptocurrency-token-impersonation-scam"},{"credibility":2,"name":"Uniswap Labs Help — Unsellable token scams","type":"research","url":"https://support.uniswap.org/hc/en-us/articles/17523088290573-Unsellable-token-scams"}],"summary":"5CLYzCRa2E8p3NHNrRSs2w5NkHzj5WGmqCF8zYd3PRD7 is a standard Solana wallet account (owned by the System Program), not a token mint. On-chain data shows 643 transactions between May 2024 and November 2025, predominantly consisting of inbound 1-lamport dust transfers sent by automated batch senders to groups of 15-20 wallets simultaneously, and inbound unsolicited SPL token airdrops from a known mass-distributor address. The wallet has also sent modest outbound SOL transfers and closed its own token accounts using a sweep program. No association with a named project, DEX listing, or public fraud report has been identified.","timeline":[{"date":"2024-05-04","event":"Wallet first appears on-chain; receives 50,000,000 lamports (0.05 SOL) from address 8jg1zLWDrut8jqkkP5movomeorucCCd4rf2MbzddT3di in funding transaction.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/A2TZJBKvkfTshUKEETkUn7zCtxwEz2q4sPtKfLSJHkGEJpDQ9jHUHdJKYAkx5M3KUhqUVJKMA8HUZnm1wDArVpw"},{"date":"2024-05-04","event":"57 transactions recorded in June 2024, predominantly inbound dust transfers from batch-sender wallets.","source":"Solana mainnet RPC transaction history","source_url":"https://api.mainnet-beta.solana.com"},{"date":"2024-08-19","event":"Wallet involved in transactions alongside high-value counterparty NTYeYJ1wr4bpM5xo6zx5En44SvJFAd35zTxxNoERYqd (current balance ~70,833 SOL); relationship and context unclear.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/3JoHbiq65WqrSVQYfM1TJogDKFXz7KKSvgGDnHMxUTdKdUqpjbUEUENmi8SPd6SvuPvaXAmCKvMGbc5J7jpjrZVE"},{"date":"2024-08-30","event":"Wallet sends 40,000,000 lamports (0.04 SOL) outbound to AVE8uY1ES3RF5thrYvirnjGcmRB62xdDEKF4Yf8CiQDc.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/ZLDMY1DYX4VioyxxkxwtYPGvQT9rTsXXQGBLgVJArppMdpXBBx4qcHebyQ7zq5KD4pqm4AxWkmQeAai8XtcakHd"},{"date":"2024-10-01","event":"Peak dust-transfer and airdrop activity begins; 156 transactions in October 2024 alone, predominantly inbound dust and unsolicited SPL token airdrops from dropscrGqxKZjMh9amnHYwL9qmu4FhEQdC1cSRgz7My distributing token BmhzXVpRX6nyF4fjBKZiaxrGybtcRHxCpg5d2NjdvBwr.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/2bHre4KK1gr8GM54hUK57Tcajfpakzvwvdiz7AZnW4Zz9q4PJPPuwk4ULLhq1cUBxaGcrFykBvsb7LCpe3N6xJH2"},{"date":"2024-11-01","event":"Highest activity month: 243 transactions, dominated by batch 1-lamport dust transfers from 5Hr7wZg7oBpVhH5nngRqzr5W7ZFUfCsfEhbziZJak7fr sending to groups of 15-20 wallets simultaneously.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/5N6CW4XcGjvZuR7WkT3TduymcW2KbhvJgzRM7oLQuVZDciT7y4h1b5EPeExcH9LstzWtkgydwuCSoVJHvtboHiwa"},{"date":"2025-01-24","event":"Wallet involved in a batch 1-lamport transfer to 20 addresses; activity begins tapering after November 2024 peak.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/2PHy2cyPeGeRUsYEgA4V9gnC3mwfgxM1kQAHAYyhj1Q7aTDU7KDHAmpj5krQJAqWbyXSzmLFtCSZ7uKXcmmk3geo"},{"date":"2025-03-25","event":"Wallet closes 3 SPL token accounts using sweep program F6fmDVCQfvnEq2KR8hhfZSEczfM9JK9fWbCsYJNbTGn7, reclaiming rent-exempt lamports and forwarding reclaimed SOL to the burn address burn68h9dS2tvZwtCFMt79SyaEgvqtcZZWJphizQxgt. This is consistent with clearing unsolicited airdrop token accounts.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/3kiD4PETWR9xMJ8fs4odTiq4pr8reHCH3M7SuVTB7UUxDMG6Lyuhd3rpf7bFy3VRzZySSJ6qZgpaqjoQmuMusjxL"},{"date":"2025-08-30","event":"Wallet sends 4,920,002 lamports outbound to LVQ2G6AzBP1sjg1h4Fjgq83P6bRHP39jMJxWMvQ1dxm.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/3PXJwkQ86Nbasz2BN74oCBxUSuQDFdVC4V5PBKXxr7xptjLirXdWWQoEKYCWtm5MXqPkc3n8h13NRTpLchpBsnN"},{"date":"2025-10-09","event":"Wallet sends 4,000,000 lamports outbound to EVpVZ5gnr6UfEn8ZzMvYSDChth5GZGaUXZRgV6S6TgPi.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/319S343epSwFBPMN8tK7tKuga9Wtpz7KkeHx2JmMnZ4pvSWumHDzkAFQ7mKZtJ95pkM43qMTUShCtTnKyw5UL8iY"},{"date":"2025-11-23","event":"Wallet receives another inbound dust/batch transfer.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/3PZgppYgwvBhVv2mcVrGGPT3gMt2hhhRY3vdQZHPVmDoRVAANCW6hpwLcQMo1efLAiBKic4kFSPWwm6DftcXC7gf"},{"date":"2025-11-28","event":"Most recent transaction: wallet receives an unsolicited compressed NFT (cNFT) minted via Metaplex Bubblegum by HnT5KVAywGgQDhmh6Usk4bxRg4RwKxCK4jmECyaDth5R; Leaf asset ID Bf6BVRnEMArT6igfJQuALQhwXEqyzeGz9aYAyYq7Eitk.","source":"Solana mainnet RPC","source_url":"https://solscan.io/tx/2o6eNfJdXfTrrvRaLSPVYbjch41rqhNJM7z7winQsWfuKK5CDZjpf84VdyGcLPPHyji1X1Xr3FJigog4eaKDPcyz"}]},"v":1}