The top serial scammer wallet in our database - 0xedb43ebf3306dce578d24b0555240d07e4778afc - has shipped 27 contracts. 24 of them are confirmed scams. That is an 88.9% scam rate from a single address.
Right behind it: 0x6f4c892a…3106 with 13 deploys, all 13 scams, 100% scam rate. Then 0xbcf3120d…66c6 with 27 deploys / 12 confirmed scams. Ten different wallets in the top ten with at least 5 confirmed rugs each. The full list with live etherscan links is at /serial-scammers.
This post is what those wallets have in common, why they keep working despite being trivial to spot on-chain, and what the boring detection pipeline behind RektRadar actually checks for before flagging them.
Why a “serial scammer” is not a metaphor
Crypto Twitter uses “serial scammer” loosely. We use it as a hard threshold: a wallet that has deployed at least three confirmed scam tokens (each scoring ≥80/100 on RektRadar’s risk model). That gives us 9 wallets in our top-tier serial_scammer flag, and another 30+ in the softer previous_scam_tokens band.
The thresholds are deliberately blunt. Past behavior is the strongest predictor of future behavior on-chain. A wallet that has rugged once may have made a mistake. A wallet that has rugged three times is running a business. The unit economics are too favorable for a serial scammer to stop voluntarily - even a single rug from a $50K liquidity pool is more profitable than most legitimate launches.
The pattern across all 10 wallets
Looking at the top 10 wallets in our database:
| Wallet | Total deploys | Scams | Scam rate |
|---|---|---|---|
0xedb43ebf…78afc | 27 | 24 | 88.9% |
0x6f4c892a…3106 | 13 | 13 | 100% |
0xbcf3120d…66c6 | 27 | 12 | 44.4% |
0x1e50d325…e7fb | 9 | 9 | 100% |
0xfb9c5d25…dbd9e | 8 | 8 | 100% |
0xcbac80c4…2798 | 7 | 7 | 100% |
| 4 more | ~5 each | ~5 each | 100% |
Six of the ten wallets have a 100% scam rate. They have never deployed anything that wasn’t a rug. Not “tried legitimately and pivoted” - every contract that left the wallet was a scam.
The other four have a “production line” pattern: more total deploys, lower scam rate. The deployer ships some legitimate-looking tokens to season the wallet’s history, then drops the rugs. Aggregate scam rate stays around 50-90% but no individual deploy looks suspicious in isolation.
Zooming out: top 12 deployer wallets by ship count
The wallets above are the most-flagged ones (≥3 confirmed scams), but they are not the most prolific. Sorting our database by raw ship count regardless of scam rate surfaces a different picture - operators that ship 100+ contracts with mixed risk profiles:
Three observations from this chart:
- Scale of organized operations. A single wallet with 100+ ships is operating at industrial scale. Even at 42% scam rate,
0x60e997de…4a72represents 46 confirmed rugs from one address - more than entire scam factories from a few months back. - 100% rate at high volume is real.
0xfa3e5c98…a620shipped 116 contracts and not one is clean. Same for0xf8dcf844…e911(39/39) and0x76dfda28…9fcd(34/34). These are not “experimenters that occasionally rugged”; these are dedicated scam factories. - The mixed-rate wallets are the scariest. Operators like
0x60e997de…4a72(108 ships / 46% scam) and0x146cc769…d557(44 ships / 50%) deliberately interleave clean tokens with rugs to confuse detection - making each individual ship look more legitimate while the aggregate keeps draining buyers.
The wallet network behind any of these deployers (every funded address, every secondary deployer) is what the 3D explorer renders in one image - the alternative being to click through 100+ Etherscan pages.
What the rugs themselves look like
We pulled three slices of detection signals from the 24 confirmed scams shipped by 0xedb43ebf…:
The contract pattern. 22 of 24 had creator_holds_all_lp (the deployer wallet held >95% of LP tokens at scan time, ready to pull). 18 of 24 had mass_deployer_network (their funding chain leads back to a wallet that itself meets the mass-deployer threshold). Half had mixer_funded - Tornado Cash withdrawal somewhere in the funding history.
The launch pattern. All 24 had liquidity_at_creation - the deployer added the initial liquidity in the same block as the contract deploy. 19 of 24 had single_mint_concentrated - the entire token supply minted in one transaction to one address. The deployer is in full control from block 1.
The exit pattern. 11 of 24 had a high_sell_fee flag (30-50% sell tax) at the moment of analysis. The contract was operationally a soft rug before the actual rug fired. Buyers paid 30-50% on every exit, which goes straight to the deployer’s wallet - the operator profits even from holders trying to escape, before the LP gets pulled.
None of this is exotic. Every one of these flags is documented at /signals, with what the flag means, why it matters, and how RektRadar detects it on-chain.
Why retail keeps falling for it
The pattern is so obvious that it raises the obvious question: how does this keep working? Three reasons we see in our data:
1. The address is fresh every time. Even when the funding wallet is shared, the deployer wallet rotates. Each new deploy is from a wallet with no on-chain history. To a casual buyer pulling up Etherscan, it looks like a new project from a new team. Without graph traversal - following the funding edges back through 3-5 hops - the connection is invisible.
2. The simulation passes on day 1. Honeypot checkers that only check the buy-sell simulation flow at scan time miss the soft rug. A 5% sell fee passes. A _maxSell modifier passes. A blacklist mapping passes if no addresses are in it yet. The contract is technically tradable on day one. The rug fires when liquidity has accumulated enough to be worth pulling.
3. The marketing pre-empts the analysis. A new memecoin lands in the trading channels with a chart, a meme, a pre-built community. Retail buys before anyone tabs out to look at the deployer’s history. The 10-second sanity check loses to the 30-second hype window.
Detection has to happen before the buy decision, not after. That is why we ship a Discord bot that surfaces the same analysis inside the channels where the buying actually happens, and why the 52 risk flags are all documented as their own pages so a single Google search on “honeypot detection ethereum” finds the right answer.
The numbers behind RektRadar today
To put one wallet in context, the database currently tracks:
- 38,976 tokens analyzed
- 3,587 confirmed scams (9.2% of all tokens)
- 34,789 deployer wallets mapped on-chain
- 9 wallets flagged
serial_scammer(≥3 confirmed rugs) - 494 deployer clusters identified by graph traversal
- 10,068,027 funding edges in the deployer graph
The 88.9% wallet is not a hand-picked anomaly. It is the top of a long tail with the same pattern repeating. The detection signals that flag them are documented at /signals/serial_scammer, /signals/mass_deployer, /signals/mixer_funded.
If you trade on-chain, the cheapest defense is ten seconds of “who deployed this contract, and what else have they shipped” before the buy. RektRadar runs that check for free at app.rektradar.io - paste any contract address, get the deployer’s track record, the cluster they belong to, and the specific flags that fired, in under 10 seconds.
The serial scammer pattern keeps working because retail keeps not checking. The pattern itself is dull.
Browse every flagged contract by ticker on the RektRadar scam catalog, or paste any contract address on app.rektradar.io for a free 0-100 risk score.