Meme Coin Factories: Uncovering Large-Scale Manipulations on pump.fun

Abstract: Once complex, creating and deploying a new cryptocurrency has become trivial. Coin launchpads now allow users to generate a new coin with merely a few clicks, at a minimal cost. Launchpad popularity has grown in tandem with the rise of "meme coins," which usually do not offer any novel technological properties and are purely created for fun. The most prominent coin launchpad, pump.fun, has gained significant traction, grossing over 100 million USD in daily trading volume. The mass adoption of coin launchpads, however, also enables strategic actors to easily manipulate trading signals, unbeknownst to inexperienced traders who then buy certain coins, and enable these strategic actors to profit from rapid and unsustainable price increases ("pumps"). To identify such manipulations at scale, we conduct a large-scale study of pump.fun, collecting information on all 15 million coins launched in the last two years, and performing analysis on large, random samples of transaction data. We identify five classes of manipulation strategies: 1) wash trading, 2) creator address obfuscation, 3) coordinated sell, 4) copycat coins, and 5) social media manipulation. We find that strategic actors often bypass the platform interface and implement these strategies in a highly automated and low-latency fashion, by interacting directly with the blockchain. We further uncover the existence of "Market-Manipulation-as-a-service (MMaaS)," third-party tools that enable users to perform these manipulations without any technical expertise. We conclude by devising mitigations and proposing recommendations for traders, pump.fun, wallets or chain scanners, software development platforms, and regulators.

• The paper uncovers large-scale market manipulations in the pump.fun ecosystem using a multimodal detection approach, particularly focused on addressing hash trading transactions.
• Nearly 18% of trading transactions are identified as manipulative, with high activity and wash trading associated with higher graduation rates.
• The top 1% of creator addresses produce 58.57% of all coins, revealing a high concentration of coin creation within a few large groups.

Study scope and research design

“Meme Coin Factories: Uncovering Large-Scale Manipulations on pump.fun” (2609.10246) presents a measurement study of market manipulation in the pump.fun ecosystem. The paper treats manipulation as the fabrication of trading, ownership, semantic, or social signals intended to increase a coin’s visibility, attract uninformed traders, and enable subsequent profit extraction. Its central claim is that the launchpad’s low-cost, pseudonymous, and highly automated architecture has transformed manipulation from an account-level activity into an infrastructure-mediated production process.

The empirical scope is unusually large. The authors identify 15,245,966 coins launched between January 14, 2024 and January 14, 2026, recover metadata for 15,183,009 of them, and analyze creator-address funding relationships involving 5,826,346 unique creator addresses. Because complete transaction retrieval for every coin is impractical, they construct two transaction datasets: a uniform random sample containing 152,171 coins and 49,970,921 transactions, and a five-day sample containing 149,028 coins and 37,350,061 transactions. The five-day sample includes both unusually high- and low-activity days and is used primarily as a consistency check.

The study combines deterministic on-chain heuristics, graph analysis, metadata matching, external-platform analysis, manual qualitative annotation, and price-based estimates of extractable value. This multimodal design is important because no individual signal is sufficient: a single high-volume transaction may be legitimate, while coordinated address funding, atomic buy-sell execution, duplicated metadata, and synchronized social activity provide mutually reinforcing evidence.

pump.fun uses Solana bonding curves before transferring sufficiently successful coins to external decentralized exchanges. The paper defines this transfer as “graduation”; only 1.02% of coins in the sample graduate. Graduation is therefore used as a coarse measure of market success rather than as a direct measure of profitability or legitimacy.

A taxonomy of manipulation

The paper identifies five principal manipulation classes:

1. wash trading;
2. creator-address obfuscation;
3. coordinated selling;
4. copycat coin deployment; and
5. social-media manipulation.

The authors additionally document Market-Manipulation-as-a-Service (MMaaS): websites and software repositories that package low-latency execution, multi-wallet management, token copying, social-media monitoring, automated commenting, and anti-detection features into accessible tools.

The strategies are not independent. A single campaign may use multiple creator addresses, launch a copycat coin, generate artificial trades and comments, promote the coin through an external community, and consolidate holdings before selling. This interaction is a substantive contribution of the paper: manipulation is characterized not as a collection of isolated abuses, but as a composable operational pipeline implemented directly against the blockchain.

Wash trading and the relationship with graduation

The strongest quantitative evidence concerns wash trading. The conservative heuristic, WT1, flags a transaction when the same address buys and sells the same quantity of the same coin against the same bonding curve within one atomic transaction. Because pump.fun’s web interface does not support this operation, WT1 specifically identifies activity requiring direct blockchain interaction, typically through a custom program or smart contract. The broader WT2 heuristic permits the buy and sell to occur across a time window and therefore has a higher false-positive risk.

In the 1% sample, WT1 identifies 2,221,734 transactions affecting 8.26% of coins. Across both transaction samples, the authors report a lower bound of approximately four million wash-trading transactions, corresponding to 17% of all trading transactions. The five-day sample independently yields 1,804,378 WT1 transactions affecting 6.07% of coins, supporting the broad prevalence estimate.

The distinction between transaction count and transaction volume is analytically important. Wash trading accounts for a substantially larger fraction of transactions than of SOL volume. The authors argue that manipulators prioritize repeated low-volume trades because pump.fun fees are tied to trading volume, making many small transactions less costly than a smaller number of large trades.

WT2 illustrates the danger of relaxing behavioral heuristics. With a five-second buy-to-sell window, it identifies wash-trading activity in 44.05% of coins in the 1% sample; with a one-day window, the fraction rises to 88.5%, while the number of candidate transactions does not increase proportionately. The divergence indicates that long temporal windows primarily add false positives rather than uncovering large amounts of additional manipulation.

Figure 1: WT1 and WT2 wash-trading transaction counts and SOL volume across buy-to-sell time thresholds.

The paper reports a strong association between WT1 activity and graduation. Coins with any conservative wash-trading activity graduate at a rate of 2.0%, compared with 0.90% for coins without detected WT1 activity. The gradient is more pronounced at higher levels of activity: coins with more than 500 WT1 transactions graduate at 9.64%, compared with 0.90% among coins with none. A logistic regression estimates that, among coins with substantial wash-trading activity, doubling the number of wash-trading transactions increases graduation odds by approximately 19% with a reported $p$-value of $3 \times 10^{-59}$.

This result establishes association, not a clean causal effect. More successful coins may naturally attract more trading, and the heuristic may detect activity generated after a coin has already gained attention. Nevertheless, the monotonic relationship is consistent with the paper’s threat model: artificial transaction activity can improve ranking or visibility, thereby increasing the probability of attracting external traders.

https://dummyimage.com/1x1/ffffff/ffffff

Creator-address obfuscation and production concentration

The creator-address analysis challenges the interpretation of wallet counts as creator counts. The authors construct a directed funding graph and link creator addresses through common funders over one, two, and three hops. Addresses labeled as exchanges, bridges, or other third-party services are removed to reduce spurious aggregation.

At the three-hop level, 3,203,502 addresses are assigned to multi-address clusters. Clustering reduces the apparent number of distinct creators by roughly eleven times for addresses included in multi-address clusters. The largest one-hop cluster contains 10,531 addresses, while the median multi-address cluster contains three addresses.

The concentration results are particularly strong. The top 1% of individual creator addresses produce 38.89% of all coins. After three-hop clustering, the top 1% of creator clusters produce 58.57% of all coins. Under the one-hop setting, multi-address clusters account for 62.99% of all coins despite representing 48.02% of creator addresses.

Figure 2: The share of coins produced by the most active creator clusters.

The implication is that creator-level statistics based on raw addresses materially understate organizational concentration. Many addresses may represent a common operator, factory, or service rather than independent participants. The paper’s adversarial deletion analysis strengthens this interpretation: after removing the address whose deletion most damages connectivity, the largest remaining component retains a median of 80.4% of cluster addresses and 89.4% of coin output among the top 1% of clusters. Thus, concentration is not usually explained by one accidental bridge address alone.

The method nevertheless rests on a common-funder assumption. Shared funding can reflect a service provider, exchange, privacy practice, or unrelated operational relationship rather than common control. The authors address this concern through service-label filtering and robustness checks, but on-chain clustering cannot establish legal or organizational identity.

Coordinated selling and address reuse

The coordinated-selling analysis identifies campaigns in which multiple sender addresses transfer tokens to a common dumper address, which then sells the received tokens. DP1 requires the transfers and sale to occur atomically in one transaction, while DP2 permits a temporal window and is therefore more inclusive but less specific.

DP1 detects 4,402 dumps in the 1% sample. DP2 identifies 9,270 events with a five-second window, 66,706 with a one-hour window, and 88,730 with a one-day window. The rapid increase under DP2 demonstrates the same precision-recall tradeoff observed for WT2. Under DP1, the median number of senders is seven; the five-day sample includes an extreme event involving 312 senders.

Figure 3: Coordinated-selling instances under DP1 and DP2 across temporal thresholds.

The sender-dumper network reveals repeated reuse of both sender and dumper addresses. This pattern is inconsistent with isolated, independent transfers and instead suggests an operational infrastructure reused across campaigns.

Figure 4: Sender-dumper transfer networks for the two largest DP1 clusters.

The conservative DP1 events involve 33,393 SOL of sales in the 1% sample. Using the authors’ stated SOL price range, this corresponds to an estimated $2.5 million to$5 million in transaction volume. This is a volume estimate rather than a profit estimate: it does not account for acquisition costs, price impact, fees, or the possibility that some coordinated sellers were not net profitable.

Copycat coins and automated deployment

The copycat analysis matches coin names, symbols, descriptions, and profile images. The strictest heuristic identifies 1,490,123 copycat coins, more than 10% of all coins. A less restrictive heuristic identifies 1,866,178 coins, while matching only names and symbols produces 5,392,081 candidates. The paper uses the strictest estimate because the broadest heuristic includes substantial ambiguity and potential false positives.

The contrast between original coins and copycats is pronounced. Original coins have a 9.20% graduation rate, compared with 0.86% for copycats and 1.02% for all coins. This does not mean that copycat deployment is generally successful. Rather, it indicates that highly visible or successful originals are more likely to be copied. The original therefore functions as a signal of attention, while the copycat competes for the same user demand.

First-mover effects decay quickly. In groups containing at least nine copycats, earlier coins are more likely to graduate, but the advantage diminishes rapidly with arrival order. Copycats nevertheless account for 17.7% of graduated coins. Only 2,613 copycat groups, or 0.40% of all groups, contain multiple graduated coins, showing that most groups yield at most one successful outcome.

Figure 5: Graduation likelihood by arrival order and the number of graduated coins per original-copycat group.

The deployment mechanism provides evidence of automation. Since pump.fun’s standard interface generally produces addresses ending in “pump,” the authors use the absence of this suffix as a lower-bound indicator of direct blockchain interaction. The no-suffix rate is 13.7% for original coins and 26.5% for copycats, compared with a 16.05% baseline. The result supports the claim that copycat production is disproportionately automated, although vanity-address generation means the suffix is not a definitive classifier.

Social manipulation and external attention

The social analysis covers both comments embedded in pump.fun coin pages and links to Twitter, Truth Social, Telegram, and other platforms. In the 1% sample, the authors identify six tightly synchronized commenting clusters containing between five and 111 users. Users in these clusters post within 0.1 seconds of one another on multiple coin pages, and the graph structure remains stable when the timing threshold is increased to one second.

The textual content is often longer and more stylistically varied than simple repetitive spam. Comments include slang, typos, capitalization, positive claims, and occasional negative statements designed to mimic organic disagreement. The cross-cluster textual overlap suggests either reuse of common software and templates or a common operator. The authors appropriately leave this attribution unresolved.

Figure 6: Synchronized commenter clusters and textual similarity among clusters.

This result weakens moderation strategies based only on message sentiment or short positive phrases. Timing, account provenance, cross-coin participation, and wallet relationships may be more discriminative than linguistic content, especially when automated systems generate varied text.

The external-platform analysis finds 3,571,170 coins, or 23.5% of all coins, created shortly after 1,452,330 Twitter or Truth Social posts. The paper does not infer malicious intent merely from temporal proximity. Instead, it estimates extractable value for graduated coins under a hypothetical initial ownership of 10% of supply. Among 12,544 posts with positive estimated value, the median post is associated with 12 coins and $135 in aggregate extractable value. The distribution is highly skewed: 31 posts have estimated extractable value of at least$1 million, and those posts account for 83.4% of total estimated value.

The maximum reported post-level estimate is approximately $113.6 million. This is a model-based upper-bound-style estimate, not demonstrated realized profit. It assumes a fixed initial holding, uses daily price data, sets non-graduated coins’ value to zero, and cannot establish that the post author created or controlled the associated coin. The paper explicitly documents cases in which the original poster denied affiliation with the token.

The high-value posts are concentrated among visible accounts. Their median follower count is 42,600, with a range extending to 240 million, and their engagement levels substantially exceed the reported averages for ordinary Twitter posts. The associated content falls primarily into culture, news, and animal categories.

Figure 7: Examples of social-media posts associated with high-value coin creation.

Community-based activity displays a different pattern. Most linked groups generate very few coins, but the most active 0.1% generate at least 60 coins and can remain active for long periods. Some communities automatically create a coin when a new member joins; five of the ten most active Twitter communities exhibit this pattern, with an average no-suffix rate of 96.1%.

Interestingly, the most active communities are not the most successful. Some groups with approximately 100 attempts, little direct blockchain automation, and roughly 30-minute median creation intervals achieve graduation rates near 14%, approximately fourteen times the platform baseline. The relationship suggests that indiscriminate high-frequency issuance and aggressive automation can reduce, rather than increase, campaign success.

Figure 8: Community creation intervals, automation rates, and graduation outcomes.

Market-Manipulation-as-a-Service

The MMaaS analysis connects observed on-chain behavior to an enabling market. The authors identify four publicly accessible websites or applications that advertise at least two relevant capabilities. All advertise low-latency execution. Some also advertise multi-address creation, copycat deployment, real-time social-media monitoring, mixers, or vanity contract addresses.

The study also examines 29 GitHub repositories returned by a search for “pump fun comment bot” and confirms 14 repositories that advertise pump.fun comment automation. At least eight advertise fresh-wallet creation, four combine fresh and creator wallets to simulate organic interaction, six provide predefined comment sets, two use AI for comments or profiles, and ten advertise anti-detection mechanisms such as CAPTCHA solving or proxy rotation.

These findings support the paper’s “factory” interpretation: the expertise required to coordinate blockchain execution and social manipulation is increasingly packaged into reusable interfaces and software. The evidence is deliberately limited to advertised functionality. The authors neither purchase the services nor execute the repositories, so the analysis establishes availability and marketing claims rather than verified operational capability.

Limitations and open questions

The principal limitation is inferential. The manipulation detectors are heuristics, and only WT1 and DP1 are presented as especially conservative lower bounds. Even atomic buy-sell execution may not establish the full economic intent of an actor, while funding-based clustering cannot prove common ownership. The copycat method detects exact or near-exact metadata duplication but misses typosquatting, homographs, and visually similar images whose IPFS hashes differ.

The transaction analysis covers approximately 1% of coins plus five selected days rather than the complete transaction history of all 15 million coins. The five-day sample improves robustness but is not a substitute for full temporal coverage. Social-media evidence is also incomplete: deleted posts, private Telegram groups, inaccessible communities, and API limitations can produce selection bias.

Graduation is a coarse outcome measure. It captures crossing a bonding-curve threshold, not sustained liquidity, trader welfare, realized manipulator profit, or post-graduation performance. The regression linking wash trading to graduation controls and model specifications are not fully developed in the provided text, leaving open the extent to which the association reflects causality, reverse causality, or confounding by underlying attention.

Several numerical and presentation issues in the manuscript require clarification before the results can be independently interpreted. Some percentages and volume fields are missing or malformed in the supplied version, and the reported “17% of all trading transactions” should be reconciled explicitly with the sample denominators and the separate WT1 counts. The paper releases approximately 2 TB of on-chain data and analysis scripts, but cannot redistribute pump.fun website data because of its terms of use. Reproducibility is therefore stronger for blockchain analyses than for comments, metadata, and price-derived estimates.

The paper leaves specific questions open: how much of the observed activity is attributable to common operators versus independent users of shared MMaaS infrastructure; how manipulation changes after platform ranking or fee-policy interventions; and whether the proposed provenance and signal-integrity features reduce victim purchases without suppressing legitimate high-frequency activity.

Conclusion

The paper documents a large and technically sophisticated manipulation environment on pump.fun. Its most consequential measurements are the conservative detection of millions of wash-trading transactions, the concentration of 58.57% of coin creation in the top 1% of creator clusters, the identification of thousands of coordinated sells, the discovery of more than 1.49 million strict copycat coins, and the association of social-media activity with highly concentrated potential extractable value.

Its central implication is operational: trading volume, creator counts, comments, metadata, and social attention should not be treated as independent or trustworthy signals without provenance analysis. The combination of on-chain heuristics, funding-graph analysis, metadata comparison, temporal coordination, and external-platform linkage provides a concrete basis for detecting manipulation, while the documented MMaaS ecosystem explains how these capabilities are becoming accessible to actors without substantial technical expertise.