⚡ SMOKING GUN — SHARED BINANCE HOT WALLET ACROSS 3 CREW PROJECTS, 2.5 YEARS APART
One Binance hot wallet seeded MOSC, rico.sol, AND ASTy/jorgieboy — each via its own dedicated single-purpose burner relay. Same pattern, three projects, three years.
Withdrawals from 5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9 (Binance Hot wallet, community-labeled across multiple Solana-tagging databases) landed in the founding wallets of three GOTM-network projects across 2.5 years. Each withdrawal used a different fresh relay, but the procedural fingerprint is identical: Binance Hot → 2-tx burner relay → flagship wallet, ~6 minute round-trip each time.
| Date | Source | Relay (burner) | Destination (flagship) | SOL |
|---|
| 2023-12-05 | Binance Hot | D8pSxmPj…jBgL | MOSC staking admin | 1.54 |
| 2024-03-17 | Binance Hot | CGL1pTCj…tNkub | rico.sol chain | 0.392 |
| 2026-05-01 | Binance Hot | FEEmyu5h…pvfqy (only 2 txs ever) | ASTy / jorgieboy.sol | 10.14 |
Anchor txs (verifiable on any explorer):
Why this is the smoking gun: Binance Hot is real Binance plumbing — many users withdraw from it. ONE shared withdrawal would be coincidence. Three withdrawals to three different operator wallets, each via a fresh single-purpose 2-tx burner relay, across 2.5 years is procedural fingerprinting — that's how a single Binance KYC obscures itself across multiple projects over time. Combine with the X bio chain, the GOTM-crew NFT cross-ownership in Aevon top holders, the Florida geographic tells, and the 10-of-102 crew follow density on @AevonNFT, and the null hypothesis (independent operators) becomes statistically untenable.
PROOF B — FLORIDA CREW (PROVEN) + NEW PRINCIPAL @PurDayMon
UK "Ltd" is brand fluff. Operations are Florida-domiciled. One Northern California operator (Dak Daze) is the only verified non-FL crew principal.
- @jorgieboy X bio: display name "jorge", location literally "Miami, fl…for now!" — operator self-disclosure on a 17-year-old account whose follower-count was wiped to 0 before re-use
- thclabz.sol holds 4 floridaXXX.sol SNS domains (floridalife / floridaguy / floridaborn / floridaboy) — operator's own SNS portfolio is themed Florida
- 3 registered Florida LLCs: Puffsterz Smoke Shop · Blockchain Florida · Baraka/Artistic Charm
- DakDaze on stage at FX Summit Miami May 2022 (photo-evidenced)
- ~6 Florida handles in @AevonNFT's follower/follow circle (@DrewRoberts Orlando, @DevDad Miami, @KristenKKCook South FL, @MarkiiiWeb3 FL Spaces Host, @JCmeta Miami, @SolDapper Palm Beach)
- UK Companies House: no record for "GOTM Labz Ltd" — the UK styling is marketing, not domicile
⚡ NEW CREW PRINCIPAL NAMED THIS PASS
@PurDayMon — X bio location "Florida, USA", self-declared "GRAND DON of @RilegatoDAO and the @Omerta_SOL $EMPIRE." Holds MOB Collective #47535 (direct chain-layer overlap with the crew NFT pool). @PurDayMon is the operator behind the 5-collection $Empire ring (xbWUT2Z3… deployer): Caporegime · Capolavoro · Don's · SOLdier's · Rilegato — all minted via Launchmynft.io, all paid the 33nQ fee. Newly added to the documented Florida roster.
CA caveat: @dak_daze (BASC CEO) is photo-evidenced in Northern California / Redwoods (Sept 18 2023). One CA operator. The rest of the verifiable principals land in Florida. UK / NV mentioned by crew on voice spaces but not corroborated by registry, chain, or SNS evidence.
PROOF C — 10/10 GOTM CREW HANDLES INSIDE @AEVONNFT'S 102-FOLLOW LIST
A project account from an independent operator does not include this exact bouquet of GOTM/BASC inner-circle handles.
Audit of promoters-following-102.json confirmed @AevonNFT (102 follows total) directly follows ALL of the following crew handles:
@moon_blaze_ (Rico, GOTM founder)
@dak_daze (BASC CEO)
@thc_labz
@frens_factory
@smythsnft
@jimye_
@jikannians
@nftsonjay
@launchmynft
@saxiaaanft
Cross-promo activity (last 90 days): @Saxiaaanft RT'd @AevonNFT 11×, @jimye_ RT'd it 2×, @AevonNFT RT'd 25 distinct crew promoters across 20 tweets. Multi-year Spaces history confirms the social unit: VibeTribe Mega Spaces Vol. 1–5 (with @MOBCollective_, @MutantsOnSol, @LunardollzNft, @vtopiaio, @TekrosUnlimited), Swiss×Rico GAINZ Spaces (Feb 15 2025), THC×VibeTribe "Seshions" (Apr 16 2024), @romantradez Aevon stream giveaway (May 9 2026).
PROOF D — IDENTITY GAINS
@jimye_'s first name is Liam. @jorgieboy is "jorge" in Miami. @Saxiaaanft has a fresh GitHub account.
- @jimye_ (display "YEKI_art") = Liam. Pulled from his self-published Discord username
263liam. He's a contractor in the GOTM artist pool (employer chain: MutantsOnSol → Monshape → BreathOfEstova → enchanted_nfts), not a principal. Open OSINT lead: ArtStation/DeviantArt under YEKI_art for a portfolio with a real surname.
- @jorgieboy = "jorge", Miami FL. Display name jorge, location "Miami, fl…for now!" on a 2009-vintage account whose avatar (
IMG_0085_normal.jpg) is iPhone-default — strongly suggesting a real face photo. Open lead: TinEye / Yandex reverse-image-search on the avatar.
- @Saxiaaanft GitHub =
saxiaaanft8, account created 2026-04-17 — exactly during the Aevon build window. Starred a Polymarket copy-trade bot. No identifying fields posted; timeline match is suggestive but not deanonymizing.
- aevon.eth on Ethereum. The ENS name resolves to
0xe626EB731848713b05CcAC9f7B05d9ac10D683D7, funded by leor.eth, which traces to a Chinese-name ENS cluster. Aevon has an EVM-side identity layer that may be a separate operator or a deliberate obfuscation hop. Worth a follow-up walk on its own.
PROOF E — THIRD CEX PATH (CRYPTO.COM HOT 2)
A third platform funder lands on a top Aevon holder that also carries a GOTM-crew NFT.
Wallet 7n5nZoRc7udNpxPzYnzAkZeyAthTfKAX3qSmP48R9yKn holds 130 Aevon + 1 HaxzSol NFT (HaxzSol is a directly attributed GOTM crew project). It was genesis-funded two hops away by Crypto.com Hot 2 (AobVSwdW9BbpMdJvTqeCN4hPAmh4rHm7vwLnQ5ATSyrS, via H8C79zUG relay).
Anchor tx: 2AFCEa4aB…ag1r
Three CEX platforms — Binance, Coinbase (multiple paths), and now Crypto.com — independently fund crew-attributable wallets in the Aevon ecosystem.
PROOF F — LAUNCHPAD OPERATOR'S SEED FUNDING ORIGINATES FROM FLIP.GG
The Squads V3 vault that controls Launchmynft's program upgrades was seed-funded — at the genesis of its funder chain — by a Flip.gg hot wallet 17 months before the launchpad's first program upgrade.
Aevon used Launchmynft.io as a no-code launcher. Launchmynft's public-facing team (Amsterdam, KOI Capital backed, named co-founders) does not appear on-chain. The wallet that actually controls program upgrades is a separate Squads V3 vault whose entire SOL ancestry traces to Flip.gg's Solana hot wallet — the same casino the Florida crew uses to launder rug proceeds.
SEED-FUNDING CHAIN — PROVEN
PUBLIC-TEAM ↔ ON-CHAIN-OPERATOR SPLIT
Public face: Amsterdam Dutch team — co-founders Jordi (aka Kwebbelkop, 15M-sub YouTuber) and Chris. KOI Capital (Singapore) listed investor.
On-chain operator: Squads V3 vault labeled "AAR L", sole active signer MNzFR9og…. Vault has 300 program-upgrade txs and zero SOL outflow to any CEX. The label "AAR L" does not match either public co-founder's name or initials.
A no-code launchpad whose program-upgrade key sits in a Squads vault funded entirely by a Cyprus-shell casino's hot wallet — and where the on-chain key holder does not match the publicly named team — is an operator/company split that the public team's KOI Capital diligence either missed or did not disclose.
WHY THIS REVERSES PRIOR "INDEPENDENT" CALL
Day-1 we said "Launchpad is independent of the crew." That call was wrong on framing. It is independent of the Florida crew (rico/gainz/thclabz/jorgieboy etc.) — but it is not independent of Flip.gg.
The crew's signature MO (lootbox / spin-the-wheel / closed-loop token gambling) and their use of Flip.gg as the off-network laundering layer (PROOF G + crew funding chain) sit on top of a launchpad whose own seed money came from the same Flip.gg hot wallet. That is structural alignment, not coincidence — even without proof of co-conspiracy.
Verdict (calibrated): Shared first-funder PROVEN. Launchpad-as-co-conspirator UNCONFIRMED. Treat the launchpad as Flip.gg-adjacent gambling-economy infrastructure rather than neutral third-party service.
What the 17-month dormancy tells us: the 0.999847 SOL Flip.gg sent in Aug 2022 sat idle for 17 months before being touched. That is not a routine customer payout (those move within days). It is more consistent with a personal seed transfer between insiders, or a dormant treasury allocation reactivated when Launchmynft's Solana program was ready to deploy in early 2024. Either reading places a Flip.gg-controlled wallet as the FIRST source of operational capital for the launchpad — directly upstream of every Aevon, BASC, GOTM, Puffsterz, MOB and Nuddies deployment that has used the platform since.
Confidence ladder: Flip.gg seed-funded the Launchmynft operator chain — PROVEN. Same person/insider runs both — SUGGESTIVE. Launchmynft is knowingly co-conspiring with Florida crew rugs — UNCONFIRMED. Florida crew chose Launchmynft because of the Flip.gg shared infrastructure — PLAUSIBLE.
PROOF G — THE CREW'S OPERATIONAL MO: GAMBLING DISGUISED AS NFT UTILITY
Lootboxes · trait stores · spin-the-wheel · case battles. Same backend, different skins, across every crew project. The Flip.gg casino abuse is the off-network mirror of an on-network casino they were already running.
The Florida crew's signature operational pattern. Every documented project ships some combination of: lootboxes, trait stores, spin-the-wheel, case battles, raffles, "open chest" mechanics. All of them require the project's own token to operate — closed-loop demand for an otherwise worthless token. The same UI metaphor maps 1:1 to Flip.gg's lootbox catalogue. The casino isn't an external accomplice — it's the off-network version of the same product.
RECEIPT 1 — SHARED trait-store BACKEND
Firebase project literally named trait-store is used by both gotmlabz.io and nftstake.app — single database backing what is presented as multiple independent products. Same code, different skins. Already documented in GOTM investigation.
RECEIPT 2 — CROSS-PROJECT TRAIT → TOKEN PAYOUT
Screenshot evidence: a Puffsterz Jacket trait staked at GAINZ pays out 5 $P4L tokens (Puffsterz's project token, paid by a Rico-operated platform). When a Puffsterz NFT trait pays Puffsterz tokens via a GAINZ platform, the projects share a single payout pipe — they are one product wearing multiple brand wrappers.
RECEIPT 3 — STAKING PLATFORM CONSOLIDATION
Original nftstake.app/gainz staking interface migrated to gotmlabz.io/nftstake/gainz with a "GOTM LABZ" tab visible. 3,185 of 3,324 GAINZ NFTs are staked on this single centralized platform. This is the on-network casino — staking-as-gambling, with house-edge revenue from the spread between deposit value and average payout.
Why this MO matters: a single project running a lootbox is just degen NFT product design. A network of 27+ projects all running lootboxes, trait stores, and spin-the-wheel mechanics that share a single backend, single staking platform, and cross-project trait→token payouts is structurally a casino. The Flip.gg laundry chain (2AQdpHJ2 → 4-hop → INTERMEDIARY → moonblaze + dakdaze) and the Binance Hot 5tzFkiKs three-way withdrawal pattern are the off-network laundering layer for an on-network gambling network. The crew's "utility" IS the laundering vehicle.
This MO observation surfaced from the operator's own pattern recognition watching the projects' UI / token-utility designs across 18+ months. Already-documented receipts above (trait-store Firebase, Puffsterz-trait→P4L payout, GAINZ staking platform migration) corroborate it without new evidence required.
⚡ PROOF H — OPERATOR DISTRIBUTION LAYER (PROVEN)
A single relay wallet receives 500–1400 SOL batches simultaneously from Crypto.com Hot 2, Binance Hot, and Coinbase — then forwards same-size batches to Aevon's pre-mint insider funder ancestors.
High-velocity relay 4cMZhSWFhcEEyU8DTGwvdN4Y2sfdAgT4xPu8EaiPjfoP sits one hop upstream of multiple Aevon insider funder ancestors AND is being fed by all three major CEXes the crew touches. This is the layer where the funding trail is being broken.
| Date | From | To | SOL | Sig |
|---|
| 2026-05-09 19:41 | Crypto.com Hot 2 | 4cMZhSW | 848 | 9jrYUqkLK8tK1Qzw… |
| 2026-05-08 19:48 | Binance Hot | 4cMZhSW | 946 | 48h9e2ifX64GuG5S… |
| 2026-05-08 20:05 | 4cMZhSW | GJRs4FwH (30K SOL whale → ancestor of Aevon's 8XVR insider) | 580 | 4j1SWQB4kN8dDJRQ… |
| 2026-05-08 10:50 | 4cMZhSW | 5g7yNHyG (funder of Aevon's 72L2 insider) | 599 | 3kUKZPWVMYCRZ7JP… |
Why this is meaningful: a single entity does not legitimately receive simultaneous large-batch SOL transfers from Crypto.com Hot 2 + Binance Hot + Coinbase within the same 24-hour windows and immediately fan-out to wallets that fund Aevon's pre-mint insider stage. Either it's a large OTC desk being unwittingly used by the crew across three accounts, or it's a deliberate distribution layer the crew set up to break the CEX-to-flagship trail. `4cMZhSW` is the most operationally suspicious wallet in this investigation and the next pivot for chain-walking.
Open leads for the next pass: (1) Map every recipient of `4cMZhSW` over April–May 2026 to find any direct funding to moonblaze / dakdaze / thclabz / vibetribe — same-operator at chain layer would be PROVEN if any hit. (2) Walk `GJRs4FwH` (30K SOL whale) to its CEX deposit destination.
All Day-2 proofs are reproducible from public-chain data, public X data, the Bonfida SNS registry, and previously-published Analyzer69000 investigations. Click any wallet or transaction to verify on a block explorer. Where re-verification of a prior claim failed (PlayFlip → moonblaze 4-hop chain), we have downgraded the claim and surfaced the corrected operator-distribution layer (`4cMZhSW`).
