CASE STUDY

BABYDADDY/SOL: Rat Wallet Pattern and Exchange Tracing

Overview

Centralized exchanges (CEX) are often investigative dead-ends due to custodial pooling, but upstream on-chain behavior can still reveal patterns. This case examines BABYDADDY/SOL for signs of coordinated rat wallet accumulation, shared funding pathways, and a common exit route.

Core Entities

Token (Solana):
2H5yWbfB3u2KZwZj4RsBrfTXL8KB2YNE8i2Yb7cvpump

Developer Wallet (Solana):
88vNKLyvkj4nMSfY7VqhNhofo5DtMoF8NtXesVEHKEzf

Funding Wallet (Solana):
FpwQQhQQoEaVu3WU2qZMfF1hx48YyfwsLoRgXG83E99Q (Coinbase hot wallet)

Rat Wallet Pattern

Rat wallets are early trading wallets that accumulate supply for the developer or affiliates. They often share funding sources and display synchronized trading behavior.

Observed early wallets and reference transactions:
E37YjkXLi9kDCRvqhgJoABcJdztpPj7GEaaJRGWq61WX
Tx: https://solscan.io/tx/2UGAisHChxHni9deERDBwY4EoGfuA243kbMP9n6coooBqorQ9EBt8AYC2hCAc9S56Cpv4LyL7dTCo7gH4KnSs5TS
AruUkd3DJy45SWZgKbnF9P5yx2DbH3MrcFNbyEjtUPsj
Tx: https://solscan.io/tx/5QNGnUWQ3q3TcvzpghD4dAN4eCzVUy3unvYtZcqsbzwFfH51BUYKTaLBJh49LyZFpCgzXqZYkmoEvjw6fvjRq3dS
7Gm4fGZHrp5a6wJwGP8fBt4gNZfQdAeSf4TQxVPaZMpf
Tx: https://solscan.io/tx/W1jBEz8wiikccvY1YDG3vWrStMhyEv6qXisp4cT7Y3oFv7bEToBy9L8VKBFoaUx6FLFLSkB2uk2GezYiXcfwyx8
CqaHpRKPBGVFWWnuqufXg5sknde7iSnYkKR2roZdShp6

Observed traits:

• Funded via spam dusting prior to activity
• Held the same token (time20x) during the analysis window
• Synchronized selling consistent with rigging/manipulation

Aggregation and Exit

Funds from the listed rat wallets converged to a common wallet:

Aggregator Wallet (Solana):
zHNAVVF6McnzPqTu19Jv3V3FUpfRfDutMv94djsgLsm

 

A subsequent large transfer of 372 SOL moved to the exit wallet:

Exit Wallet (Solana):
9W2viEv7R1TQw1Qia7rGk2WSuYU9MHRCH3MnrnVq2vXY

 

Transaction:
https://solscan.io/tx/5wSV8pHp5GPSKBV3FtGZmWCWxzgqTmfYf7ZagyDGDrQQyz6up1jT9KpkPSPQtrjJ5SnhKUgiTfk8TV2pbPR9pRFk

Exchange Attribution

Following aggregation, funds were reportedly withdrawn to a Kraken hot wallet. While CEX custody obscures downstream tracing, upstream clustering (shared funding, synchronized trading, common aggregator/exit) provides strong attribution signals.

 

Kraken deposit transaction:
https://solscan.io/tx/2y3umFcLe2Gu3HTn8PpPf7dKDwcAAykkzZNTKW1CWWYk487jdzTJuW4re2URMVni7a3yRE5n9qkLBeaHYttzmbHG

Key Findings

• Early wallets share funding traits (spam dusting) and token exposure (time20x)
• Timing suggests coordinated selling activity
• Funds clustered to a shared aggregator (zHNAV...Lsm), then to an exit wallet (9W2viE...vXY)
• Final movement reportedly reached a Kraken hot wallet

Recommended Actions

1) Monitor the listed wallets (early, aggregator, exit) for repeat patterns and new token exposure
2) Submit reports to Coinbase and Kraken with addresses and timelines
3) Maintain an evidence log (timestamps, tx hashes, addresses) to support any follow-on actions

Evidence & Transaction References

T0 – Developer Funding Transaction

Timestamp:
09:54:26 Jun 19, 2026 (UTC)

Transaction:
https://solscan.io/tx/2oQkxdfmCLfxameHhapYbNYyiPbN9Jdz98KAu2gYvS252TpvufBGxquqFJhP8vZcNLX1yK3fnZgQpc6gDFuuNfd8

Description:
Funding transaction from Coinbase-associated wallet to developer wallet.

T1 – Token Creation Transaction

Transaction:
https://solscan.io/tx/iUKyxKiwGS4Nu9WpquaJoaQVbrNwHmLg6G6NJAsJdLRSb27CXuXxeUqtvQqQAzjqcnh5qrTtFa3KgcWhTfpRgWB

Description:
Token creation / deployment event.

T2 – Early Participant Wallet Activity

Transaction 1:
https://solscan.io/tx/2UGAisHChxHni9deERDBwY4EoGfuA243kbMP9n6coooBqorQ9EBt8AYC2hCAc9S56Cpv4LyL7dTCo7gH4KnSs5TS

Transaction 2:
https://solscan.io/tx/5QNGnUWQ3q3TcvzpghD4dAN4eCzVUy3unvYtZcqsbzwFfH51BUYKTaLBJh49LyZFpCgzXqZYkmoEvjw6fvjRq3dS

Transaction 3:
https://solscan.io/tx/W1jBEz8wiikccvY1YDG3vWrStMhyEv6qXisp4cT7Y3oFv7bEToBy9L8VKBFoaUx6FLFLSkB2uk2GezYiXcfwyx8

Description:
Representative transactions demonstrating early wallet participation and trading activity.

T5 – Consolidation Wallet Withdrawal

Transaction:
https://solscan.io/tx/5wSV8pHp5GPSKBV3FtGZmWCWxzgqTmfYf7ZagyDGDrQQyz6up1jT9KpkPSPQtrjJ5SnhKUgiTfk8TV2pbPR9pRFk

Description:
Transfer of approximately 372 SOL from the consolidation wallet to an intermediary wallet.

Exchange Cash-Out Transaction

Transaction:
https://solscan.io/tx/2y3umFcLe2Gu3HTn8PpPf7dKDwcAAykkzZNTKW1CWWYk487jdzTJuW4re2URMVni7a3yRE5n9qkLBeaHYttzmbHG

Description:
Transaction associated with deposit into a Kraken-labeled wallet.

Analyst Notes

The investigation identified a cluster of early-participating wallets exhibiting similar behavior patterns, including synchronized selling activity and subsequent transfer of proceeds to a common consolidation wallet.

The consolidation wallet transferred approximately 372 SOL before funds were ultimately deposited into a Kraken-associated address. While common ownership cannot be conclusively established through on-chain evidence alone, the observed behavior is consistent with coordinated activity.

Conclusion

The BABYDADDY/SOL flow exhibits behavior consistent with a rat-wallet accumulation and coordinated exit. Even where CEX custody limits visibility, on-chain clustering offers actionable monitoring and escalation paths.