On-chain evidence · compiled 2026-08-26

JustOneSui ($ONE) rug pull

4,767 SUI taken from 715 wallets on Sui mainnet, 2026-08-25. The proceeds were deposited to Binance on 2026-08-26.

Binance deposit address holding the proceeds0x10067f87f8687cd1fe6e6fff0f9a204bd71b744483531de067f272ae4f972ea9

Addresses

Token0xaaffd090b57fcdcf293f7e7ec59c119acc910eeb5fc4aadfb4185fa56b6a2cb5::suipump::SUIPUMP
Presale collection0xd3589c08f263d1fd51e684150289a197cfee144e1cdbe558ea16a7e7e618bb13
Deployer / operator0x99e00c12e5a3319b37048be73755f9538fbc2d2c7aed8dd727990b9c88e112a4
Exit wallet0x65b4a0edd51ab817fc14d2adf9c45104fe08a42db0d790b3b7e10209aeb22ba5
zkSend claimer0x73e02f6f4659987783352d2022bab8b23d975cbc9c6dae017f166d462a2c4b59
Forwarder0x41660517bad59947b7f4da75bd1738eaffab3b447b52414492254fcd6bd4cc0d
Stash (3,996.90 SUI)0x2a3a901e23d3589e03a350734feff95a16848ef1742590bf8344442d49407289
Binance deposit addr0x10067f87f8687cd1fe6e6fff0f9a204bd71b744483531de067f272ae4f972ea9
Binance hot wallet0x935029ca5219502a47ac9b69f556ccf6e2198b5e7815cf50f68846f723739cbd ("Binance 1")
Ethereum (secondary)0xdCDA06F7fAeA2c02D7d175a82Cd1645f59Dc4D99

What happened

  1. He funded the launch with the victims' money. The deployer wallet's first two deposits ever both came from the presale collection wallet: 1.0000 SUI at 01:12:05 UTC (tx) and 4,866.89 SUI at 01:16:36 UTC (tx).
  2. Pre-mine inside the launch transaction. 01:17 UTC, 553,388,273 tokens minted to the operator atomically at deployment.
  3. Dump. 03:22 UTC, the pre-mined supply sold for approximately 3,918 SUI.
  4. Laundering. 3,996.90 SUI wrapped into a zkSend link to break the trail (tx), claimed (tx), then forwarded to the stash wallet (tx), where it has sat untouched since.
  5. Extortion. Using Telegram handles "L.Dotsui" and "Dazzy", the operator demanded 200 USDC from a community member in exchange for not defacing the token's DexScreener listing, then used DexScreener's paid Update Token Info product (order #1787671764758) to vandalize it. DexScreener reverted the change and locked the operator out of editing.
  6. A small Ethereum route, 2026-08-26. The operator swapped SUI to USDC and bridged roughly $4.40 through Circle CCTP to Ethereum 0xdCDA06F7…4D99: 2.209129 USDC at 16:14 UTC (tx) and again at 16:20 UTC (tx). The bulk of the money did not follow this route. It is listed because that Ethereum wallet is a second identity belonging to the same operator.
  7. The cash-out to Binance, 2026-08-26. Between 21:56 and 22:00 UTC the holding wallet sent everything to a Binance deposit address, starting with a 1 SUI test:
    21:56:32 · 1.00 SUI · tx
    21:58:51 · 3,995.90 SUI · tx
    22:00:55 · 35.05 SUI · tx
    4,032.16 SUI in total. The receiving address 0x10067f87… forwards everything it receives to 0x935029ca…, which Suiscan labels "Binance 1", Exchange, Mandatory KYC and AML, holding over 24 million SUI. Binance swept the deposit into that wallet at 22:35 UTC.
  8. Reported. Filed with Binance support on 2026-08-26, case #168259523, with the full transaction path above.
  9. Continued interference. Also on 2026-08-26, from the same deployer wallet, the operator submitted a paid request to SuiVision to rename the token "JustOneSkam" and flag it as a scam, after the community took the project over.

Screenshots

Suiscan transaction showing the CCTP deposit_for_burn call from the operator's wallet
Sui mainnet, 2026-08-26 16:14 UTC. The operator's wallet 0x99e00c12… calls deposit_for_burn on CCTP TokenMessengerMinter, bridging USDC to Ethereum 0xdCDA06F7…4D99. Digest ABf2P6pxPowxidNSq3v3mutTnQy1nZD9zFWAo3B6q3Gj
Suiscan account page for the holding wallet
The holding wallet 0x2a3a901e… while it still held 3,996.90 SUI. It has since been emptied to Binance.
Suiscan showing the receiving wallet labelled Binance 1
Suiscan labels the wallet that received the deposit as "Binance 1", flagged Exchange and Mandatory KYC and AML, holding 24,064,470 SUI. Captured 2026-08-26 22:03 UTC.

Verify it yourself