Back to Blog

两分钟赚取一百万:使用MetaSleuth追踪Solana上的“聪明”资金

MetaSleuth
April 29, 2024
4 min read

MetaSleuth 是一个加密货币追踪和调查平台。它可以帮助监控市场动态、追踪犯罪活动的资金流向,并进行DYOR(自己做研究)以避免诈骗。它支持超过 20 条区块链,并被社区广泛用于执行调查。

在本篇博客中,我们将展示如何使用 MetaSleuth 追踪 Solana 上 meme TIM 代币 的“聪明”资金,该项目被批评为项目内部人员通过购买 TIM 代币赚取了数百万美元。本篇博客中使用的地址是 9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy。在接下来的内容中,我们将使用地址 9wAfr 来指代 9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy

开始搜索

首先,在 MetaSleuth 中输入地址 9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy。该工具将进行智能分析,显示初始化结果(如下图所示)。

Figure 1: The initialized result after inputting the address
Figure 1: The initialized result after inputting the address

左侧是地址的侧边面板,当您在主画布上单击一个地址时会显示。主画布上的节点代表一个地址,节点之间的边代表每个代币的聚合代币转账。这意味着如果两个节点之间存在多个代币转账交易,它们之间将只有一条边。您可以单击边来显示详细的代币转账交易。

从结果中,我们可以发现与 Raydium 的代币兑换,有 30.38 wSoL 流入 Raydium,流出 288,723,795.50 TIM。正如我们刚才所说的,边代表聚合的代币转账。我们可以单击边来查看更详细的信息。

Figure 2: More detailed information at the edge
Figure 2: More detailed information at the edge

交易列表显示了地址 9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy 和 Raydium 之间的交易。

Figure 3: The transaction list
Figure 3: The transaction list

从交易列表中,我们可以看到 9wAfr 在 04-28 02:33:33 至 04-28 02:25:49 这两分钟内,使用 30.38 SoL 兑换了 288,723,795.50 TIM 代币。

追踪资金流向

收到 TIM 代币后,地址 9wAfr 希望出售 TIM 代币以获利。它没有直接使用 9wAfr 地址出售代币,而是使用了三层地址来隐藏踪迹。这是如何实现的?

要追踪资金流向,我们首先找到从地址 9wAfr 转出的 TIM 代币。我们可以单击地址 9wAfr 来显示侧边面板,并选择所有输出的 TIM 代币。

Figure 4: The selecting progresses and results
Figure 4: The selecting progresses and results

选择接收 TIM 代币的地址后,我们可以单击地址节点进一步追踪代币流向。例如,我们可以单击地址 Ax39bkxVxfC9Riz9fSKHVWGjwLSdHv2zCnHFyNWq15eK,发现该地址将收到的 TIM 代币兑换成 SoL,并将 SoL 转账给 DJGiuwGs1WtC1QkEj3GkGtdVoXuEk34uwWmvQvLi72SZ

Figure 5: The further tracking results
Figure 5: The further tracking results

我们可以使用类似的方法追踪其他从 9wAfr 接收 TIM 代币的地址。我们发现这些地址有三种不同的状态。

  • 状态 1:收到的代币仍在地址中
  • 状态 2:收到的代币已兑换成 SoL,并转账给 DJGiuwGs1WtC1QkEj3GkGtdVoXuEk34uwWmvQvLi72SZ
  • 状态 3:收到的代币已兑换成 SoL,并转账给 Pa3AzeK4HHmvoj1sgtfjHQ37onbjoGXreZkxuW8uE4w

请注意,其中一些地址将 TIM 代币转账给了另一个层级的地址。

存入 Coinbase

Figure 6: The deposit addresses of different layers
Figure 6: The deposit addresses of different layers

我们进一步发现,SoL 将被兑换成 USDC,并转账到 Coinbase 的存款地址 CZPaGuP7scPw69bnjWycfTF5chmuqtaf2PnGR4Ji9yyn

利润

让我们计算地址 9wAfr 的估算利润。

Figure 7: The estimated profits of address the address 9wAfr
Figure 7: The estimated profits of address the address 9wAfr

我们可以发现,投资回报率超过 400 倍(按当前每 TIM 0.00004995 SoL 的价格计算)。利润为 (476 - 1) x 30.38 SoL x 130 USD/SoL = 180 万美元。

图表显示了购买时间和开始出售 TIM 代币的时间。

Figure 8: The time to buy and to start selling the TIM tokens
Figure 8: The time to buy and to start selling the TIM tokens

“聪明”资金?

社区怀疑本篇博客中分析的地址以及另一个地址(DmHDP8BNRUMNkwqD145zudhJGKuEZgAMyZi7BsvEnMNv),它们赚取了数百万美元,是项目内部人员。原因如下。

  • 这两个地址是新的地址,没有交易历史
  • 在代币启动前不久,它们收到了 SoL,并立即购买了大量的 TIM 代币
  • 它们使用了多层地址来隐藏资金流向

我们不知道这些地址的真实身份。然而,所有的交易都是公开的。任何人都可以利用 MetaSleuth 对任何项目和地址进行自己的研究。

请阅读 MetaSleuth 文档网站 以获取更多信息。

我已保存分析结果,您可以单击以查看详细信息。

Figure 9: The analysis result
Figure 9: The analysis result

https://metasleuth.io/result/solana/9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy?source=bb67b58b-25d8-4737-ba12-73440cdf6302

订阅并享受 10% 折扣

注册 MetaSleuth 时,使用 BLOCKSEC 作为邀请码,即可享受 10% 的订阅折扣。

https://metasleuth.io/?invite-code=BLOCKSEC

drawing
Sign up for the latest updates
The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis
Security Insights

The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis

This BlockSec deep-dive analyzes the KelpDAO $290M rsETH cross-chain bridge exploit (April 18, 2026), attributed to the Lazarus Group, tracing a causal chain across three layers: how a single-point DVN dependency enabled the attack, how DeFi composability cascaded the damage through Aave V3 lending markets to freeze WETH liquidity exceeding $6.7B across Ethereum, Arbitrum, Base, Mantle, and Linea, and how the crisis forced decentralized governance to exercise centralized emergency powers. The article examines three parameters that shaped the cascade's severity (LTV, pool depth, and cross-chain deployment count) and provides an exclusive technical breakdown of Arbitrum Security Council's forced state transition, an atomic contract upgrade that moved 30,766 ETH without the holder's signature.

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026

This BlockSec weekly security report covers four attack incidents detected between April 13 and April 19, 2026, across multiple chains such as Ethereum, Unichain, Arbitrum, and NEAR, with total estimated losses of approximately $310M. The highlighted incident is the $290M KelpDAO rsETH bridge exploit, where an attacker poisoned the RPC infrastructure of the sole LayerZero DVN to fabricate a cross-chain message, triggering a cascading WETH freeze across five chains and an Arbitrum Security Council forced state transition that raises questions about the actual trust boundaries of decentralized systems. Other incidents include a $242K MMR proof forgery on Hyperbridge, a $1.5M signed integer abuse on Dango, and an $18.4M circular swap path exploit on Rhea Finance's Burrowland protocol.

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026

This BlockSec weekly security report covers four DeFi attack incidents detected between April 6 and April 12, 2026, across Linea, BNB Chain, Arbitrum, Optimism, Avalanche, and Base, with total estimated losses of approximately $928.6K. Notable incidents include a $517K approval-related exploit where a user mistakenly approved a permissionless SquidMulticall contract enabling arbitrary external calls, a $193K business logic flaw in the HB token's reward-settlement logic that allowed direct AMM reserve manipulation, a $165.6K exploit in Denaria's perpetual DEX caused by a rounding asymmetry compounded with an unsafe cast, and a $53K access control issue in XBITVault caused by an initialization-dependent check that failed open. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident.

Go Deeper with MetaSleuth Investigation

Extend your crypto compliance capabilities with Blocksec's MetaSleuth Investigation, the first platform for tracing funds, mapping transaction networks and revealing hidden on-chain relationships.

Move from detection to resolution faster with clear visual insights and evidence-ready workflows across the digital assets ecosystem.

MetaSleuth Investigation