Back to Blog

两分钟赚取一百万:使用MetaSleuth追踪Solana上的“聪明”资金

MetaSleuth
April 29, 2024
4 min read

MetaSleuth 是一个加密货币追踪和调查平台。它可以帮助监控市场动态、追踪犯罪活动的资金流向,并进行DYOR(自己做研究)以避免诈骗。它支持超过 20 条区块链,并被社区广泛用于执行调查。

在本篇博客中,我们将展示如何使用 MetaSleuth 追踪 Solana 上 meme TIM 代币 的“聪明”资金,该项目被批评为项目内部人员通过购买 TIM 代币赚取了数百万美元。本篇博客中使用的地址是 9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy。在接下来的内容中,我们将使用地址 9wAfr 来指代 9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy

开始搜索

首先,在 MetaSleuth 中输入地址 9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy。该工具将进行智能分析,显示初始化结果(如下图所示)。

Figure 1: The initialized result after inputting the address
Figure 1: The initialized result after inputting the address

左侧是地址的侧边面板,当您在主画布上单击一个地址时会显示。主画布上的节点代表一个地址,节点之间的边代表每个代币的聚合代币转账。这意味着如果两个节点之间存在多个代币转账交易,它们之间将只有一条边。您可以单击边来显示详细的代币转账交易。

从结果中,我们可以发现与 Raydium 的代币兑换,有 30.38 wSoL 流入 Raydium,流出 288,723,795.50 TIM。正如我们刚才所说的,边代表聚合的代币转账。我们可以单击边来查看更详细的信息。

Figure 2: More detailed information at the edge
Figure 2: More detailed information at the edge

交易列表显示了地址 9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy 和 Raydium 之间的交易。

Figure 3: The transaction list
Figure 3: The transaction list

从交易列表中,我们可以看到 9wAfr 在 04-28 02:33:33 至 04-28 02:25:49 这两分钟内,使用 30.38 SoL 兑换了 288,723,795.50 TIM 代币。

追踪资金流向

收到 TIM 代币后,地址 9wAfr 希望出售 TIM 代币以获利。它没有直接使用 9wAfr 地址出售代币,而是使用了三层地址来隐藏踪迹。这是如何实现的?

要追踪资金流向,我们首先找到从地址 9wAfr 转出的 TIM 代币。我们可以单击地址 9wAfr 来显示侧边面板,并选择所有输出的 TIM 代币。

Figure 4: The selecting progresses and results
Figure 4: The selecting progresses and results

选择接收 TIM 代币的地址后,我们可以单击地址节点进一步追踪代币流向。例如,我们可以单击地址 Ax39bkxVxfC9Riz9fSKHVWGjwLSdHv2zCnHFyNWq15eK,发现该地址将收到的 TIM 代币兑换成 SoL,并将 SoL 转账给 DJGiuwGs1WtC1QkEj3GkGtdVoXuEk34uwWmvQvLi72SZ

Figure 5: The further tracking results
Figure 5: The further tracking results

我们可以使用类似的方法追踪其他从 9wAfr 接收 TIM 代币的地址。我们发现这些地址有三种不同的状态。

  • 状态 1:收到的代币仍在地址中
  • 状态 2:收到的代币已兑换成 SoL,并转账给 DJGiuwGs1WtC1QkEj3GkGtdVoXuEk34uwWmvQvLi72SZ
  • 状态 3:收到的代币已兑换成 SoL,并转账给 Pa3AzeK4HHmvoj1sgtfjHQ37onbjoGXreZkxuW8uE4w

请注意,其中一些地址将 TIM 代币转账给了另一个层级的地址。

存入 Coinbase

Figure 6: The deposit addresses of different layers
Figure 6: The deposit addresses of different layers

我们进一步发现,SoL 将被兑换成 USDC,并转账到 Coinbase 的存款地址 CZPaGuP7scPw69bnjWycfTF5chmuqtaf2PnGR4Ji9yyn

利润

让我们计算地址 9wAfr 的估算利润。

Figure 7: The estimated profits of address the address 9wAfr
Figure 7: The estimated profits of address the address 9wAfr

我们可以发现,投资回报率超过 400 倍(按当前每 TIM 0.00004995 SoL 的价格计算)。利润为 (476 - 1) x 30.38 SoL x 130 USD/SoL = 180 万美元。

图表显示了购买时间和开始出售 TIM 代币的时间。

Figure 8: The time to buy and to start selling the TIM tokens
Figure 8: The time to buy and to start selling the TIM tokens

“聪明”资金?

社区怀疑本篇博客中分析的地址以及另一个地址(DmHDP8BNRUMNkwqD145zudhJGKuEZgAMyZi7BsvEnMNv),它们赚取了数百万美元,是项目内部人员。原因如下。

  • 这两个地址是新的地址,没有交易历史
  • 在代币启动前不久,它们收到了 SoL,并立即购买了大量的 TIM 代币
  • 它们使用了多层地址来隐藏资金流向

我们不知道这些地址的真实身份。然而,所有的交易都是公开的。任何人都可以利用 MetaSleuth 对任何项目和地址进行自己的研究。

请阅读 MetaSleuth 文档网站 以获取更多信息。

我已保存分析结果,您可以单击以查看详细信息。

Figure 9: The analysis result
Figure 9: The analysis result

https://metasleuth.io/result/solana/9wAfrMnzrJ1XWXXDDmqh7gH7Q9ZBJjLhgou5GrUcHsZy?source=bb67b58b-25d8-4737-ba12-73440cdf6302

订阅并享受 10% 折扣

注册 MetaSleuth 时,使用 BLOCKSEC 作为邀请码,即可享受 10% 的订阅折扣。

https://metasleuth.io/?invite-code=BLOCKSEC

drawing
Sign up for the latest updates
~$15.9M Lost: Trusted Volumes & More | BlockSec Weekly
Security Insights

~$15.9M Lost: Trusted Volumes & More | BlockSec Weekly

This BlockSec bi-weekly security report covers 11 notable attack incidents identified between April 27 and May 10, 2026, across Sui, Ethereum, BNB Chain, Base, Blast, and Berachain, with total estimated losses of approximately $15.9M. Three incidents are analyzed in detail: the highlighted $1.14M Aftermath Finance exploit on Sui, where a signed/unsigned semantic mismatch in the builder-fee validation allowed an attacker to inject a negative fee that was converted into positive collateral during settlement; the $5.87M Trusted Volumes RFQ authorization mismatch on Ethereum; and the $5.7M Wasabi Protocol infrastructure-to-contract-control compromise across multiple EVM chains.

Newsletter - April 2026
Security Insights

Newsletter - April 2026

In April 2026, the DeFi ecosystem experienced three major security incidents. KelpDAO lost ~$290M due to an insecure 1-of-1 DVN bridge configuration exploited via RPC infrastructure compromise, Drift Protocol suffered ~$285M from a multisig governance takeover leveraging Solana's durable nonce mechanism, and Rhea Finance incurred ~$18.4M following a business logic flaw in its margin-trading module that allowed circular swap path manipulatio

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly
Security Insights

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly

This BlockSec weekly security report covers eight attack incidents detected between April 20 and April 26, 2026, across Ethereum, Avalanche, Sui, Base, HyperLiquid, and MegaETH, with total estimated losses of approximately $7.04M. The highlighted incident is the $1.3M GiddyDefi exploit, where the attacker did not break any cryptography or use a flash loan but simply replayed an existing on-chain EIP-712 signature with the unsigned `aggregator` and `fromToken` fields swapped out for a malicious contract, demonstrating how partial signature coverage turns any historical signature into a generic permit. Other incidents include a $3.5M Volo Vault operator key compromise on Sui, a $1.5M Purrlend privileged-role takeover, a $413K SingularityFinance oracle misconfiguration, a $142.7K Scallop cross-pool index injection, a $72.35K Kipseli Router decimal mismatch, a $50.7K REVLoans (Juicebox) accounting pollution, and a $64K Custom Rebalancer arbitrary-call exploit.

Go Deeper with MetaSleuth Investigation

Extend your crypto compliance capabilities with Blocksec's MetaSleuth Investigation, the first platform for tracing funds, mapping transaction networks and revealing hidden on-chain relationships.

Move from detection to resolution faster with clear visual insights and evidence-ready workflows across the digital assets ecosystem.

MetaSleuth Investigation