A second suspected memecoin rug factory has surfaced on Robinhood Chain as the fast-growing network attracts increasingly coordinated scam activity.

On Sept. 28, blockchain security firm GoPlus said it identified a high-risk operation behind hundreds of memecoins that routed more than $9 million through a common fund-consolidation network over the past 30 days.

The operation used batches of freshly created wallets to accumulate and sell tokens before sweeping the proceeds into related addresses, according to GoPlus. Its main consolidation wallet recorded about 3,589 ETH, worth roughly $9.49 million, of two-way flows across its latest 400 transactions as of Sept. 28.

GoPlus noted that the figure represents gross flows rather than net profits or investor losses. The security firm said the wallet activity nonetheless exposed a repeatable structure in which proceeds from one group of launches appeared to finance the next.

Operators would create a token around a popular narrative, distribute supply among fresh wallets with little transaction history, and sell through contracts including PonsV2Helper and UniversalRouter. ETH generated from those sales was then routed through local sweep wallets before reaching the wider consolidation cluster.

That structure can obscure how much of a token one operation effectively controls. Instead of one wallet dumping a concentrated position, dozens of seemingly unrelated addresses sell in stages, creating the appearance of independent market activity before the proceeds converge elsewhere.

GoPlus said the setup does not resemble a traditional rug pull, in which liquidity suddenly disappears, or buyers are prevented from selling. Its concern is the coordinated ownership and exit process behind apparently separate wallets, followed by recycling of the proceeds into subsequent launches.

Earlier operation extracted $18.4 million from 53 launches

The findings come after on-chain researcher Wazz identified another suspected serial-rug operation on Robinhood Chain that allegedly extracted about $18.43 million from at least 53 memecoin launches over roughly two months.

That operation used a different variation of the same broad playbook. Groups of 70 to 200 wallets would acquire large portions of supply shortly after launch, often leaving the cluster with over 70% of a token.

Wazz also identified links between successive launches, including funds from one project moving into wallets used to seed another. The pattern suggested proceeds were being recycled rather than withdrawn after each individual trade.

GoPlus said the two operations share several characteristics, including heavy use of Pons V2 infrastructure, large wallet batches used to disguise supply concentration, and capital moving from one launch into the next.

The security firm cautioned that there is no evidence the two clusters belong to the same operators. The newer operation relies more heavily on fresh wallets followed by consolidation, while the Wazz-linked group used larger clusters positioned to control supply early in the launch.

The distinction suggests the activity is broader than a single crew. Similar economics can be reproduced with different wallet structures, giving operators multiple ways to make coordinated dumping resemble normal trading.

That raises a harder detection problem for wallets, launchpads and trading interfaces. Identifying malicious code alone would not necessarily flag a token whose contracts function normally while its supply is quietly concentrated across dozens of related addresses.

Robinhood Chain’s rapid growth raises the stakes

The suspected factories are emerging as Robinhood Chain expands at a pace few new networks have matched.

The Ethereum layer-2 went live July 1 and has crossed $1.5 billion in total value locked as of press time, per DeFiLlama data. It reached that milestone in less than 90 days, showing how quickly it has grown.

Token Terminal estimates Robinhood Chain has generated about $50 million in revenue in roughly three months, underscoring the trading activity already moving through the network.

Robinhood’s larger opportunity extends beyond fees generated by crypto-native users. The brokerage has 28.6 million funded customers and about $384 billion in assets, giving developers the prospect of building on-chain products that could eventually reach a large existing financial customer base.

That distribution advantage also raises the cost of missing abusive token launches early.

A permissionless network can let external developers deploy products without Robinhood approving every contract, but the applications and interfaces through which users encounter those products can still add screening, wallet warnings, and concentration analysis.

The emergence of a second suspected rug factory makes those safeguards more important before Robinhood pushes more of its brokerage audience on-chain.

For Robinhood, the commercial question is whether it can preserve the open environment helping its chain grow while preventing organized token operators from using that same distribution layer to reach a much larger pool of retail capital.