Ivan and 'LobsterDAO' Defrauded the Blockchain Space With the CRV Token Release

Investigation Aug 15, 2020

For those that don't know, "LobsterDAO" is a meaningless alias given to a fictitious / nebulous group of online 'degenerates' that discuss DeFi prices in random Telegram chats (i.e., t.me/lobsters_chat).

What makes this worthy of note is that this also happens to be Ivan's base of operations.

In fact, Ivan owns his very own 'announcement' channel on Telegram, which serves as "homebase" for the lobsters (link = https://t.me/blockchain_lobsters)

[screenshot below]

The chat, which boasts well over 4,000 members at the time of writing is maintained by none other than Ivan Golovko

Disclaimer: This is not a dox attempt. Ivan is a 'public figure' within the realm of blockchain via his role as the CTO / founder / creator of '$LTO', ICODrops and other ventures. Apart from this, Ivan is known to go by the username, 'Ivan' on all social media platforms. Out of respect (and integrity), we will not be delving into Ivan's personal life - just his involvements in the blockchain space.

Ivan Golovko's Resume

For those that don't know, Ivan has been a busy individual in the blockchain space over the past few years.

Below is a short list of some of the more recognizable projects / entities that he's been involved with over the past couple of years:

  1. '$LTO' (LegalThings One); founder / he still manages this project and its community to this day
  2. ICODrops (CEO & co-founder of the site)
  3. He started the 'Vite ICO' ; this project is also still in operation as we speak.
  4. Head of the "BlockchainLobsters" group that we were just discussing (we'll get back to them, don't worry)
  5. Founder of 'distributed.fund' and 'distributed.alliance'
  6. He's partnered with 'BlockCloud' (notably, BlockCloud was listed on Binance, invested in by Torque Ventures and partnered with Origin X Capital ; three intra-related entities).
  7. Ivan created the POA Network (this one is pretty substantial).

Main Point: Ivan is Far From a 'Nobody'

This isn't some random individual that we're talking about here.

In fact, its arguable that Ivan was perhaps the fist real pioneer of the DeFi space to break land with this idea via the launch of '$LTO' (facilitated by the unsavory Torque Ventures, which has mysteriously disappeared in the few short months since).

Ivan Launched CRV Token Then Spread FUD On it To Accumulate Said Token

This headline seems a bit hyperbolic, admittedly - but when you look at how the series of events played out yesterday, its hard to argue that this is an inaccurate depiction of what transpired on August 13th, 2020 during the supposed 'CRV' token launch.

Let's re-review the information that we have at our disposal.

Hyping of the Token's Launch

On August 12th (the day before Ivan launched the token), he posted the following message in his Telegram channel:

Specifically, the message states:

"Any time, degens, any time... CRV will likely make 200 gas look like a baby. Cryptokitties x2: github.com/curvefi/curve-dao-contracts/pull/39


Pretty harsh appraisal from someone that would go on to launch the token directly less than 24 hours after issuing said statement.

What Happened?

Your guess is as good as anyone's.

All we know is that there was radio silence from the channel for nearly 24 hours before the following was published (August 13th, 2020):

The message above reads:

"It looks like LobsterDAO just allegedly launched Curve Finance '$CRV'. Everybody is still confused."

"It might be a joke, but might be real. Everyone is confused af. Post-mortem incoming."

"This is not a joke. Wait for confirmations. This was the best launch party ever."

Confused? You Should Be

You're probably asking yourself a few questions such as:

  1. What the fuck is the 'LobsterDAO?'
  2. How were they able to arbitrarily launch the contract at whim? (instead of the Curve.Finance team, considering that this is the Curve Finance governance token, which was announced by the Curve Finance team directly no more than a week prior).
  3. How were they able to time the release to be right around the launch?
  4. What makes their iteration of the project 'legitimate' versus the other 'fakes' out there?
  5. What does Ivan know that you don't?

Unfortunately, I don't have the answer to all of those questions above - but I can answer #5 with two words.


Post-Launch: Spreading FUD to Allow For Accumulation

Despite being the one to announce the (eventual) legitimate token contract (which was directly issued by his own group), Ivan was publicly apprehensive about declaring his "discovery" as the one, "true" CRV token smart contract. (see below)

In the message above, Ivan states:


"WAIT TO VERIFY* Contract address of '$CRV' - etherscan.io/token/0xD533a949740bb3306d119CC777fa900bA034cd52"

"Vesting contract - etherscan.io/address/0x575ccd8e2d300e2377b43478339e364000318e2c#readContract"

"Wait to check here www.curve.fi/contracts"

"Distribution LP 22:17:28 UTC"

Honing in on the Timestamp

If there's any piece of relevant information that Ivan gave us here, it was the 'timestamp' included in the enigmatically cautious Telegram post that we isolated above from his 'BlockchainLobsters' chat.

The Time

Reiterating - the time given for the distribution of the contract was 22:17 UTC (no date attached, giving the impression that the event occurred on 22:17 UTC that day).

If you live in New York, that's roughly 6:17 p.m. EST in the afternoon / evening (3:17 PST).

Notably, Ivan's tweet was published at 4:54 p.m. EST (which would be in the "past" if we're going by the time he published for the creation of the contract).

Visiting Etherscan

If there's one thing that Ivan did manage to do here, its provide us with the proper links to the CRV governance token contract.

Contract Address = https://etherscan.io/token/0xD533a949740bb3306d119CC777fa900bA034cd52

Vesting Contract = etherscan.io/address/0x575ccd8e2d300e2377b43478339e364000318e2c#readContract

Taking a Look at the Contract Address For CRV

Out of curiosity, I decided to visit the very last page of the transaction history on Etherscan.io to get a definitive date for the launch of this token contract.

This is what I found:

What the fuck?

Some Quick Observations Here

A) Ivan was right about the time of the contract's deployment...he just didn't mention the date, which was a full 24 hours prior to his announcement that HIS GROUP was responsible for its launch (now this is getting weird)

B) If memory serves correct, Ivan was advising everyone in his channel (Blockchain Lobsters), "DO NOT BUY IMHO". Curiously, he sent that message into his channel no more than 20 minutes (literally) before the actual deployment of the contract in question (looks like it didn't take long for him to have a change of heart.)

C) The initial outgoing transactions from that wallet are absolutely massive.

Let's take a closer look at them again.

Listing the Nine Major Transactions and the Corresponding Transaction Amounts

Initial Transaction = https://etherscan.io/tx/0x5dc4a688b63cea09bf4d73a695175b77572792a2e2b3656297809ad3596d4bfe

Second Transaction (151 million tokens) = https://etherscan.io/tx/0x1d36fa3e154f409e48c59dc5085e5d3cf5993f48d2ed525b49f7d1aa1bf3bca5

Third Transaction (14 million tokens) = https://etherscan.io/tx/0x5f762bc8e2929b76cf22936595b2e2a58cbaa9f31ec896bfaf63f798c4c65d38

Fourth Transaction (26.6 million tokens) = https://etherscan.io/tx/0xb84eb0488e9696e063ce829cfad38aeaced814c54d897078fdc7267c567b0f8e

Fifth Transaction (151 million tokens [again]) = https://etherscan.io/tx/0x3f9aa0ff15fbd00cce60e36f32f25d6f85a43a19d983100d98007a84609f861a

Sixth Transaction (800 million tokens) = https://etherscan.io/tx/0xb7f7de7dc668b584bb22ffa164b959729db96385e500f926f03936c453a3a45e

Seventh Transaction (92 million tokens) = https://etherscan.io/tx/0xcaf8fc449a2c28e13877f6e0dc3e12cb2ba585a86f771d92ae8959cc3303c5d4

Eighth Transaction (2 million tokens) = https://etherscan.io/tx/0x2bada5103c3c1c64879125b8832961bc30a6e1524861272347e9f32a9593a084

Ninth Transaction (64 million tokens) = https://etherscan.io/tx/0xe99a98d6aa3ee2413c58a28c9505be123e02399336364ab47e10bf13102816f1

Brief Blockchain Analysis

There's obviously a lot going on here with this contract and the recipient addresses of those initial transactions appear to be rooted in the protocol in some way.

But that tells us nothing about their nature (or affiliation).

So, out of curiosity, I decided to take a look for myself to see if I could uncover anything interesting.

Starting With Etherscan: Look at the 'Holders'

We don't have to start too complex here.

Let's begin by isolating the 'CRV Token' itself on Etherscan (https://etherscan.io/token/0xd533a949740bb3306d119cc777fa900ba034cd52#balances); with a specific view of the major holders of the token (in order from greatest proportional ownership of total circulating supply - to least).

Below is a screenshot of what it looks like for me at the time of writing:

Out of curiosity, there was one particular address that I honed in on (among the top 10 or so holders of this CRV governance token).

That address was: 0x2a7d59e327759acd5d11a8fb652bf4072d28ac04

At the time of writing, this address possesses 7% of the total circulating supply, which amounts to > '$1 billion' in value (yes, for a project that just launched a few hours ago).

Tracking Down Address 0x2a7

The first thing I did was isolate down to the normal wallet view for the address: https://etherscan.io/address/0x2a7d59e327759acd5d11a8fb652bf4072d28ac04 .

From there, I decided to take a 'helicopter' view of the total transactions (inflow & outflow) for the wallet address, since its owner has become an overnight billionaire (literally).

Just 11 transactions. Meaningless (almost).

Looks like the wallet was created explicitly for this purpose.

Let's see if we can find anything out about the creator of this contract though (first transaction in the transaction log).

But the investigation doesn't stop here.

I decide to isolate the transaction in which this wallet received CRV token for the first time:

Specifically, I'm interested in the sender here.

Transaction ID for that interaction = https://etherscan.io/tx/0xcaf8fc449a2c28e13877f6e0dc3e12cb2ba585a86f771d92ae8959cc3303c5d4

The total value of tokens transferred in that interaction was > $900 million (that's quite a lot to be transferring in one go, right?).

The wallet sending wallet address in question = 0xc4AD0Ef33A0A4ddA3461c479ccb6c36d1e4B7Be4

Examining the Sending Wallet (There's No Better Name For it, So Follow Along)

Here's the URL for that wallet address: https://etherscan.io/address/0xc4ad0ef33a0a4dda3461c479ccb6c36d1e4b7be4

Like the other wallets that we've viewed thus far, it appears that this wallet has very few total transactions (less than 100)

What Gets My Attention

The timing of the first transaction into this wallet address:

If you look closely, you'll notice that this transaction occurred before the launch of the token address (thus, this wallet was primed for distribution by whoever the sender of that transaction was).

Quick Edit (in hindsight, I realized that the photo above did not show the transaction's date, thus it has been added in retroactively to provide that information for the reader.

One of the fortunate benefits of blockchain is that its all on a public ledger, making it not only auditable but - for all intents & purposes - immutable as well
The actual launch occurred at 22:17 UTC on August 12th, this transaction takes place two hours earlier

Wallet Address ID for the Sender = 0x6871eacd33fbcfe585009ab64f0795d7152dc5a0 (https://etherscan.io/address/0x6871eacd33fbcfe585009ab64f0795d7152dc5a0)

Address For This Specific Transaction = https://etherscan.io/tx/0x8f7618f6c7d0874e1a3e56a10f619a3525d18bfebcba09face24f083653b902b

Our Third Wallet in the 'Chain' is Much More Interesting Than its Predecessors

Upon first view, it appears that this wallet address (0x687) has been involved in over 6,000 transactions (and is still active at the time of writing):

However, its affiliation (with any known entities) remains unknown.

Bloxy / Bitquery

At this point, we're going to need to track the inflow / outflow of the relevant transactions for this wallet to get a better idea of what's going on.

Fortunately that can be done by visiting Bloxy & Bitquery.io

Taking a Look at Bloxy.info First

Bloxy (an Ethereum block explorer / smart contract analyzer / transaction visualizer), is useful for giving us comprehensive metrics regarding the wallet's activity (to assist us with parsing potential linkages between this wallet and other known entities in the blockchain sphere so that we can peg this address to a potential owner).

Let's take a look at the information that Bloxy rendered for us for this address:

Strange Affinity For USDT Transfers

For whatever reason, it appears that the bulk of this address' transfers involve Tether in some capacity.

Below we can see the raw numbers (in relation to non-Tether transactions involving this address).

This next chart is even more interesting:

Visiting Bitquery.io

If we want a good ol' fashioned transaction graph analysis, then we better head over to bitquery.io (they're unrivaled when it comes to providing this type of analysis for Ethereum, specifically).

Here's a reliable link for readers to follow if you're looking to perform a similar / different / enhanced analysis yourself (open to all contributions / insights and ideas!): https://explorer.bitquery.io/ethereum/address/0x6871eacd33fbcfe585009ab64f0795d7152dc5a0/graph

Apparent Connection to Binance

It took a little while to unfold the necessary entities on this map (appears that the flow of funds has been sent to this address in a purposefully obfuscated manner), but they all seem to definitively track back to Binance.

(see below):

What's worth noting here is that Binance is not the liquidation point, but rather the sender of funds here (very curious).

We identified Binance (exchange wallet #4) again here:

Additionally, I Found OKex and Huobi

To Be Clear:

A) We're looking at Ethereum transactions specifically (not CRV token transactions)

B) These transactions have all transpired within the last two days and change (few hours)

C) All of the transactions involving the aforementioned exchanges (Binance / OKex / Huobi), are outgoing transactions, so we're not viewing innocuous profit dumps at these exchanges here.

Conclusion (What it Looks Like)

It appears as though OKex / Binance / Huobi were accumulating this token while the rest of the blockchain world was in the dark about what was going on.

Just being honest.

That's what it looks like.

Could I say this conclusively? Not yet.

Not until the timestamps are examined here (haven't had a chance to do so at this point).

But if we can clearly see that these transactions took place before the general public was aware of CRV token (and that these transactions were related to the distribution / aggregation / purchase / sale of CRV in some way), then we can state, without a shadow of a doubt, that those three exchanges (in collaboration with Ivan and Andre Cronje) just hustled the entire blockchain space for billions of dollars.

Merry Christmas.



Happy to serve and help wherever I'm needed in the blockchain space. #Education #EthicalContent #BringingLibretotheForefront

Great! You've successfully subscribed.
Great! Next, complete checkout for full access.
Welcome back! You've successfully signed in.
Success! Your account is fully activated, you now have access to all content.