project kimchi: 40% bought before the post

On October 22, 2026, the pump.fun token project kimchi ($kimchi) went from a quiet coin of about $360k to a $15.2M peak in about nine minutes, then crashed. The spark was a post by Kimchi (@kimchi1x) showing a poster with the token's QR code, retweeted by Alon (@a1lon9), pump.fun's co-founder, and removed two minutes later.

We traced it with Iris. The short version: a coordinated group of 41 wallets bought about 28% of the supply, most of it 20 to 45 minutes before Kimchi's post, then sold into the hype for +3,288 SOL (about $340k). The token's creator handed half the supply to Kimchi's wallet during the pump, and the same night pump.fun's admin multisig moved an old coin's fee stream to that same wallet.

Every claim below links to the transaction behind it. On-chain times are exact (UTC). Times taken from X are approximate: the posts have since been deleted.

Timeline

1. A group bought before the post

Forty-one wallets acted as one. We grouped them only on hard evidence: they swept their proceeds into the same five collector wallets within the same one or two seconds, or they sold in all ten synchronized waves at 20:37.

• When they bought: 45 buys, about 283M tokens, roughly 28% of the supply, almost all between 19:44 and 20:06. That is 20 to 45 minutes before Kimchi's post, while the coin was still well under $1M with no social activity.
• Only two small member buys came close to the post, at 20:27:15 and 20:28:52, and the group's funding wallet bought 18.25 SOL at 20:26:55. None after the retweet: from then on they only sold.
• Result: they spent 218.8 SOL and received 3,507.0 SOL, +3,288 SOL realized (about $340k).
• They are not fresh wallets. They are months old and run the same trading bot. Their history shows the same crew sniping other new coins and selling in the same kind of synchronized waves.
• They traded through a private program deployed that morning. A router program went live at 12:44 UTC, about seven hours before kimchi existed, deployed by a wallet funded from KuCoin seventeen minutes earlier (tx). It has only 272 transactions, all on October 22, almost all signed by this group, and it takes 10% of every trade: about 259 SOL from kimchi.
• One account funded them. The group's funding wallet, itself funded from KuCoin the evening before (tx), twice deposited to Binance, and 18 to 22 seconds later Binance batch withdrawals paid the same amounts, less fees, to the single-use wallets that funded the group (batch 1, batch 2).

The coin's name, "project kimchi", was also the location field on Kimchi's X profile. Buying that name early and holding over a quarter of the supply for up to 45 minutes on a quiet coin is what you would do if you knew the post was coming. It is also what a speculative sniper crew might do. The chain alone can't tell the two apart.

2. Where the money went

The group swept its proceeds into five collectors at 21:00 to 21:07, then into one hub wallet, which received 3,310.85 SOL (including 645 SOL the operator withdrew from Binance during the action). From the hub:

• 1,650 SOL over the Relay bridge to Ethereum, delivered as 70.93 ETH to 0x963e01F575aB11579A6Ac9816d025231c6fC7BC3 (1,150 SOL, 500 SOL; payouts 49.44 ETH and 21.49 ETH). From there, 44.02 ETH sits untouched at 0x503447da2A6EFD82899fc46211613b8c04C63672, and about 21 ETH went into two Binance deposit addresses.
• 1,013.5 SOL parked at C8MfEr29YxfUKURzFdEYN3LqsQYush9PgSpycnqpW739, untouched since (tx).
• About 635 SOL to Binance through single-use deposit addresses.

3. The creator and Kimchi's wallet

• The creator never sold a token. It bought half the supply at launch, then gave all of it to Kimchi's wallet at 20:29:34, about a minute after the post. That wallet still holds the 500M tokens (50.9% of the supply) and has never sold.
• The creator's only income is 421.5 SOL in creator fees, still in its wallet.
• This was not the first time: on October 20, the same Kimchi wallet received 75% of another "$Kimchi" coin within a minute of its creation, then that coin's creator fees.
• We found no money flow between Kimchi's wallet or the creator and the 41-wallet group.

4. pump.fun's admin action that night

At 22:14:59, a 2-of-20 Squads multisig executed pump.fun's AdminCto instruction, making Kimchi's wallet the creator of "Kimchi Cat", a 2024 coin, in place of its original creator. Kimchi's wallet then collected 24.95 SOL of that coin's accrued fees. That multisig's vault is the address pump.fun's own programs store as the authority allowed to change a coin's creator. Who signed it is not public.

5. One more thread: KuCoin

The same KuCoin hot wallet funded three key wallets within 22 hours: the group's funding wallet (Oct 21, 21:54), the router deployer (Oct 22, 12:27) and the token's creator (Oct 22, 19:31). A hot wallet serves every KuCoin user, so this proves nothing on its own. But it is the one thread that could connect the person who launched the token and gave it to Kimchi with the group that profited, and KuCoin can say whether these three withdrawals came from one account.

Other groups

Two smaller groups traded it too, both funded through Privacy Cash, which Iris traces to the lamport: one made +648.6 SOL from a single 70.448443 SOL deposit at 18:31:40, the other +151.9 SOL from a closed loop that returned its profits to the depositor's own funder. Neither links to the main group.

What we don't know

• The exact times of Kimchi's post and Alon's retweet: both are deleted, and no source we found links them.
• Whether anyone told the group about the post in advance. The timing says someone may have known; the chain doesn't say who.
• Who controls the wallets. Binance and KuCoin can identify the accounts involved. The evidence above is what a request to them would cite.

Questions

• To pump.fun and Alon: why did pump.fun's admin multisig move "Kimchi Cat"'s fee stream to Kimchi's wallet the same night? Was the retweet planned, and who knew about the post beforehand?
• To Kimchi: was the account compromised, as some coverage suggests, and who created project kimchi and sent you half its supply?

Traced with Iris. Explore the board, every wallet clickable: the board. Investigating something similar? iriscan.app.