← All Reports

CATFI Rug Pull Investigation: Korean Crypto Scam Network

📅 2025-05-29
rug-pull korea catfi scam

South Korea CATFI Rug Pull - Investigation Report

Date: May 29, 2026

Case ID: ONCHAIN-2026-0529-003

Project: CATFI (Catpie) - Solana memecoin

Status: Criminal Indictment (May 27, 2026)

Executive Summary

South Korean prosecutors have achieved a landmark legal victory by successfully prosecuting what is being called the country's first criminal case targeting a decentralized exchange (DEX) rug pull. Five suspects have been indicted under the Virtual Asset User Protection Act for defrauding 256 investors of approximately $600,000 through a Solana-based memecoin called CATFI.

This case establishes that DEX rug pulls ARE prosecutable under existing law.

Case Timeline

| Date | Event |

|------|-------|

| Feb 2025 | CATFI token launches, surges to $8.99M market cap |

| ~26 hours post-launch | Price pump 1,001x (coordinated) |

| Post-pump | Liquidity rug executed |

| May 11, 2026 | Five suspects arrested by Seoul police |

| May 27, 2026 | Formal indictment by Seoul Southern District Prosecutors' Office |

Financial Summary

| Metric | Amount |

|--------|--------|

| Investor Losses | ~900 million KRW (~$600,000 USD) |

| Suspect Profits | ~400 million KRW (~$260,000 USD) |

| Number of Victims | 256 investors |

| CATFI Market Cap (Peak) | $8.99 million |

| CATFI Market Cap (Current) | $57,000 (99% crash) |

| Tokens Still Held | 1,512 investors |

Suspect Details

| Role | Alias | Status |

|------|-------|--------|

| Ringleader | "Eth Father" | Arrested, Indicted |

| Accomplice 1 | Unknown | Arrested, Indicted |

| Accomplice 2 | Unknown | Arrested, Indicted |

| Accomplice 3 | Unknown | Arrested, Indicted |

| Accomplice 4 | Unknown | Arrested, Indicted |

Legal Authority: Seoul Southern District Prosecutors' Office - Virtual Asset Crime Joint Investigation Division

How the Scheme Worked

Phase 1: Pre-Loading

Suspects + Insiders → Load heavy CATFI tokens before public launch

Park ("Eth Father") and associates loaded wallets with CATFI tokens BEFORE any public trading began, giving them outsized positions.

Phase 2: Wash Trading

Suspect Wallet A → Buy CATFI → Sell CATFI → Suspect Wallet B

Circular buys and sells between their own wallets to:

  • Fake trading volume
  • Create artificial price movement
  • Attract attention from traders/bots

Phase 3: Price Manipulation

| Time | CATFI Price Action |

|------|-------------------|

| Launch | Baseline price |

| 26 hours later | 1,001x increase |

| Method | Coordinated wash trades |

Phase 4: Exit (Rug Pull)

Suspects → Remove liquidity pool → Price → $0

Once retail investors piled in attracted by the artificial pump, the team:

  • Pulled all liquidity from the DEX pool
  • Collapsed the token price
  • Walked away with ~$260,000

Phase 5: Cash-Out

Crypto profits → CEX conversion → Fiat → Identity revealed

The "Eth Father" persona and multiple wallets didn't provide real anonymity once the suspects tried to convert crypto to Korean won through regulated exchanges.

Legal Analysis

Why This Case Is Different

#### Before CATFI:

  • South Korea's Virtual Asset User Protection Act (effective July 2024) had been used mostly against centralized platforms
  • Bithumb and ACE token cases were the reference points
  • DEXs were considered a "gray zone" due to:

- No mandatory issuer disclosures

- Pseudonymous wallets

- No central operator to subpoena

#### CATFI Precedent:

Prosecutors argued that conduct itself constitutes fraud and market manipulation regardless of centralization:

| Element | Traditional Case | CATFI Case |

|---------|-----------------|------------|

| Exchange | Centralized CEX | DEX |

| Operator | Identifiable entity | Pseudonymous |

| Evidence | Server records | On-chain data |

| Outcome | ❌ Blocked | ✅ Indictment |

The unfair-trading provisions of the Virtual Asset User Protection Act now officially apply to DEX-based operations.

How Investigators Pierced the Anonymity

On-Chain Forensics

  • Wallet clustering: Mapped connected addresses to suspects
  • Trading pattern analysis: Identified wash trades
  • Transaction timing: Correlated with social media promotion

    • The Critical Breakthrough

    Pseudonymous wallets → CEX conversion → Identity revealed

    When suspects converted crypto profits to fiat, they had to use regulated gateways (Korean CEXs with mandatory KYC). That's where the anonymity wall cracked.

    The Role of Financial Services Commission

    Initially, investigators almost dropped the case after suspects claimed they'd been "hacked" (a common excuse in crypto fraud).

    The Financial Services Commission (FSC) intervened:

    • Re-referred the matter for prosecution
    • Triggered full forensic review
    • Coordinated with financial and tax authorities
    • Ultimately secured the indictment

    Regulatory Context: South Korea's Crypto Framework

    Recent Measures

    | Regulation | Status |

    |------------|--------|

    | Virtual Asset User Protection Act | In effect since July 2024 |

    | 5-minute reconciliation requirements | Implemented |

    | Automated kill switches on crypto platforms | Implemented |

    | Digital Asset Act (100% stablecoin reserves) | In development |

    What This Means

    South Korea is systematically closing the gap between centralized and decentralized crypto enforcement. DeFi is no longer a regulatory sanctuary.

    Largest Holder Analysis

    Wallet "5Q54": Largest CATFI holder

    Current holdings: Significant % of remaining market cap
    

    Status: Under investigation

    Community Impact

    Victim Statements

    1,512 investors still holding CATFI tokens in hopes of recovery, despite:

    • 99% price decline
    • No liquidity available
    • Criminal prosecution ongoing

    Typical Victim Experience

  • Saw "Eth Father" promoting CATFI on social media
  • Saw price surging 1,001x in 26 hours
  • FOMO'd in during the pump
  • Token crashed when liquidity was removed
  • Left holding worthless tokens

    • ZachXBT Angle

    This case deserves analysis coverage because:

    • ✅ Legal precedent for DEX rug pull prosecution
    • ✅ Clear on-chain evidence of wash trading
    • ✅ Wallet clustering methodology demonstrated
    • ✅ Shows regulatory teeth against DeFi fraud
    • ✅ Precedent for global enforcement

    Recommended angle: Compare CATFI prosecution to other major rug pulls that went unpunished. Highlight the on-chain forensics that cracked pseudonymous anonymity.

    Lessons for Investors

    Red Flags Missed

    | Signal | Why It Matters |

    |--------|----------------|

    | 1,001x price increase in 26 hours | Physically impossible without manipulation |

    | "Eth Father" persona | Pump-and-dump playbook |

    | Unknown team | No accountability |

    | Solana memecoin | Highest rug pull risk category |

    | Wash trading indicators | Coordinated manipulation |

    Protection Strategies

  • Research team identity - Legitimate projects reveal founders
  • Check trading volume - 1,001x pump = guaranteed dump
  • Avoid memecoins - 99% are designed to transfer wealth to insiders
  • Use blockchain explorers - Look for wash trading patterns
  • Trust the blockchain, not social media - Anyone can fake a persona

    • Conclusion

    The CATFI prosecution is a watershed moment for crypto enforcement worldwide. It proves:

  • DEX rug pulls are prosecutable under existing law
  • Pseudonymous ≠ anonymous when cash-out requires KYC
  • On-chain forensics can provide prosecutable evidence
  • Regulatory coordination (FSC + prosecutors + tax authorities) is effective
  • DeFi is no longer a regulatory free zone

    • Key Takeaway: The days of anonymous DEX rug pulls with zero consequences may be numbered.

    Data Sources

    • The Currency Analytics (https://thecurrencyanalytics.com/ponzi-scams/south-koreas-first-dex-rug-pull-case-nets-five-suspects-in-solana-memecoin-fraud-261415)
    • Cointelegraph (https://cointelegraph.com/news/south-korea-first-arrest-memecoin-rug-pull-report)
    • Digital Asset Works (Korean legal news)

    Investigation conducted by on-chain-shadow

    Report generated: May 29, 2026

    GitHub Pages: https://onchain-shadow.github.io/on-chain-investigations/