- Treat Soldrift, Telegram @devbeast5775, and related aliases as a severe security-risk cluster unless independently cleared by forensic audit.
- Any connected tool requesting PRIVATE_KEY, seed phrase, funded wallet, RPC credentials, GRPC_TOKEN, exchange API access, server administrator access, encrypted bot execution, or wallet export capability should be considered unsafe.
- The risk is elevated because the public tool categories involve high-speed Solana trading, HFT, sniping, arbitrage, MEV, volume automation, copy trading, wallet tracking, and exchange-linked automation.
- All timestamps in this report should be recorded in UTC. Local time assumptions should be avoided unless independently verified.
USER-REPORTED SCAM WARNING · UTC OSINT INDEX
Soldrift / devbeast5775
Security Warning and OSINT Index
A dense public security-warning report about Soldrift, Telegram @devbeast5775, related GitHub traces, Solana HFT/sniper/arbitrage tooling, wallet/private-key exposure, phishing-tool risk, KuCoin-linked Solscan wallet leads, and public evidence preservation.
overview
Executive warning
identity
Identity and alias index
Primary online identifierSoldriftMain name used in public GitHub and report context.
Key contact identifierTelegram @devbeast5775Primary handle emphasized for search, OSINT matching, and user warning.
Telegram URLt.me/devbeast5775Public contact trail requiring archival capture.
Related public tracewhistledev411 / @whistle / @soldriftPossible alias, migration, clone-path, or rebranding cluster to monitor.
Wallet leadEfwJn8cXCYhcGrsavxWSDbUFHPrCK9gvdCr6AVywFBPgSolscan account lead submitted by the complainant.
Exchange-linked label observedKuCoin 2Visible in the submitted Solscan screenshot as a transaction counterparty label.
Time standardUTC onlyUse UTC for all event, commit, transaction, screenshot, and archive timestamps.
evidence
Submitted exhibits
- Exhibit A and Exhibit B are submitted profile/avatar records for identity-context documentation.
- Exhibit C is a submitted Solscan screenshot showing account EfwJn8cXCYhcGrsavxWSDbUFHPrCK9gvdCr6AVywFBPg, a high SOL balance at capture time, and recent transfer rows involving KuCoin 2.
- The submitted wallet screenshot is a tracing lead, not standalone proof of wallet ownership, KuCoin API use, HFT operation, bot profit, or criminal intent.
- Every exhibit should be archived with a UTC timestamp, source URL, screenshot hash if available, and a redaction note for private keys, API keys, personal data, and unrelated information.
github
GitHub and tool-cluster index
- Public GitHub traces associated with Soldrift show a broad Solana/Web3 bot portfolio pattern including Pump.fun, PumpSwap, Raydium, Meteora, Orca, Jupiter, sniper, bundler, volume, arbitrage, MEV, copy-trading, wallet-tracking, and exchange-linked tooling.
- whistledev411, @whistle, and @soldrift should be monitored as possible alias, migration, clone-path, contact-label, or rebranding traces because related repository themes and contact patterns may overlap.
- Repository deletion, private conversion, 404 status, renaming, locking, clone-path movement, or account migration should be treated as unresolved risk rather than evidence that the issue is resolved.
- A GitHub account with many repositories and high follower count can create credibility, but it does not prove that private-key software is safe. Wallet-related code must be independently audited.
Tool-category matrix
| Launch tools | Pump.fun, PumpSwap, launch automation, bundler, first-buy, 0-block claims | High risk when combined with private keys or funded wallets. |
| Trading bots | HFT, sniper, arbitrage, MEV, copy-trading, wallet tracking | High risk when combined with live execution and hidden networking. |
| Volume tools | Raydium volume, Dexscreener trending, maker bots, multi-wallet automation | May indicate market-manipulation-like or abusive activity. |
| Exchange-linked tools | KuCoin API, exchange routing, arbitrage execution | Requires exchange key exposure; must be independently verified. |
| Phishing-like tools | Wallet connection, private-key input, casino/gambling bots, Axiom/Polymarket claims | Severe risk when secrets or funds are requested. |
wallet
Solscan wallet and KuCoin-linked lead
- The Solscan account lead is EfwJn8cXCYhcGrsavxWSDbUFHPrCK9gvdCr6AVywFBPg.
- The complainant alleges that visible KuCoin-linked transfer patterns may indicate KuCoin API-based high-performance arbitrage or HFT activity generating significant profit.
- This report records that allegation as an investigative lead only. The screenshot does not independently prove who controls the wallet, whether KuCoin API was used, whether the activity is HFT, or whether any profit came from a bot.
- Recommended lawful OSINT steps: preserve transaction hashes, compare UTC timestamps, map exchange deposit/withdrawal patterns, archive counterparties, and avoid doxxing, account intrusion, or unauthorized access.
on-chain tx evidence
Confirmed on-chain wallet-cluster evidence
Newly submitted Solscan transaction evidence links the reported victim-fund receiving wallet, an intermediate routing wallet, and a high-balance arbitrage/API-style wallet into the same operational fund-flow cluster.
Victim-fund receiving walletE8RcJDs3SaBP2udWy6bD7576zJ3WitfbVh16vgeqoAgiUser-reported wallet where the stolen funds entered.
Intermediate / routing walletGLoyGTsJiS3iDAV66NNsiRWkm1VU6H6UjaywmNdaxs4LWallet used in the observed transfer route after the victim-fund wallet.
High-balance arbitrage / API-style walletEfwJn8cXCYhcGrsavxWSDbUFHPrCK9gvdCr6AVywFBPgWallet reported to have held over USD 30,000 at observation time and then shown automated/arbitrage-style activity.
Observed fund-flow route
- Reported flow: victim funds entered the first wallet, were routed through the intermediate wallet, and are connected through the listed TXIDs to activity involving the high-balance arbitrage/API-style wallet.
Transaction evidence
| Item | Solscan transaction / account link | Relevance |
| TX 1 | 33Jc35XrQwhFAZN93Gcsyi2a3Zb9ujgxNeSPcD2xUMzcQ3b18kqCUHHhUdzzAY5dNDgQHSfqFM7RshX7A4KvCnKW | Submitted TXID for the reported fund-flow route connecting the victim-fund cluster to the arbitrage/API-style wallet activity. |
| TX 2 | 2Zm267N9eDAbvLX3WooJYmLc5YCkNKyBitV6CRn3HBApxEFHMc7tBuLtHXEcAjmjDhsDz3aBfEefK7HdKPuT8um7 | Submitted TXID for the reported fund-flow route connecting the victim-fund cluster to the arbitrage/API-style wallet activity. |
| TX 3 | 3beyL4Um4Wt9duWbCQrStySMdLF33k5QAP1h49VQkE6PTJaHtp36G3JGnTjmVDZ7RcY4z1v8C7ngnNnvHK9wkoqV | Submitted TXID for the reported fund-flow route connecting the victim-fund cluster to the arbitrage/API-style wallet activity. |
| Efw account | EfwJn8cXCYhcGrsavxWSDbUFHPrCK9gvdCr6AVywFBPg | Account page for the high-balance wallet connected to the submitted TX evidence. |
Compliance significance
This evidence should be reviewed as a direct on-chain operational link, not as a standalone court finding. It strongly supports treating the victim-fund wallet, the intermediate wallet, and the arbitrage/API-style wallet as a connected wallet cluster for exchange compliance, law-enforcement preservation, and scam-report review.
- Review whether these wallets connect to the same KuCoin account, API credentials, KYC profile, IP/device logs, deposit records, withdrawal records, linked accounts, or trading infrastructure.
- Preserve the exact TXIDs, Solscan links, timestamps, sender/receiver rows, amounts, screenshots, and any signer/fee-payer/actor fields visible in the transaction details.
pre-incident statement
Pre-incident HFT arbitrage bot claim and tool-upgrade statement
A newly added user-reported timeline item records that, only hours before the incident, the reported individual allegedly claimed that he could earn approximately $2,000 per day through an HFT/arbitrage bot, stated that he wanted to see the victim's launch succeed, and said that he had heavily upgraded the tool for that purpose.
This screenshot turns the HFT/arbitrage claim from a timeline allegation into a visible chat exhibit that should be preserved with UTC timestamp, source context, and the original Telegram export if available.
Claimed trading capabilityHFT / arbitrage bot income claimReported statement: approximately $2,000 per day from high-frequency arbitrage-style bot activity.
Tool-upgrade timingHours before the incidentThe reported upgrade statement immediately preceded the later fund-loss event and on-chain tracing findings.
Connected wallet contextEfwJn8cXCYhcGrsavxWSDbUFHPrCK9gvdCr6AVywFBPgHigh-balance arbitrage/API-style wallet later linked by the wallet-cluster TX evidence.
Why this statement matters
- The statement is relevant because it links claimed technical capability, claimed HFT/arbitrage infrastructure, a last-minute tool upgrade, and the later on-chain fund-flow route.
- Shortly after the claimed upgrade, the incident occurred, and the submitted TX evidence connected the victim-fund route to the high-balance arbitrage/API-style wallet.
- The timing raises serious concern that the tool upgrade may have included hidden malicious logic, unauthorized access capability, wallet/key-handling abuse, or a backdoor-like mechanism.
- This section records the statement as an investigative lead requiring forensic review of the delivered source code, VPS/server logs, deployment history, environment variables, wallet/key-handling logic, and outbound network calls.
This report does not rely on the statement alone as proof of code-level compromise. The significance comes from the combined timeline: pre-incident HFT/arbitrage claim, tool-upgrade statement, trusted developer/server access, post-incident non-response, and the later Solscan wallet-cluster evidence.
threat
Threat model and suspected monetization path
- Suspected monetization path: credibility building through public GitHub repositories, followed by private Telegram sales of high-demand Solana trading tools.
- Potential exposure path: user runs a tool that requests PRIVATE_KEY, RPC keys, GRPC_TOKEN, exchange API access, or server administrator access.
- Potential persistence path: tool installs background services, PM2 processes, crontabs, systemd units, hidden startup scripts, webhooks, remote logging, or encrypted packages.
- Potential rebranding path: after exposure, the operator may rotate Telegram handles, GitHub usernames, repository names, clone URLs, profile images, or README language.
- Potential profit path alleged by the complainant: exchange-linked HFT/arbitrage execution, KuCoin-linked transfer flow, Solana bot automation, and high-frequency wallet activity. This requires independent verification.
redflags
Technical red flags
- PRIVATE_KEY or seed phrase request
- Funded wallet request
- KuCoin or exchange API key request
- RPC key, GRPC_ENDPOINT, or GRPC_TOKEN request
- Server root/admin access request
- Encrypted or obfuscated bot package
- Compiled binary without reproducible build instructions
- Hidden outbound network request
- Telegram or Discord webhook
- Remote logging endpoint
- Wallet export or key-transfer logic
- Guaranteed profit, guaranteed speed, first-buy, or 0-block claim
- Dexscreener trending or volume manipulation claim
- Raydium volume or maker manipulation claim
- Polymarket win-rate or prediction-market manipulation claim
- Axiom trading advantage claim
- Casino, gambling, wallet-drainer, or phishing-like bot claim
asia
Asia-Pacific caution notice
- Activity windows and broken-English usage may be OSINT notes, but they do not prove Korean, Asian, or any specific nationality.
- Because the reported contact pattern, Telegram sales, GitHub activity, and Solana bot offers may overlap Asia-Pacific users and time zones, Asian crypto communities should treat this identity cluster as high risk.
- Users in Korea, Japan, China, Southeast Asia, and the broader Asia-Pacific region should be especially cautious with Telegram-based HFT, sniper, arbitrage, private-key, and wallet automation offers connected to this cluster.
- This warning is directed at risk prevention, not ethnicity, nationality, or regional profiling.
tracking
Reverse-tracking search index
Soldrift devbeast5775Telegram @devbeast5775devbeast5775 Telegramt.me/devbeast5775Soldrift GitHubwhistledev411@whistle@soldriftSolana HFT bot warningSolana sniper bot warningSolana arbitrage bot warningSolana MEV bot warningSolana wallet tool scamSolana phishing tool warningKuCoin API arbitrage botKuCoin Solana arbitrageRaydium volume botDexscreener volume botDexscreener trending botPolymarket botPolymarket win-rate botAxiom trading botcasino phishing botwallet drainer warningJito bundler botYellowstone gRPC sniper botGRPC_TOKEN Solana botPRIVATE_KEY Solana botVPS root access developer scam
actions
Immediate security actions
- Do not run any related bot on a funded machine.
- Do not paste a valuable private key into any .env file, website, Telegram bot, dashboard, compiled binary, encrypted package, or VPS.
- Use only a disposable sandbox machine and an empty test wallet.
- Rotate all exposed API keys, RPC keys, gRPC tokens, GitHub tokens, server passwords, and wallet keys.
- Remove unknown SSH keys, PM2 processes, crontabs, systemd services, hidden startup scripts, and unexpected background services.
- Search the codebase for outbound requests, webhooks, base64 blobs, dynamic execution, wallet export logic, private-key storage, and remote logging.
- Archive public evidence with UTC timestamps and report suspicious repositories through proper platform channels.
preservation
Evidence preservation protocol
- Preserve public repository URL, owner name, README text, repository description, topics, commit timestamps, release files, package names, screenshots, demo links, and fork relationships.
- Preserve Telegram handle, displayed contact addresses, public payment wallets, transaction hashes, Solscan pages, exchange labels, and UTC screenshot timestamps.
- Do not publish private keys, seed phrases, API keys, unrelated private messages, private addresses, phone numbers, or unsupported personal information.
- Use correction-friendly wording. Separate user-confirmed experience from court-confirmed legal conclusions.
- Record each update with UTC date, source URL, short description, and whether the evidence is screenshot-based, repository-based, blockchain-based, or user-submitted.
sources