Forensic Cluster Analysis Report
RAVE Token: 9-Wallet
Cluster Investigation
Independent on-chain analysis prompted by ZachXBT's April 18, 2026 bounty thread on RAVE manipulation.
April 28, 2026 · ChainTracing · Report CT-RAVE-2026-04
⚡ Executive Summary
Wallets analyzed
9
ZachXBT published list
Intra-cluster txs
23
Documented transfers
RAVE moved
1.11B+
Exceeds 1B total supply
CEX deposits
11.99M
To flagged addresses
Gap to collapse
6 days
Apr 12 activity, Apr 18 crash
Nine wallets from ZachXBT's published April 18, 2026 bounty thread were analyzed against on-chain data for the RAVE token contract 0x17205fab...370db97. The analysis documents 23 intra-cluster transfers, a programmatic pattern of identical 4,436,111 RAVE transfers repeated four times, and direct deposits from cluster wallet I to the exact Bitget and Gate addresses ZachXBT named as exchange-side evidence.
The deposits occurred on April 12, 2026, six days before the 95% price collapse. RaveDAO publicly denied involvement on April 18, 2026. That denial is directly contradicted by the documented on-chain activity of wallet I (0x53d7d523...F3487b), which is a named member of the cluster.
Intra-Cluster Flow Diagram
Nine wallets (A through I) form a directed graph. Wallet A acts as the primary hub receiving supply from D and distributing to B, C, and H. Wallet C distributes further to I, D, F, and E. Wallet I deposits directly to ZachXBT-flagged CEX addresses.
Key Findings
Cluster setup: 5-wallet path tests in a 90-minute window (Oct 30, 2025)
Five wallets exchanged 1 RAVE each between 10:14 and 11:34 UTC on October 30, 2025. Notably, the 10:14 transaction (0x915806be) emitted two Transfer events simultaneously, A to C and A to H in the same tx, which is consistent with a scripted batch sender rather than manual execution. The test-then-transact pattern is a known OPSEC technique for confirming transfer paths before bulk movement and is repeated on Nov 20, 2025 (D to A) and April 12, 2026 (CEX deposits).
76.97% of supply moved D to A on Nov 20, 2025, preceded by 1-RAVE test 3 minutes prior
Wallet D transferred 769,699,999 RAVE to wallet A in tx 0x940939f1 on November 20, 2025 at 03:13 UTC. Three minutes earlier at 03:10 UTC, D sent A a 1 RAVE test transfer (0x1eefc336) using the same path-confirmation pattern documented on October 30. This transfer represents 76.97% of the 1,000,000,000 RAVE total supply and confirms D as the dominant supply holder feeding the hub.
Programmatic identical-amount transfers: 4 x 4,436,111 RAVE from A to C
Wallet A transferred exactly 4,436,111 RAVE to wallet C on January 21, February 22, and twice on April 12, 2026. The amount is not a round number and repeats verbatim four times across three months. This is programmatic behaviour, not manual execution. The April 12 pair (09:19 and 09:21 UTC) were two minutes apart.
Smoking gun: CEX deposits to ZachXBT-flagged addresses on April 12, 2026
Wallet I deposited 11,993,923 RAVE across six transactions to the exact Bitget address (0x2dc20f21...031b) and Gate address (0x31711246...353) that ZachXBT identified. Two of the six were 10,000 RAVE test transactions before larger deposits, matching the Oct 30 test pattern. All activity occurred within a 4-hour window.
Six-day gap between cluster activity and price collapse
All documented cluster activity falls on April 12, 2026. RAVE collapsed 95% within 24 hours on April 18, 2026, the same day ZachXBT published his bounty thread. The six-day gap is consistent with exchange-side distribution preceding the open-market dump.
RaveDAO public denial contradicted by on-chain evidence
RaveDAO denied involvement on April 18, 2026. Wallet I is a named member of the cluster ZachXBT publicly listed. Its direct deposits to the ZachXBT-flagged Bitget and Gate addresses six days prior are a documented, publicly verifiable on-chain record. The denial does not address this evidence.
Full Transaction Timeline
Address Intelligence
RAVE In
1.77B
RAVE Out
1.02B
Tx Count
14
Primary distribution hub; largest intra-cluster volume
RAVE In
168M
RAVE Out
69M+
Tx Count
9
Identical-amount transfers from A; 4 x 4,436,111 RAVE
RAVE In
825M
RAVE Out
825M
Tx Count
5
Perfect pass-through: 825M in, 825M out
RAVE In
10
RAVE Out
0
Tx Count
1
Received 10 RAVE test ping only; inactive
RAVE In
5M
RAVE Out
0
Tx Count
1
5M RAVE held; no outbound activity observed
RAVE In
38,658,406
RAVE Out
20,000,000
Tx Count
13
Funded April 11, 2026 from non-cluster addresses (primarily 0x1ab4973a); sent 20M to external 0xe077490da on Apr 12. No observed intra-cluster RAVE flows in this analysis.
RAVE In
35M
RAVE Out
11.99M
Tx Count
7
Received 35M from C on Nov 2, 2025; deposited 11.99M to ZachXBT-flagged Bitget and Gate addresses on Apr 12, 2026; remaining approx. 23M held or moved off RAVE.
Methodology
Data source
Etherscan V2 API queried against RAVE token contract 0x17205fab...370db97. On-chain Transfer event logs were indexed for each of the nine wallet addresses ZachXBT published.
Date range
Token deployment through April 28, 2026. All timestamps are UTC.
Limitations
This analysis covers Ethereum mainnet activity only. BSC-side activity (where the Binance Alpha listing occurred) requires a separate investigation and is not reflected here. Some wallets may hold additional non-RAVE Ethereum activity not analyzed in this report.
Identity claims
This report makes no claim about the real-world identity of any wallet operator. On-chain patterns and transaction data are publicly verifiable facts. Characterizations such as "programmatic" or "coordinated" are analytical interpretations clearly labeled as such.
Recommendations
- 1
For ZachXBT and investigators
Cluster wallet I (0x53d7d52301366DC14E1916b14eFeC1aDD8F3487b) directly deposited 11,993,923 RAVE to the Bitget address (0x2dc20f21...031b) and Gate address (0x31711246...353) named in your bounty thread on April 12, 2026, six days before the collapse. This is the strongest documented link between the published 9-wallet cluster and the suspected exchange-side activity. The test-then-transact 10,000 RAVE deposits match the Oct 30 cluster-setup pattern, suggesting the same operator.
- 2
For Bitget and Gate compliance teams
Review deposits from address 0x53d7d52301366DC14E1916b14eFeC1aDD8F3487b on April 12, 2026 between 11:47 and 15:39 UTC. Six deposits totaling 11,993,923 RAVE arrived at your custody addresses during this window. KYC documentation linked to those deposits identifies the account holder and, by extension, the cluster operator.
- 3
For retail traders
Any token launch where five or more wallets exchange 1-unit transfers in a short window before listing is a coordinated cluster, not organic distribution. The Oct 30 path-confirmation pattern documented here is a repeatable signature. Future token investigations should flag this pattern at the screening stage.
- 4
For RaveDAO
A public denial without addressing the on-chain evidence is not credible. The minimum step toward credibility is a direct response to the wallet I deposits specifically: what is the relationship between the RaveDAO team and wallet 0x53d7d52301366DC14E1916b14eFeC1aDD8F3487b, and who controls the Bitget and Gate accounts that received those funds.
ChainTracing
Generated April 28, 2026 · Report CT-RAVE-2026-04
Independent forensic analysis. No payment received from any party.
On-chain data sourced from Etherscan V2 API. All transaction data is publicly verifiable. This report is provided for investigative and educational purposes. ChainTracing makes no claim about the real-world identity of any wallet operator.