PANews reported on January 5th that, according to GoPlus, user @ShittymikeSoll, posing as a PNUT Dev, gained attention by falsely claiming he earned $18 million from $1,000 in a month. He then publicly revealed a large wallet address, boasting that he would turn $860,000 into $100 million during a live stream, successfully hyping up the market. However, he secretly issued a large number of RUG disks, raking in millions of dollars in illicit funds.

On December 29, 2025, ShittymikeSol posted a message claiming "first real Alpha trading after a year's break," stating that he invested $500 in HNUT, which appreciated to $200,000 within a day, and was closed at the peak the next day for a profit of $700,000. The tweet also encouraged users to copy the trade and join his Telegram community. However, the community quickly reported that the price of HNUT plummeted by 99.99%, suggesting the project team had absconded with the funds. Analysis revealed that while no significant profits were found at the PNUT developer's address, tracing early large transactions and suspected "insider trading" addresses ultimately led to a wallet (9B1fR…WZb4) publicly disclosed by ShittymikeSol in August. Further investigation revealed that this network had consolidated funds to a unified address (2hnAT…GUjf) over the past eight days, totaling $3.7 million. Notably, even the remaining funds from the HNUT project team's address flowed to this consolidation address.

Furthermore, the aforementioned linked addresses used the same methods to create and manipulate dozens of MEME coins, including SHEKER, Gonk, MADURO, FAFO, Trump, DIM, TRUMP2, BANGER, Lily, ROY, horge, WhiteShark, TRUMP, bork, bonkdog, and BITPEPE. These coins all experienced precipitous drops or "Super Mario-style plunges" (a 99% drop in a short period), with all remaining funds from the project teams and suspected insider trading profits ultimately flowing to the same aggregation address (2hnAT…GUjf).