The $LIBRA Playbook: How One Cluster Drained $87 Million in a Single Hour
On February 14, 2025, the president of Argentina, Javier Milei, released just one tweet, supporting the launch of a new Solana meme token known as $LIBRA. In less than two days, the price of the token soared up to a valuation of about $4 billion. Just days later, the token had practically no value at all, leaving investors with losses exceeding $250 million. Cryptogate became the name of the story which turned into the first-ever political scandal during the term of presidency of Javier Milei.
This is what Bubblemaps observed when $LIBRA was launched and continued observing in the following year.
The warning signs were visible from minute one
Within one hour of its launch, our analysts identified three red flags that, taken together, indicated a coordinated extraction operation was underway:
- 82% cluster concentration. Virtually all of the coin's supply was concentrated in a single wallet cluster, which is completely unprecedented for any organically launched meme coin.
- Zero tokenomics released. There was zero vesting schedule, no treasury allocation, nor any roadmap.
- Fee production way out of line with the trading volume. $LIBRA liquidity pools generated over $25M in fees within one hour of the launch.
The $25M figure was an obvious sign something was up. Dynamic pools on Meteora do not generate $25M in fees per hour from retail activity. Such a high fee cost can only come from minting coins against buy pressure or setting up trades to siphon liquidity off the counterparty. We made our alert public. The first response threads consisted of many traders labeling it "another crime season."
We were absolutely right to be concerned.
The exit: $87 million in an hour, with no selling required
By the early hours of February 15, 2025, the team had begun their exit. The mechanism they used is worth understanding, because it is the playbook that has since been repeated across dozens of meme coins in 2025 and 2026.
Instead of dumping $LIBRA on the open market, which would have triggered sharp price impact and tripped on-chain alarms, the deployers did the following:
- Added one-sided liquidity pools on Meteora containing only $LIBRA.
- Simultaneously removed USDC and SOL from the existing pools.
The net effect is a swap. The team trades their $LIBRA inventory for the USDC and SOL sitting on the other side of the pool, with essentially zero price slippage. From the chart's perspective, the token simply "drifts" lower. From the chain's perspective, tens of millions of dollars are moving out of the contract in clean, signed transactions.
By the time we published the thread, the team had already extracted roughly $87 million in USDC and SOL. The breakdown:
- 148,343 SOL (~$29.6M at the time) sent to B9KTwx...
- 69,275 SOL (~$13.8M) sent to FTjLYk...
- 891.5K USDC sent to DtkvLX...
- 907.7K USDC sent to 8DgzQs...
- 42.79M USDC sent to 61yKS9b... (labelled on-chain as "Squad Vault 'Milei CATA'")
The token was down 85%. The thread ended with a line that has aged well: "still $500M more to go."
The MELANIA link
The $LIBRA story might have ended there, as just another meme coin rug, if not for a piece of evidence that connected it to a much larger pattern.
A few days after the crash, we identified a wallet, 0xcEA on Ethereum, that had been the funding source for both the $LIBRA deployer and the $MELANIA deployer. Cross-chain transfers, CEX deposit overlap, and shared funding patterns made the link hard to argue with. We published the analysis alongside Coffeezilla, and the conclusion was straightforward: the same team had built both tokens.
That team, on-chain forensics and subsequent court filings confirmed, was led by Hayden Davis, operating through Kelsier Ventures. Davis is also known by the alias "Kelsier." Once we had 0xcEA pinned to him, the rest of the picture snapped into focus.
The wider playbook
Once you have a cluster pinned to a person, you can ask a different question: what else has this cluster done?
The answer, in the months that followed, was an unending series of tokens. $HOOD (link). $TRUST. $KACY. $VIBES. Each one launched with the same structure: heavy bundling at deploy, multiple wallets sniping the first block, a quick run to a market cap in the tens of millions, then a rug. $LIBRA was simply the one that hit the biggest, because of Milei's tweet.
In March 2025, with Davis now on an Interpol red notice, he launched $WOLF, supposedly tied to Jordan Belfort, the "Wolf of Wall Street." We traced the $WOLF deployer wallet 6MsuHd through 17 intermediary addresses and 5 cross-chain transfers. Every hop led back to the same place: 0xcEA. The bubble map of $WOLF's holder distribution was, to our eyes, structurally identical to the maps we had published for $HOOD and $MELANIA. Same clustering. Same bundling ratios. Same operator.
Even when Davis wasn't launching tokens himself, his wallets were active. Our investigation into the $TRUMP launch in January 2025 had already exposed how the sniping economy around these tokens works. Wallets tied to a trader known as "@naseem" had sniped $TRUMP within the first second of trading and walked away with more than $100 million in profit. The same cluster had previously profited on $LIBRA itself ($0.5M from the cGxeY address), as well as $HAWK, $ENRON, and $SHROOM. The launch infrastructure around these tokens is professionalized. The same sniper ring that fed off Davis's launches was, in some cases, being paid to feed into them.
The aftermath
The $LIBRA story did not end at the cash-out.
In August 2025, a U.S. judge ruled in favour of unfreezing $57 million in USDC tied to the case. The reasoning: Hayden Davis and his co-defendant Ben Chow were not deemed evasive, there was no proof of irreparable harm, and the underlying case was unlikely to succeed on its merits. Our coverage that day ran under a headline that captured it plainly: "CRIME IS LITERALLY LEGAL." Davis and Chow regained legal access to the funds.
A few months later, the wallets began moving again. In November 2025, two addresses from the original $LIBRA cluster DefcyKc... and 61yKS9b... came active for the first time in nine months. Together they swapped $60 million in USDC for SOL. We mapped the cluster publicly and asked what seemed like the obvious question: was Hayden Davis a Solana bull now?
By February 2026, the trading activity offered a partial answer. Davis was back to actively trading, this time buying trending Solana meme coins including $PUMP, $TROVE, $PENGUIN, and others. The cluster had six active wallets over the previous 30 days, with deposits flowing back into CPGZ1i, an address that had been quiet since a $YZY snipe earlier in 2025. The twist: he was down roughly $3 million on the recent activity, with $2.5 million of that on $PUMP alone.
What we are still watching
$LIBRA is one of the largest meme coin rugs by total losses in crypto history. The 82% cluster, the empty tokenomics page, the impossible fee generation: each signal was sitting on the block explorer for anyone with the knows to read it.
What made $LIBRA different was not the technique. It was the political endorsement, which turned what would have been a $50 million local scam into a $4 billion global one. The playbook is the playbook. The address is the address. The pattern repeats, with or without a presidential tweet.
We will keep following the cluster. The wallets are still active. The funds are still moving. And as long as people keep launching tokens, the same group of onchain analysts will keep watching where the money actually goes.🫡
